3ba4bdd4bcea3f61fb13239dda807dc46d43af3e0f4d3b80caaac625e07a6cfa.zip
- SHA256 782cf0032bb2cfc90b406d3134e2332a6344ec36879d0131616c0d746bf171ce
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
3ba4bdd4bcea3f61fb13239dda807dc46d43af3e0f4d3b80caaac625e07a6cfa.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
General
- Target 3ba4bdd4bcea3f61fb13239dda807dc46d43af3e0f4d3b80caaac625e07a6cfa.zip
- Size 622KB
- Sample240402-lym2tsdh47
- SHA256 782cf0032bb2cfc90b406d3134e2332a6344ec36879d0131616c0d746bf171ce
- MD5 dab66fd39f62e5d16c3adba5d9e17386
- SHA1 43b9f69cbb11d0cc79f4928e08216f438dfa4277
- SHA512 e055a5be2dee5b71cb8b8c2e1191de2c8c15fd08b9c48201e639748b9438ade341d7f70c71ecf47cf1164edffb7f556dec67e38a4cdc9923f2bed4518d789baa
- SSDEEP 12288:AusRbR9Ji1RUNtyUTf4vG9R25JhHdaBP/mNXW5uw7K9U2i3ERSjYn:AusFRkRUv1pye/uguYDSRA8
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
3ba4bdd4bcea3f61fb13239dda807dc46d43af3e0f4d3b80caaac625e07a6cfa.zip.zip 622KB
-
3ba4bdd4bcea3f61fb13239dda807dc46d43af3e0f4d3b80caaac625e07a6cfa.exe.exe 1.4MB
3ba4bdd4bcea3f61fb13239dda807dc46d43af3e0f4d3b80caaac625e07a6cfa.exe
- IMPHASH 66fd4e61aeff559a6af394a29c49ac49
- SHA256 3ba4bdd4bcea3f61fb13239dda807dc46d43af3e0f4d3b80caaac625e07a6cfa
- MD5 cf435e0b10436bc7b504d6d4689e626c
- SHA1 9da40327c2638b56e79e21bdb3871e4fb2fa669d
- SHA512 02e12e4a129b418aa95db9c33f39d6600b4ec2a7ca687fffabbc33b4c51b5103e85ff16ad0e90690112a4f6e7d4a226c1d385ac2e603e18b0c3341d53674970a
- SSDEEP 24576:A3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6S:TmYqHU7pHYY00VcCDdowG3tMa6S
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
03:d8:19:c5:7f:27:f9:73:af:3f:b9:fb:05:b5:d5:d8:a9:57:02:02:34:45:be:7b:08:d0:88:74:ad:44:2f:80
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Feb 19, 2024
Subject
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Serial Number
56:b6:29:cd:34:bc:78:f6
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 31, 2017 - May 30, 2042
Subject
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 26, 2019 - Mar 22, 2034
Subject
SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
5e:90:65:01:75:69:20:86:f7:3d:d0:5e:e1:4b:3d:a5
Issuer
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 26, 2024 - Jan 25, 2025
Subject
CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Issuer
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 9, 2022 - Dec 6, 2032
Subject
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Issuer
CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 13, 2019 - Nov 12, 2034
Minor OS version
0
Major OS version
6
Entry point
530848
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\xml-data\build-dir\CODRU-CL23M-SOURCES\bin\Win32\Release\BdUserHost.pdb
crypt32
CryptMsgGetParam
CryptMsgClose
CertFindCertificateInStore
CertCloseStore
CertFreeCTLContext
CertFreeCRLContext
CertFreeCertificateContext
CryptQueryObject
CertGetNameStringW
kernel32
InitializeCriticalSectionEx
DecodePointer
CreateThread
SetCurrentDirectoryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCommandLineW
SetEvent
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CreateEventW
GetModuleHandleA
OpenProcess
OpenEventW
GetExitCodeThread
LocalFree
LocalAlloc
GetCurrentProcess
LockFile
UnlockFile
WriteFile
SetEnvironmentVariableW
GetSystemDirectoryW
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
GetCurrentProcessId
ProcessIdToSessionId
CreateFileW
GetLastError
FormatMessageA
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
GetModuleHandleExW
DeleteCriticalSection
CloseHandle
Sleep
RaiseException
SetDllDirectoryW
GetACP
IsValidCodePage
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStdHandle
ExitProcess
GetFileType
SetStdHandle
FreeLibraryAndExitThread
ExitThread
SetConsoleCtrlHandler
TlsFree
GetStringTypeW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
AreFileApisANSI
DeviceIoControl
GetFileInformationByHandleEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
EncodePointer
LCMapStringEx
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetSystemTimeAsFileTime
GetTickCount64
GetLocaleInfoEx
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
GetFileSizeEx
SetFilePointer
DebugBreak
OutputDebugStringA
SetLastError
WaitForSingleObject
GetProcessTimes
GetCurrentThread
GetLocalTime
GetWindowsDirectoryW
GetModuleFileNameA
LoadLibraryExA
LoadLibraryA
FormatMessageW
SetSearchPathMode
FileTimeToSystemTime
K32GetMappedFileNameW
WriteConsoleW
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
GetLongPathNameW
QueryDosDeviceW
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
user32
DispatchMessageW
PeekMessageW
TranslateMessage
RegisterClassExW
CreateWindowExW
ShowWindow
UpdateWindow
BeginPaint
EndPaint
PostQuitMessage
DefWindowProcW
MsgWaitForMultipleObjects
advapi32
ConvertSidToStringSidW
LookupAccountSidW
GetAclInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetSecurityDescriptorDacl
GetFileSecurityW
GetAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueW
GetNamedSecurityInfoW
GetTokenInformation
OpenProcessToken
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegOpenKeyExW
RegGetValueW
RegCloseKey
shell32
SHGetKnownFolderPath
CommandLineToArgvW
ole32
StringFromCLSID
CLSIDFromString
CoTaskMemFree
winmm
timeGetTime
wintrust
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
shlwapi
PathIsRelativeW
ntdll
NtQuerySystemInformation
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
GetUserProcessHost
Name
.text
Size
708KB
Virtual Size
708KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
504KB
Virtual Size
503KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=27412,
count=180, id=261, version=27412,
count=25, id=260, version=27412,
count=19, id=260, version=30034,
count=23, id=259, version=30034,
count=7, id=261, version=30151,
count=95, id=261, version=30034,
count=1, id=262, version=27412,
count=23, id=257, version=27412,
count=260, id=1, productName=Unmarked objects,
count=6, id=265, version=30151,
count=1, id=256, version=30151,
count=1, id=255, version=30151,
count=1, id=151,
count=1, id=258, version=30151,