4f8e60e49e4c8bbd88b00558f80abc929dd9d1a033c63305159fd9fd23de0576.zip
- SHA256 899e6b7548a87acf35bcd894c28ad4f181cb6a73e0e43ce4407603141b526431
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
4f8e60e49e4c8bbd88b00558f80abc929dd9d1a033c63305159fd9fd23de0576.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
General
- Target 4f8e60e49e4c8bbd88b00558f80abc929dd9d1a033c63305159fd9fd23de0576.zip
- Size 622KB
- Sample240402-lyncladd7z
- SHA256 899e6b7548a87acf35bcd894c28ad4f181cb6a73e0e43ce4407603141b526431
- MD5 0c2de7f734190721b92fb2b31975e84f
- SHA1 6912e099b720a4dd2f3bb5d3824c0ed254659623
- SHA512 c473abbe57d3d8f6b31e90f6a61c4e4077295ca380f04266332abfb63c98c90465edffaac1fbee4c2e5aa563c24bd0cf372eabcdb6f8e6d3fbd19447a58a2aab
- SSDEEP 12288:VV7M6KLiV6EEwDCThcsBeJnnIYBJlokoJVLpI9oVbarmR1VoaCVD:VhhKGLbDihcsAnnNJlk9i9uoqfoaCF
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
4f8e60e49e4c8bbd88b00558f80abc929dd9d1a033c63305159fd9fd23de0576.zip.zip 622KB
-
4f8e60e49e4c8bbd88b00558f80abc929dd9d1a033c63305159fd9fd23de0576.exe.exe 1.4MB
4f8e60e49e4c8bbd88b00558f80abc929dd9d1a033c63305159fd9fd23de0576.exe
- IMPHASH 66fd4e61aeff559a6af394a29c49ac49
- SHA256 4f8e60e49e4c8bbd88b00558f80abc929dd9d1a033c63305159fd9fd23de0576
- MD5 fb152400190659a0f41b159320efc1d4
- SHA1 fadc828de2a220d4f6d8950b5998b4cdff27a0ea
- SHA512 0de59d68cea7b8d6844805bf68037e08055a6ee46b128224dd66258e219ff09be8dfe36889fc852039e6541fd139411277f55455fe91817ca6a4bdc290b21f63
- SSDEEP 24576:M3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6e:PmYqHU7pHYY00VcCDdowG3tMa6e
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
e0:64:5f:d3:5c:03:52:af:b4:68:cc:db:98:a2:be:a1:b5:8b:b5:75:6f:c2:6b:6c:c3:12:73:08:60:46:7c:b6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Feb 19, 2024
Subject
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Serial Number
56:b6:29:cd:34:bc:78:f6
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 31, 2017 - May 30, 2042
Subject
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 26, 2019 - Mar 22, 2034
Subject
SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
5e:90:65:01:75:69:20:86:f7:3d:d0:5e:e1:4b:3d:a5
Issuer
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 26, 2024 - Jan 25, 2025
Subject
CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Issuer
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 9, 2022 - Dec 6, 2032
Subject
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Issuer
CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 13, 2019 - Nov 12, 2034
Minor OS version
0
Major OS version
6
Entry point
530848
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\xml-data\build-dir\CODRU-CL23M-SOURCES\bin\Win32\Release\BdUserHost.pdb
crypt32
CryptMsgGetParam
CryptMsgClose
CertFindCertificateInStore
CertCloseStore
CertFreeCTLContext
CertFreeCRLContext
CertFreeCertificateContext
CryptQueryObject
CertGetNameStringW
kernel32
InitializeCriticalSectionEx
DecodePointer
CreateThread
SetCurrentDirectoryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCommandLineW
SetEvent
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CreateEventW
GetModuleHandleA
OpenProcess
OpenEventW
GetExitCodeThread
LocalFree
LocalAlloc
GetCurrentProcess
LockFile
UnlockFile
WriteFile
SetEnvironmentVariableW
GetSystemDirectoryW
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
GetCurrentProcessId
ProcessIdToSessionId
CreateFileW
GetLastError
FormatMessageA
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
GetModuleHandleExW
DeleteCriticalSection
CloseHandle
Sleep
RaiseException
SetDllDirectoryW
GetACP
IsValidCodePage
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStdHandle
ExitProcess
GetFileType
SetStdHandle
FreeLibraryAndExitThread
ExitThread
SetConsoleCtrlHandler
TlsFree
GetStringTypeW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
AreFileApisANSI
DeviceIoControl
GetFileInformationByHandleEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
EncodePointer
LCMapStringEx
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetSystemTimeAsFileTime
GetTickCount64
GetLocaleInfoEx
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
GetFileSizeEx
SetFilePointer
DebugBreak
OutputDebugStringA
SetLastError
WaitForSingleObject
GetProcessTimes
GetCurrentThread
GetLocalTime
GetWindowsDirectoryW
GetModuleFileNameA
LoadLibraryExA
LoadLibraryA
FormatMessageW
SetSearchPathMode
FileTimeToSystemTime
K32GetMappedFileNameW
WriteConsoleW
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
GetLongPathNameW
QueryDosDeviceW
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
user32
DispatchMessageW
PeekMessageW
TranslateMessage
RegisterClassExW
CreateWindowExW
ShowWindow
UpdateWindow
BeginPaint
EndPaint
PostQuitMessage
DefWindowProcW
MsgWaitForMultipleObjects
advapi32
ConvertSidToStringSidW
LookupAccountSidW
GetAclInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetSecurityDescriptorDacl
GetFileSecurityW
GetAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueW
GetNamedSecurityInfoW
GetTokenInformation
OpenProcessToken
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegOpenKeyExW
RegGetValueW
RegCloseKey
shell32
SHGetKnownFolderPath
CommandLineToArgvW
ole32
StringFromCLSID
CLSIDFromString
CoTaskMemFree
winmm
timeGetTime
wintrust
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
shlwapi
PathIsRelativeW
ntdll
NtQuerySystemInformation
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
GetUserProcessHost
Name
.text
Size
708KB
Virtual Size
708KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
504KB
Virtual Size
503KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=27412,
count=180, id=261, version=27412,
count=25, id=260, version=27412,
count=19, id=260, version=30034,
count=23, id=259, version=30034,
count=7, id=261, version=30151,
count=95, id=261, version=30034,
count=1, id=262, version=27412,
count=23, id=257, version=27412,
count=260, id=1, productName=Unmarked objects,
count=6, id=265, version=30151,
count=1, id=256, version=30151,
count=1, id=255, version=30151,
count=1, id=151,
count=1, id=258, version=30151,