密码infected[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

密码infected.rar
Size

105KB
MD5

73b07ccdcecd3d3a7031d34e4c2be223
SHA1

ac3b8787c669ca7ca19e79aaddc807c7646b4738
SHA256

f5ac56f727c588c1db70388db71595157b10e1b9fb8d3dbf7701bcb5b3d5c5b8
SHA512

8747d9e07926600c8fadf72075c5d55a394e940283534efffed5bdef94d0ebb1bda911baf77d1216ad6dd309617850a699b570095a986eea0eaeb9934ec3ff1b
SSDEEP

3072:a6A5+Reac6A5rJlWPp6A5+Reac6A5rJlWPFzM0:a62PavAX4Pp62PavAX4PFzN

Score

1^/10

Malware Config

Signatures

Files

密码infected.rar
.rar
密码infected/32/InstallShield.87FHD.exe
.exe windows:5 windows x64 arch:x64

affa2f94d00b1c91617b7450de103626

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9b:26:0e:e9:14:7f:4d:0d:f8:de:ff:db:bb:0a:56:42
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

30/12/2015, 00:00

Not After

29/12/2018, 23:59

Subject

CN=Code Systems Corporation,O=Code Systems Corporation,POSTALCODE=98109,STREET=1000 DEXTER AVE N STE 502,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:48:d6:ea:65:16:82:71:2d:d3:26:a0:69:94:52:46:c2:bf:c9:33
Signer

Actual PE Digest

45:48:d6:ea:65:16:82:71:2d:d3:26:a0:69:94:52:46:c2:bf:c9:33

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
GetModuleHandleW
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
GetCurrentProcess
OpenProcess
GetLastError
DuplicateHandle
GetCommandLineW
OpenFileMappingW
MapViewOfFile
SetEvent
UnmapViewOfFile
CloseHandle
GetVersionExW
GetSystemInfo
VirtualQuery
GetCommandLineA
CreateFileW
CreateFileMappingW
GetFileSizeEx
VirtualAlloc
VirtualFree
LoadLibraryW
ExitProcess
GetModuleHandleA

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 16.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
密码infected/32/Readme.txt
密码infected/64/InstallShield.87FHD.exe
.exe windows:5 windows x64 arch:x64

affa2f94d00b1c91617b7450de103626

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9b:26:0e:e9:14:7f:4d:0d:f8:de:ff:db:bb:0a:56:42
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

30/12/2015, 00:00

Not After

29/12/2018, 23:59

Subject

CN=Code Systems Corporation,O=Code Systems Corporation,POSTALCODE=98109,STREET=1000 DEXTER AVE N STE 502,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:48:d6:ea:65:16:82:71:2d:d3:26:a0:69:94:52:46:c2:bf:c9:33
Signer

Actual PE Digest

45:48:d6:ea:65:16:82:71:2d:d3:26:a0:69:94:52:46:c2:bf:c9:33

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
GetModuleHandleW
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
GetCurrentProcess
OpenProcess
GetLastError
DuplicateHandle
GetCommandLineW
OpenFileMappingW
MapViewOfFile
SetEvent
UnmapViewOfFile
CloseHandle
GetVersionExW
GetSystemInfo
VirtualQuery
GetCommandLineA
CreateFileW
CreateFileMappingW
GetFileSizeEx
VirtualAlloc
VirtualFree
LoadLibraryW
ExitProcess
GetModuleHandleA

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 16.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
密码infected/64/Readme.txt
密码infected/t01263854eafe661d1a.jpg
.jpg
密码infected/木马网站.url
.url

Sharing

General

Malware Config

Signatures

Files

affa2f94d00b1c91617b7450de103626

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

9b:26:0e:e9:14:7f:4d:0d:f8:de:ff:db:bb:0a:56:42Certificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

45:48:d6:ea:65:16:82:71:2d:d3:26:a0:69:94:52:46:c2:bf:c9:33Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 60KB - Virtual size: 60KB

.data Size: - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 360B

.rsrc Size: 1024B - Virtual size: 944B

.reloc Size: 512B - Virtual size: 16.0MB

affa2f94d00b1c91617b7450de103626

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

9b:26:0e:e9:14:7f:4d:0d:f8:de:ff:db:bb:0a:56:42Certificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

45:48:d6:ea:65:16:82:71:2d:d3:26:a0:69:94:52:46:c2:bf:c9:33Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 60KB - Virtual size: 60KB

.data Size: - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 360B

.rsrc Size: 1024B - Virtual size: 944B

.reloc Size: 512B - Virtual size: 16.0MB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

9b:26:0e:e9:14:7f:4d:0d:f8:de:ff:db:bb:0a:56:42
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

45:48:d6:ea:65:16:82:71:2d:d3:26:a0:69:94:52:46:c2:bf:c9:33
Signer

.text
Size: 60KB - Virtual size: 60KB

.data
Size: - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 360B

.rsrc
Size: 1024B - Virtual size: 944B

.reloc
Size: 512B - Virtual size: 16.0MB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

9b:26:0e:e9:14:7f:4d:0d:f8:de:ff:db:bb:0a:56:42
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

45:48:d6:ea:65:16:82:71:2d:d3:26:a0:69:94:52:46:c2:bf:c9:33
Signer

.text
Size: 60KB - Virtual size: 60KB

.data
Size: - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 360B

.rsrc
Size: 1024B - Virtual size: 944B

.reloc
Size: 512B - Virtual size: 16.0MB