ir41_qc.zip
- SHA256 0dcfcccd6ae895d9e5dbf703cdfc8becb6aa20d56e756bba84c84837cf5c55f1
Static task
static1
Behavioral task
behavioral1
Sample
ir41_qc/cephalosporin.png
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ir41_qc/cephalosporin.png
Resource
win10-20240221-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
ir41_qc/tedutil.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
ir41_qc/tedutil.dll
Resource
win10-20240221-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
ir41_qc/topoedit.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
ir41_qc/topoedit.exe
Resource
win10-20240221-en
windows10-1703-x64
9 signatures
150 seconds
General
- Target ir41_qc.zip
- Size 592KB
- Sample240313-ls68hscc26
- SHA256 0dcfcccd6ae895d9e5dbf703cdfc8becb6aa20d56e756bba84c84837cf5c55f1
- MD5 cc43361faedfcf3129bad175c9c2eb69
- SHA1 51494c7bc7fa39ebfae56958206d4e06437864f4
- SHA512 2cbe0f3da88ae5676c0b3d59709f86f2b479cb50fe1f9403cadfc5f0508207728f45b3cbe60e5c095d98c6a71764c5c2957d85c46d552469b9607c39a7821390
- SSDEEP 12288:yUpATBHVdo6P+UZI2qGDiLMNhXl13ClPMt3++3DSDF8QBqtOMM7xEYHam1cEB8p:ySATB1do6PZbqG5P3Cl0HTS7lMM1L6mu
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
ir41_qc.zip.zip 592KB
-
ir41_qc/cephalosporin.ppt.png 395KB
-
ir41_qc/tedutil.dll.dll 313KB
-
ir41_qc/topoedit.exe.exe 229KB
ir41_qc/cephalosporin.ppt
- SHA256 4eba6d3c38122a623e5adf8c07fa395be652b93fbbb0be29b74ad29f4ca4f018
- MD5 020309e5adfd756102ebcd09bdaac478
- SHA1 31bda79d7e1dee1936d41181544ac69521760039
- SHA512 757e95ddd748b31ba24c0383ffe75c1c97807a0e62a7a28a018dad796213ca3255fade0a794d62b274595ec29bbfab92f1290e46e4f9496dc93850bb8572e1ce
- SSDEEP 6144:or4jfA/GhI3pbktDc9eoj4cLs57fiQnJdGUIC1PkMt7zbKUoEleuZ3y1r/Vz37LB:gsSWcsOY57qQJg5ePznLXZ3y1pFb
- MD5 SHA1 SHA512 SSDEEP
ir41_qc/tedutil.dll
- IMPHASH 39581144b1c8b1bade166ec9ba48bdf5
- SHA256 f5ce36b5cbfae21ed23c3f035fc8f627b72a0d1c1f7246f99f3b31b85b2fb9e2
- MD5 7bd665f3443218d65f58002373e1917e
- SHA1 ff5d6ef9ff040135c427d8e75685eae0b5b7fe98
- SHA512 23547d3fa6908e276e9be868f65ec5bddc1467a242c559e7f786d7c65bb9607c0b3c8930914b9660bc975dca612915623778cae42ed8dbabf05ea662feee448e
- SSDEEP 6144:6syLJmJlSKUixqSOnBceR5Dp9aWF+OwmohoTd8oi4iKF7hZlrniwIUtwaB9E:6syLJA55vOBceR5Dp9aWF+OwmIoTd8oU
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
11:2b:e7:f9:e1:41:e1:8f:78:a3:9b:d3:a4:c4:57:f7:88:ee:4e:8b:71:85:69:83:24:cc:c6:56:90:af:36:b5
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 11, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:91:64:62:f3:b7:3e:e2:0c:cd:00:00:00:00:04:91
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
196768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
TEDUTIL.pdb
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__wtof
_o__wtoi
_o__wtoi64
_o__wtol
_o_calloc
_o_free
_o_malloc
_o_strcpy_s
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstod
_o_wcstoul
_o_wmemcpy_s
_o___std_type_info_destroy_list
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
wcschr
memmove
wcsrchr
memcpy
memcmp
__C_specific_handler
oleaut32
UnRegisterTypeLi
LoadRegTypeLi
SysFreeString
SysAllocString
SysStringLen
LoadTypeLi
VarUI4FromStr
VarBstrCmp
VariantClear
VariantInit
RegisterTypeLi
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException
api-ms-win-core-synch-l1-1-0
SetEvent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateEventW
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ResetEvent
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
LoadResource
LoadLibraryExA
GetModuleHandleW
FindResourceExW
SizeofResource
LockResource
GetModuleFileNameW
GetProcAddress
FreeLibrary
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-localization-l1-2-0
GetThreadLocale
SetThreadLocale
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
api-ms-win-core-com-l1-1-0
IIDFromString
PropVariantClear
StringFromCLSID
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
api-ms-win-core-file-l1-1-0
CreateFileW
WriteFile
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-timezone-l1-1-0
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
HeapReAlloc
HeapDestroy
HeapSize
GetProcessHeap
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-1
FlushInstructionCache
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
mf
MFRequireProtectedEnvironment
MFCreateVideoRendererActivate
MFCreateMPEG4MediaSink
MFCreateSequencerSource
MFCreateTranscodeProfile
MFCreateTopology
MFCreateTopologyNode
MFCreateTranscodeSinkActivate
MFCreateASFProfile
MFCreateASFMediaSink
MFCreateAudioRendererActivate
mfplat
MFCreateSourceResolver
MFCreateFile
MFCreateAttributes
MFTEnumEx
MFCreateEventQueue
MFInitAMMediaTypeFromMFMediaType
MFCreateMediaType
MFCreateCollection
propsys
VariantToPropVariant
PropVariantToVariant
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TEDCreateDataLoader
TEDCreateDataSaver
TEDCreateMediaTypeViewer
TEDCreateTopoViewer
TEDCreateTopoViewerWindow
TEDGetAttributeCategory
TEDGetAttributeGUID
TEDGetAttributeListLength
TEDGetAttributeName
TEDGetAttributeType
TEDGetAttributeTypeFromGUID
TEDGetMTKnownAttributes
TEDGetMTKnownGUIDStrings
TEDMTStringFromGUID
Name
.text
Size
200KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=30795,
count=65, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1233, id=1, productName=Unmarked objects,
count=4, id=259, version=30795,
count=6, id=265, version=30795,
count=1, id=256, version=30795,
count=18, id=260, version=30795,
count=41, id=261, version=30795,
count=1, id=253, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
ir41_qc/topoedit.exe
- IMPHASH fcd89eebe7a883ae62c53452b4abddf8
- SHA256 b874e5abdd7c008d47560fda4e84db893ac63c18c3a5a450d25f4e62ed8e8d8c
- MD5 88691dbfa349db78f96e3278d1afc943
- SHA1 f5624018c9e9c6e9f42ebb08fcd46f1b598c47d3
- SHA512 70acedd1af236d187d400b3be56a91df6397b3f2f79b64296711efe9f503f4b4151b4617a4cafdf80fcf6767990fce906b8d9b885ba09561ff662d37ddcabbaa
- SSDEEP 3072:4XM/O19qfAuKEWUu8hzls0khPA+xvGEVsZVZ+1DNYlw1BRE84Yowo3BJTo:Ps9qDP3svPA+xeEV8VZ8Dmlw13opA
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ac:61:1d:7d:67:38:3b:79:5c:d7:75:9f:10:2b:c6:b9:d0:c6:6d:c1:36:bb:9d:5d:a8:80:d4:1c:e8:da:a0:f0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 11, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:91:64:62:f3:b7:3e:e2:0c:cd:00:00:00:00:04:91
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
115824
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
TopoEdit.pdb
kernel32
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
CreateThread
GetCurrentThreadId
FindResourceExW
FreeLibrary
LeaveCriticalSection
LoadLibraryExW
LoadResource
LockResource
SizeofResource
LocalFree
FormatMessageW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
DelayLoadFailureHook
EnterCriticalSection
HeapSetInformation
SetLastError
GetLastError
RaiseException
CloseHandle
GetFileTime
GetModuleFileNameW
CreateFileW
ResolveDelayLoadedAPI
gdi32
MoveToEx
SelectObject
LineTo
CreateSolidBrush
CreatePen
DeleteObject
CreateFontIndirectW
Rectangle
user32
UpdateWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
GetWindowRect
MessageBoxW
GetWindowLongPtrW
SetWindowLongPtrW
LoadCursorW
DestroyAcceleratorTable
GetParent
GetFocus
SetCapture
EnableMenuItem
BeginPaint
EndPaint
GetSysColor
FillRect
SetClassLongPtrW
LockWindowUpdate
LoadAcceleratorsW
KillTimer
LoadStringW
SetTimer
GetActiveWindow
LoadMenuW
SendDlgItemMessageW
SetDlgItemTextW
GetDlgItem
EndDialog
ReleaseCapture
TranslateAcceleratorW
DialogBoxParamW
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
PostQuitMessage
DefWindowProcW
PostMessageW
SendMessageW
DispatchMessageW
LoadIconW
TranslateMessage
GetMessageW
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-private-l1-1-0
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_new_mode
_o__wcsicmp
_o__wtoi
_o__wtol
_o_calloc
_o_exit
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstoul
_o_wmemcpy_s
__C_specific_handler
__current_exception
__current_exception_context
memmove
memcpy
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___p__commode
_o___stdio_common_vswprintf
wcschr
_o__set_fmode
tedutil
TEDGetAttributeType
TEDCreateMediaTypeViewer
TEDCreateDataLoader
TEDCreateTopoViewer
TEDMTStringFromGUID
TEDGetAttributeTypeFromGUID
TEDGetMTKnownAttributes
TEDGetMTKnownGUIDStrings
TEDGetAttributeListLength
TEDGetAttributeName
TEDGetAttributeCategory
api-ms-win-core-com-l1-1-0
PropVariantClear
CoInitializeEx
CoCreateInstance
IIDFromString
StringFromGUID2
CoTaskMemFree
CoUninitialize
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapSize
HeapDestroy
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetStartupInfoW
TerminateProcess
GetCurrentProcessId
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExA
GetModuleHandleW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
FlushInstructionCache
api-ms-win-core-interlocked-l1-1-0
InterlockedPopEntrySList
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
mf
MFCreateTopology
MFCreateMediaSession
MFEnumDeviceSources
MFTranscodeGetAudioOutputAvailableTypes
MFCreateTranscodeTopology
MFCreateTranscodeProfile
MFCreateTopoLoader
MFCreateVideoRendererActivate
MFCreateAudioRendererActivate
MFRequireProtectedEnvironment
MFGetService
MFCreateTopologyNode
MFCreatePMPMediaSession
mfplat
MFCreateSourceResolver
MFTEnumEx
MFCreateMediaType
MFCreateAttributes
MFStartup
MFShutdown
MFInvokeCallback
MFCreateAsyncResult
wmvcore
WMCreateReader
Name
.text
Size
116KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=50, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=30795,
count=15, id=257, version=30795,
count=1253, id=1, productName=Unmarked objects,
count=5, id=265, version=30795,
count=39, id=261, version=30795,
count=1, id=253, version=30795,
count=14, id=260, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,