Kontakt7.zip
- SHA256 16d9bc3d5e59df1878984cfd3d755a8eff71e35bd87cad9d6d14450badc0be9e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Kontakt7.zip
Resource
win10v2004-20240226-en
windows10-2004-x64
23 signatures
1200 seconds
General
- Target Kontakt7.zip
- Size 565.5MB
- Sample240302-3bva3aaf99
- SHA256 16d9bc3d5e59df1878984cfd3d755a8eff71e35bd87cad9d6d14450badc0be9e
- MD5 560b182c5cd7e1fae40ba8a3d6cdce1c
- SHA1 1d68b2d127e79c935fa49a11f06963e8296371fb
- SHA512 768f975471d6632d9672850344f40c57f6f5086c76e578b1db0d035ca8d5ed803c16ed2e995a8cbef2a937c7d7e8015f95deb028dc5582e5ade077e40069b927
- SSDEEP 12582912:KxY/pcRS3aD0X68vFhQJQSStjrtCjLYL9RZyqzH6sNkG7RPZ:KxY/cS3aD0fLqYLvZBH6s/VPZ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Kontakt 7 Next Patcher.exe
File Explorer
-
Kontakt7.zip.zip 565.5MB
-
Kontakt 7 7.8.1 Setup PC.exe.exe 515.7MB
-
Kontakt 7 Next Patcher.7z.7z 50.1MB
-
Kontakt 7 Next Patcher.exe.exe 50.3MB
Kontakt 7 7.8.1 Setup PC.exe
- IMPHASH 2504766638fe11b4c0e06283c1d3235c
- SHA256 a15a246bbccd30c062d216181fface336a622dafbf6afa26976731ffb8cfedaa
- MD5 8c09cdac641f0a8b400b9d56febaf3f5
- SHA1 87320e3b6e3b15222595ad84dc7b74813c724829
- SHA512 b6a8f31bc0040b1b609071b6186a578b959fc8042e5bd57445aa7678ac839bcde942cc3a4b63046c1d3d65de100acbd2797b79b5523115f29479cc79999b2f46
- SSDEEP 12582912:7VuNdSloZyl+5+aPSR6lwsE5lbVUXfa5xvlKoTzswG0Up:7VuNgoZyl+BIYa5tlDzsw4p
- MD5 SHA1 SHA512 SSDEEP
Digest
28:fb:49:3d:87:fe:32:dd:63:e3:23:5e:f4:88:a2:bc:4b:62:c6:5e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Native Instruments GmbH,O=Native Instruments GmbH,L=Berlin,C=DE
Chains
Feb 20, 2024
CN=Native Instruments GmbH,O=Native Instruments GmbH,L=Berlin,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Native Instruments GmbH,O=Native Instruments GmbH,L=Berlin,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=Native Instruments GmbH,O=Native Instruments GmbH,L=Berlin,C=DE
Serial Number
04:92:1e:31:af:15:9e:dc:94:1a:a6:59:57:55:b6:84
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Oct 2, 2024
Minor OS version
0
Major OS version
4
Entry point
75069
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
ord17
kernel32
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
CreateThread
WaitForSingleObject
SetEvent
ResetEvent
WaitForMultipleObjects
CompareStringA
GetLastError
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
lstrlenA
LoadLibraryA
AreFileApisANSI
GetModuleFileNameA
GetModuleFileNameW
FormatMessageA
LocalFree
FormatMessageW
SetFileAttributesA
RemoveDirectoryA
SetCurrentDirectoryA
GetWindowsDirectoryA
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
GetShortPathNameW
GetShortPathNameA
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryA
GetTempPathA
GetTempFileNameA
FindClose
FindFirstFileA
SetLastError
FindFirstFileW
FindNextFileA
CreateFileA
CreateFileW
GetFileSize
SetFilePointer
ReadFile
SetFileTime
WriteFile
SetEndOfFile
CreateEventA
EnterCriticalSection
LeaveCriticalSection
Sleep
GetCommandLineW
CreateProcessA
GetExitCodeProcess
IsBadReadPtr
SetUnhandledExceptionFilter
RaiseException
GetSystemInfo
VirtualProtect
GetLocaleInfoA
IsBadCodePtr
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetCPInfo
GetOEMCP
GetACP
VirtualQuery
InterlockedExchange
RtlUnwind
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
TlsAlloc
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
HeapSize
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapFree
HeapAlloc
HeapReAlloc
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
user32
PostMessageA
ShowWindow
DestroyWindow
KillTimer
SetTimer
SetDlgItemTextA
EndDialog
IsDlgButtonChecked
GetDlgItem
MessageBoxW
DialogBoxParamA
GetDesktopWindow
SetForegroundWindow
GetWindowLongA
SetWindowLongA
SetWindowTextW
GetWindowTextA
GetWindowTextLengthA
SetWindowTextA
SendMessageA
LoadStringW
LoadStringA
CharPrevA
oleaut32
VariantClear
SysAllocString
SysFreeString
Name
.text
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
372KB
Virtual Size
371KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=14, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=25, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=75, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=2, id=93, version=2067,
count=6, id=93, version=2179,
count=5, id=25, version=9210,
count=191, id=1, productName=Unmarked objects,
count=62, id=100, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, productName=Unmarked objects (old),
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
Kontakt 7 Next Patcher.7z
- SHA256 956622411aba0f6bde7a92c2f54fd13a00de430ecb0879e7909a6d6e5d3a74b5
- MD5 56e6fa406fd65b0be137e0f446097892
- SHA1 cadb13f59f887e136a3d3405d8804b18a5e21594
- SHA512 6867db2d9f4461a1f2b6eddc0724b88fa64ebad9ce1ea7a9bf7c28560ff6c6e9a0bd9a0d7b26609c036a68030e9813765bb5c0a0c7c073804fd730271d3bef36
- SSDEEP 1572864:nxbGepLPakvdj3uaNptqkcW2jUjUs7Rrm8zgWMxrIjKq:IKLzVq74jPr5qpIR
- MD5 SHA1 SHA512 SSDEEP
Kontakt 7 Next Patcher.exe
- IMPHASH dc73a9bd8de0fd640549c85ac4089b87
- SHA256 4025c2cdb8ffc1f01c0d06cbff47e24d8336884de99840e6b1b0e39502359fc0
- MD5 3873e42dcfac9165f786c6c34f3f972a
- SHA1 327d104238370d2e3b79921ebcadbdd77090f906
- SHA512 150ec040821c2fbf643447066245c660868507405b5be6a048b407390971c0fbe34fbca5bc42278dc4ca54d443e3672e6c1d65a1b5de259931552f02f6bf32c5
- SSDEEP 1572864:h4sueBWxjuTkEmKw7qQW2o320QnAzoUnFU/JsOFNuo8Lli:usuk0yt7D2C0USJ9Hcl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4139
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile
Name
.text
Size
512B
Virtual Size
502B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
50.3MB
Virtual Size
50.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
82B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=18, version=8444,
count=20, id=19, version=8078,
count=1, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,