lastactivityview.zip
- SHA256 09976fd76ae40a608f424655cda82b2be77c426c88ea95af78378b47630397bf
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
lastactivityview.zip
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
LastActivityView.chm
Resource
win11-20240221-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
LastActivityView.exe
Resource
win11-20240221-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
readme.txt
Resource
win11-20240221-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target lastactivityview.zip
- Size 87KB
- Sample240306-2we67scc71
- SHA256 09976fd76ae40a608f424655cda82b2be77c426c88ea95af78378b47630397bf
- MD5 213adc37c29813db9b304c029eb83772
- SHA1 e24c3ea2a2e8bef31626827553c13ee1fc1de8fb
- SHA512 b38e21623729b6a6bb56af1ea8a6c9b42be2741c79ea453262a4f04e15a66a10e008158d9355298b7184808f2257891e2abefffea54cdfb84001dc57c1858681
- SSDEEP 1536:gG3FFwlf+A2Gn9UFWWYu9gVwbOv4PgP1rwLfdK59/rSsV/FlgIMwfaUt:vFKlf+A2M9UFF9gmbOvigPwdoxrSSAmv
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Nirsoft 1 IoCs
resource yara_rule static1/unpack001/LastActivityView.exe Nirsoft
File Explorer
-
lastactivityview.zip.zip 87KB
-
LastActivityView.chm.chm 19KB
-
LastActivityView.exe.exe 130KB
-
readme.txt15KB
LastActivityView.chm
- SHA256 462d2d409228e8d93f3d285472901515728bd843efb0dcbc1e66e6764588a1e0
- MD5 3cfa706aecbfabf73fe8270baa528577
- SHA1 c70eea1ddfca236d041cf138a3813a04501500d7
- SHA512 3931321b37f3957a2c881cce32f079f3bd7bc7f502e54c39fe7d225ad2b1420ede0f003930e2ef455c0e49fb9de3fb1db0db95e6d7485a36a48927006df1183c
- SSDEEP 384:0b4M3PJFPc6yLz6G6hZoLUnFKeVRIwT07rg1ygKcU:0b4cP/c6yLz6Gu2UFKeV1T0IMTc
- MD5 SHA1 SHA512 SSDEEP
LastActivityView.exe
- IMPHASH 3fbcb180ebbfb0ad62cf50d337af18c5
- SHA256 af86dc3f76d39b67b967a3b714e9e70ed43eec8d3871e9691cb45d84372b53fb
- MD5 f27a284ef9b018cdd2a98a7b78ccdcb3
- SHA1 67e260b11e6227c18cae8925b4f6899103c607f2
- SHA512 9a8811f13517748539308a70933b126a3348407f397bf30f903019379f927532c64015853b94acf21bdbc554d638a0265d4394d026e289103db06fe93fe5524b
- SSDEEP 3072:5e69eWHZXp1nPDhhloZqX6EsSiEF4Gw1aqL1p7BZ5CJ/:5e/+1nrhPKqX6EsS94H8B
- MD5 SHA1 SHA512 SSDEEP
-
Nirsoft
Digest
86:d0:50:e9:bb:2f:ee:a9:26:74:b9:34:ef:82:25:c8:43:e0:7f:b7:d0:98:e5:f2:8e:e8:20:f8:95:33:8c:05
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Chains
Mar 28, 2023
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Serial Number
f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 9, 2019 - Sep 9, 2023
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
76662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Projects\VS2005\LastActivityView\Release\LastActivityView.pdb
msvcrt
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__p__fmode
exit
_cexit
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
_msize
__set_app_type
_controlfp
_except_handler3
_wcmdln
calloc
realloc
_purecall
_wcslwr
strlen
_itow
_wcsnicmp
qsort
free
modf
_memicmp
_wtoi
memcmp
wcstoul
wcsrchr
swscanf
malloc
_ultow
wcscmp
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
wcslen
wcscpy
memset
_wcsicmp
wcschr
_snwprintf
wcscat
wcsncat
comctl32
CreateToolbarEx
CreateStatusWindowW
ImageList_SetImageCount
ImageList_Create
ord17
ImageList_Add
ImageList_AddMasked
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
kernel32
GetCurrentProcessId
ExitProcess
GetLogicalDrives
GetLongPathNameW
QueryDosDeviceW
GetVolumeInformationW
OpenProcess
EnumResourceTypesW
GetModuleHandleA
GetStartupInfoW
GetModuleHandleW
ReadProcessMemory
SetErrorMode
DeleteFileW
CloseHandle
GetFileSize
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetDriveTypeW
CompareFileTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetTickCount
GetWindowsDirectoryW
ExpandEnvironmentStringsW
GetLastError
GetDateFormatW
FindNextFileW
SizeofResource
GetTempFileNameW
GlobalLock
FormatMessageW
FindFirstFileW
GetVersionExW
FindClose
GetTimeFormatW
GetFileAttributesW
FileTimeToLocalFileTime
ReadFile
FindResourceW
WriteFile
GetModuleFileNameW
LocalFree
LoadResource
CreateFileW
TzSpecificLocalTimeToSystemTime
LockResource
SystemTimeToTzSpecificLocalTime
lstrcpyW
MultiByteToWideChar
lstrlenW
LocalFileTimeToFileTime
LoadLibraryExW
GlobalAlloc
GetSystemDirectoryW
GlobalUnlock
WideCharToMultiByte
GetTempPathW
GetCurrentProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetStdHandle
user32
ChildWindowFromPoint
LoadCursorW
SetCursor
GetSysColorBrush
ShowWindow
GetDlgItemInt
SetDlgItemInt
DeferWindowPos
CreateWindowExW
BeginPaint
EndPaint
GetWindow
GetClientRect
SendDlgItemMessageW
DrawFrameControl
EndDialog
SetWindowLongW
GetDlgItem
SetWindowTextW
UpdateWindow
SendMessageW
SetDlgItemTextW
InvalidateRect
GetDlgItemTextW
GetWindowRect
GetSystemMetrics
RegisterClassW
PostMessageW
MessageBoxW
TranslateAcceleratorW
SetMenu
SetWindowPos
GetWindowPlacement
LoadAcceleratorsW
DefWindowProcW
LoadImageW
GetSysColor
GetWindowLongW
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
KillTimer
SetTimer
GetParent
OpenClipboard
CheckMenuItem
GetMenuStringW
GetMenuItemCount
CloseClipboard
CheckMenuRadioItem
SetClipboardData
EnableWindow
GetCursorPos
MapWindowPoints
GetMenu
GetSubMenu
GetDC
EmptyClipboard
EnableMenuItem
ReleaseDC
GetClassNameW
MoveWindow
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
DestroyWindow
LoadStringW
GetDesktopWindow
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
DestroyIcon
LoadIconW
GetKeyState
RegisterWindowMessageW
TrackPopupMenu
PostQuitMessage
GetMessageW
DispatchMessageW
IsDialogMessageW
TranslateMessage
DrawTextExW
CreatePopupMenu
CallWindowProcW
gdi32
CreateFontIndirectW
SetTextColor
DeleteObject
DeleteDC
GetObjectW
SetBkMode
GetStockObject
GetTextExtentPoint32W
SetBkColor
GetDeviceCaps
GetPixel
SetPixel
SelectObject
CreateCompatibleDC
comdlg32
FindTextW
GetSaveFileNameW
advapi32
RegOpenKeyExW
RegConnectRegistryW
RegEnumKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
OpenSCManagerW
ControlService
StartServiceW
QueryServiceStatus
CloseServiceHandle
OpenServiceW
RegCloseKey
shell32
SHGetFileInfoW
ShellExecuteW
SHGetMalloc
SHBindToParent
SHGetDesktopFolder
SHGetPathFromIDListW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
VariantTimeToSystemTime
SysFreeString
SysAllocString
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=20, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=64, version=9210,
count=11, id=28, version=9178,
count=305, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=41, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
readme.txt
- SHA256 f3d8cd1a5d64d61b17ef4918542f2d6a531412b1317d48cc32fb74ffd8acbe88
- MD5 331b2daa1922a441f02a38c7a2248312
- SHA1 d3baa51871f5128bd216706b56094a7bacfc0793
- SHA512 e151de0c1cc3ce9764e568fb7ae023b98413cf85c2a335591eedc3426682a7928444f5fb73b4a084559abad8c03a1b03de3453cabcb03c8eb9b115a75644a5b9
- SSDEEP 384:UmfiY7ABU+H2imTAh0JLFjYdVVh+qWoIP:UmfiY7AS+xOJhsdjVW3
- MD5 SHA1 SHA512 SSDEEP