MDE_File_Sample_feeef9f391863db3c9174a0979aa3f00ceb1f4fe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

MDE_File_Sample_feeef9f391863db3c9174a0979aa3f00ceb1f4fe.zip
Size

766KB
MD5

763c2f5678fb5608a3fde11a48211d56
SHA1

c0cd3cd1f6176e4f4ab9722fc426f8bd7c22c495
SHA256

8af1e28837f21e9628aa4610d25b1c0aa5a3aa8be579d8a7848ba5ae1c8f51ff
SHA512

bb576ec8ffa976a00c76441304a3575e3a0e6ac1e1c741e665f25e6d373297755b979e9033d7b6a3104443c76974e140afbe2214fcdc09766d68783215a53e67
SSDEEP

12288:cZfMF4f7Z9t5dyftUf7Dyl44pXK0ULKBcsoTjKu4+MvL65NJQ:A0F4f/tGfWHy9pXKn+BiTjF4bvn

Score

1^/10

Malware Config

Signatures

Files

MDE_File_Sample_feeef9f391863db3c9174a0979aa3f00ceb1f4fe.zip
.zip

Password: 1234
2012.R2VL.ESD.ENU.June2016.iso
.dll windows:0 windows x64 arch:x64

Password: 1234

Code Sign

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/07/2014, 20:32

Not After

01/10/2015, 20:32

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:86:2a:9e:7b:f3:54:8a:ad:4c:21:4c:6c:cd:7e:5f:fe:0d:74:75:d5:fc:c5:74:8b:3e:85:47:3e:4b:59:80
Signer

Actual PE Digest

ab:86:2a:9e:7b:f3:54:8a:ad:4c:21:4c:6c:cd:7e:5f:fe:0d:74:75:d5:fc:c5:74:8b:3e:85:47:3e:4b:59:80

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

bootx64.pdb

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGER32C
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGER32R
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 1234

Password: 1234

Code Sign

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4eCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

ab:86:2a:9e:7b:f3:54:8a:ad:4c:21:4c:6c:cd:7e:5f:fe:0d:74:75:d5:fc:c5:74:8b:3e:85:47:3e:4b:59:80Signer

Headers

File Characteristics

PDB Paths

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

PAGER32C Size: 15KB - Virtual size: 15KB

PAGE Size: 5KB - Virtual size: 5KB

.rdata Size: 119KB - Virtual size: 119KB

.data Size: 18KB - Virtual size: 428KB

.pdata Size: 41KB - Virtual size: 41KB

PAGER32R Size: 512B - Virtual size: 256B

.rsrc Size: 63KB - Virtual size: 63KB

.reloc Size: 8KB - Virtual size: 8KB

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

ab:86:2a:9e:7b:f3:54:8a:ad:4c:21:4c:6c:cd:7e:5f:fe:0d:74:75:d5:fc:c5:74:8b:3e:85:47:3e:4b:59:80
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

PAGER32C
Size: 15KB - Virtual size: 15KB

PAGE
Size: 5KB - Virtual size: 5KB

.rdata
Size: 119KB - Virtual size: 119KB

.data
Size: 18KB - Virtual size: 428KB

.pdata
Size: 41KB - Virtual size: 41KB

PAGER32R
Size: 512B - Virtual size: 256B

.rsrc
Size: 63KB - Virtual size: 63KB

.reloc
Size: 8KB - Virtual size: 8KB