DEFl_NB14596_2024-03-15_08_46_33[.]859[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

DEFl_NB14596_2024-03-15_08_46_33.859.zip
Size

756KB
MD5

fed054bc28faa8a9cf52baa73ec360e5
SHA1

9884f8307c6abe674017b3a6cf4fbc8c86edea8c
SHA256

5c3c163980840388e556016804e2372ac072eff90f01c18540e6b13204f1aac3
SHA512

2e36a3f46eb707070612e78e60d47844abcd910116a6acb31cac922a6aa53cd6b54a73e39dd53f74638e389717f93a8689e16e07ac8c6206a3e405e6bcf419d5
SSDEEP

12288:t4dLQ7LjBDcttSjthkLT1udlUDf6Qe8DWyOZMZnZ2WsuANaqA7hNxi8RvZJkHn/O:t4q9Qttqsf1udyf6Qd5ZBsuADA/gQZJB

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Device/HarddiskVolume4/Users/reindl/Documents/alt/Privat/Hochzeit/Andere/Maria & Jörg/Stick/DaVinci Resolve - CHIP-Installer.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack002/out.upx	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/out.upx

Files

DEFl_NB14596_2024-03-15_08_46_33.859.zip
.zip

Password: Password123456
Device/HarddiskVolume4/Users/reindl/Documents/alt/Privat/Hochzeit/Andere/Maria & Jörg/Stick/DaVinci Resolve - CHIP-Installer.exe
.exe windows:5 windows x86 arch:x86

Password: Password123456

Code Sign

5b:9a:5e:4d:b0:87:28:85:54:00:19:81:89:1b:7b:8a
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

21/01/2019, 00:00

Not After

21/01/2020, 23:59

Subject

CN=CHIP Digital GmbH,OU=Download Development,O=CHIP Digital GmbH,POSTALCODE=81541,STREET=St.-Martin-Strasse 66,L=Munich,ST=Bavaria,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:1a:8f:86:4d:2f:4c:40:ee:98:db:10:b9:4a:3f:c0:a0:7c:5f:13
Signer

Actual PE Digest

cf:1a:8f:86:4d:2f:4c:40:ee:98:db:10:b9:4a:3f:c0:a0:7c:5f:13

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 335KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 965KB - Virtual size: 968KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 557KB - Virtual size: 557KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 964KB - Virtual size: 963KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: Password123456

Password: Password123456

Code Sign

5b:9a:5e:4d:b0:87:28:85:54:00:19:81:89:1b:7b:8aCertificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

cf:1a:8f:86:4d:2f:4c:40:ee:98:db:10:b9:4a:3f:c0:a0:7c:5f:13Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.4MB

UPX1 Size: 335KB - Virtual size: 336KB

.rsrc Size: 965KB - Virtual size: 968KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 557KB - Virtual size: 557KB

.rdata Size: 179KB - Virtual size: 179KB

.data Size: 24KB - Virtual size: 39KB

.rsrc Size: 964KB - Virtual size: 963KB

.reloc Size: 41KB - Virtual size: 41KB

5b:9a:5e:4d:b0:87:28:85:54:00:19:81:89:1b:7b:8a
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

cf:1a:8f:86:4d:2f:4c:40:ee:98:db:10:b9:4a:3f:c0:a0:7c:5f:13
Signer

UPX0
Size: - Virtual size: 1.4MB

UPX1
Size: 335KB - Virtual size: 336KB

.rsrc
Size: 965KB - Virtual size: 968KB

.text
Size: 557KB - Virtual size: 557KB

.rdata
Size: 179KB - Virtual size: 179KB

.data
Size: 24KB - Virtual size: 39KB

.rsrc
Size: 964KB - Virtual size: 963KB

.reloc
Size: 41KB - Virtual size: 41KB