MapACASvc.rar
- SHA256 42bb35a99f00d6ec5a18aced113c138d05a5e9662b61e7130a7383f440c4db27
Overview
overview
10Static
static
3DeElevator.exe
windows7-x64
10DeElevator.exe
windows10-1703-x64
10DeElevator.exe
windows10-2004-x64
10DeElevator.exe
windows11-21h2-x64
10DeElevator64.dll
windows7-x64
1DeElevator64.dll
windows10-1703-x64
1DeElevator64.dll
windows10-2004-x64
1DeElevator64.dll
windows11-21h2-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DeElevator.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
DeElevator.exe
Resource
win10-20240214-en
windows10-1703-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
DeElevator.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
DeElevator.exe
Resource
win11-20240221-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral5
Sample
DeElevator64.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
DeElevator64.dll
Resource
win10-20240221-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
DeElevator64.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
DeElevator64.dll
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target MapACASvc.rar
- Size 307KB
- Sample240226-ppdnksde62
- SHA256 42bb35a99f00d6ec5a18aced113c138d05a5e9662b61e7130a7383f440c4db27
- MD5 07a75f45a0a0ef08667f80bdb6de1e7f
- SHA1 cc559a749988edaee98b90a79d1dbd3d4491c007
- SHA512 b9b09561b1ded9c8d95b3586ac779c7aa542f6fe6d466f2ec1230134f1e03518f23d3b6c340ffedf9d86a194e95e6328e48465d46cdd03535cb9d663fd585ea7
- SSDEEP 6144:0n0/SzCU0v+5ZOxnfnK2okPu/qEp+MFO/T/nZn7yFsmseaXBc:0wSGUa+gnxPu/qD7/BYaRc
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/DeElevator64.dll
File Explorer
-
MapACASvc.rar.rar 307KB
-
DeElevator.exe.exe 10KB
-
DeElevator64.dll.dll 119KB
-
Private.USO380KB
DeElevator.exe
- IMPHASH 6a434e5ab484c200b99c3c0186c3ea29
- SHA256 22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4
- MD5 77f4f5243e1f2eab70e253e138488754
- SHA1 6f91e14d7c5a7d2bc865cf0928dc9be9a2cef55a
- SHA512 64a2be3bbc720f66264238aca89daa1214d96e5566838ba49c4b5ec32f3ab1bdd83a9bcc59d965c6fbbc7c171ac20f07e9118908064b5006503f343074b28bf5
- SSDEEP 96:M4/hNM2frP3IhjM7EugiG3/YiPoHQjzQMLy+y54+MIc/g23PQnA7k4WZwT:v/hNMIejMAPYyowJL/yCl/g2YnF2T
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d9:bb:be:57:0e:2f:da:f3:87:99:a6:48:ca:76:2d:25:22:43:1c:85
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Stardock Corporation,O=Stardock Corporation,POSTALCODE=48170,STREET=15090 N Beck Rd Ste 300,L=Plymouth,ST=MI,C=US
Chains
Jul 27, 2011
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Stardock Corporation,O=Stardock Corporation,POSTALCODE=48170,STREET=15090 N Beck Rd Ste 300,L=Plymouth,ST=MI,C=US
Serial Number
41:af:54:47:8c:ca:c5:d7:f4:a2:b3:6e:de:8e:f6:02
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 13, 2008 - Oct 13, 2011
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\Users\GreenReaper\Documents\Visual Studio 2005\Projects\DeElevator\x64\Release\DeElevate64.pdb
kernel32
GetCommandLineW
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
RtlLookupFunctionEntry
ExitProcess
LocalFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlCaptureContext
user32
MessageBoxW
shell32
CommandLineToArgvW
deelevator64
RunNonElevated
Name
.text
Size
1024B
Virtual Size
600B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
DeElevator64.dll
- IMPHASH 2de9a3792de0a6970a8c96a5116f6eba
- SHA256 23269729c2c0b943edbdf469fe456e7583ac95423c9279d1ddc4d4c122444d7b
- MD5 d2c7db5f032e0a1577007eeee844e1df
- SHA1 5e92a9fe4e2098816cdc50d6d41ed71a74fd4f28
- SHA512 97d48ca5d613e27004aa3aaf98547a69129961bc73e51ae7bbc34dc2838bd9e2da94a58e909a73eee742ddc965af86b3c6236b20408fd4f1e9f684a914be4d1a
- SSDEEP 3072:LweuSzzSgTm7GufZFlO6cJulIBVxaMCNm:LTjGpe6cJuM9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15812
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileW
GetFileSize
ReadFile
WriteFile
CloseHandle
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
VirtualAlloc
VirtualFree
OutputDebugStringW
CreateThread
VirtualProtect
DisableThreadLibraryCalls
FindResourceExW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
lstrcpyW
WriteConsoleW
SetFilePointerEx
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
RunNonElevated
RunNonElevatedRunDllW
Name
.text
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=134, id=261, version=27412,
count=14, id=260, version=30034,
count=9, id=259, version=30034,
count=36, id=261, version=30034,
count=5, id=257, version=27412,
count=106, id=1, productName=Unmarked objects,
count=3, id=261, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
Private.USO
- SHA256 4b7bbb949e0dca762687f113a5a2be5bda2b8a2c9654612a4907eeaf23b3976e
- MD5 73af29f04bfd945e07de31b490f3aa56
- SHA1 94e7b1ce58aacfa7afe070693bd497bfea07f568
- SHA512 105cadea52a8f01bedaf3bddb336a694ffa52430093fe6224984a0f28b9ef9063b2e4f4ff7e0ce1d09720b4eee59af57a346018e287f031892daae2ce12ce88c
- SSDEEP 6144:QWSdn9zrPcRIsqeOTX5XfozOHBQxnO6NrhxHPm3w9RLX5Nb1i:NSdnVcGT/TpfozOHuxnHrvmA9RLXjg
- MD5 SHA1 SHA512 SSDEEP