887594ca6a20bf67064c0f2bf0db1246ab54236df3fadb7162ac8290d40b1798.zip
- SHA256 1b856a4e1aa8be60c26ec28c906f52cd5db4fbd283e95710a457bd29e4008f08
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
887594ca6a20bf67064c0f2bf0db1246ab54236df3fadb7162ac8290d40b1798.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
General
- Target 887594ca6a20bf67064c0f2bf0db1246ab54236df3fadb7162ac8290d40b1798.zip
- Size 622KB
- Sample240402-lypknadd71
- SHA256 1b856a4e1aa8be60c26ec28c906f52cd5db4fbd283e95710a457bd29e4008f08
- MD5 685a560e6221a0bc7cccf50daca64fb8
- SHA1 9ec7c5a0bc0b4aebc9aa88f41499afcc0fa858ed
- SHA512 7c8d7981beea0d48eeb683f14ef81d18963da0944fd7948bfd8b12fd3dad62d0bec37d0500145b9c7f3c12ffd7c040b6e0e52876b35c1cc01c0f0cb1415b1b02
- SSDEEP 12288:DnhFMXsW4XrUFWWdzxKT1AEzIppWcuniZrhJG7qmOqmNj:DgZUWtdzxKTZEe1nMYzqt
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
887594ca6a20bf67064c0f2bf0db1246ab54236df3fadb7162ac8290d40b1798.zip.zip 622KB
-
887594ca6a20bf67064c0f2bf0db1246ab54236df3fadb7162ac8290d40b1798.exe.exe 1.4MB
887594ca6a20bf67064c0f2bf0db1246ab54236df3fadb7162ac8290d40b1798.exe
- IMPHASH 66fd4e61aeff559a6af394a29c49ac49
- SHA256 887594ca6a20bf67064c0f2bf0db1246ab54236df3fadb7162ac8290d40b1798
- MD5 2677fd95e54293517c0bc79fdd108f34
- SHA1 278e973250198ccfcd4789c8f4951e8d9fe1ff84
- SHA512 cf9a96fb75eb780b4111d48417d1d9a1373372e4a8a678a0acf1a2399d31a3d7e89b1088ab418860f95c4d1da5820c013fb94af45b2a2638b4d75ea253527de3
- SSDEEP 24576:63dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6L:FmYqHU7pHYY00VcCDdowG3tMa6L
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
bf:bd:04:bf:b4:27:18:04:31:bf:7c:4e:43:b2:f6:dd:33:ca:38:82:5e:23:c0:bc:fe:d5:2b:14:60:69:61:15
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Feb 19, 2024
Subject
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Serial Number
56:b6:29:cd:34:bc:78:f6
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 31, 2017 - May 30, 2042
Subject
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 26, 2019 - Mar 22, 2034
Subject
SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
5e:90:65:01:75:69:20:86:f7:3d:d0:5e:e1:4b:3d:a5
Issuer
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 26, 2024 - Jan 25, 2025
Subject
CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Issuer
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 9, 2022 - Dec 6, 2032
Subject
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Issuer
CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 13, 2019 - Nov 12, 2034
Minor OS version
0
Major OS version
6
Entry point
530848
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\xml-data\build-dir\CODRU-CL23M-SOURCES\bin\Win32\Release\BdUserHost.pdb
crypt32
CryptMsgGetParam
CryptMsgClose
CertFindCertificateInStore
CertCloseStore
CertFreeCTLContext
CertFreeCRLContext
CertFreeCertificateContext
CryptQueryObject
CertGetNameStringW
kernel32
InitializeCriticalSectionEx
DecodePointer
CreateThread
SetCurrentDirectoryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCommandLineW
SetEvent
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CreateEventW
GetModuleHandleA
OpenProcess
OpenEventW
GetExitCodeThread
LocalFree
LocalAlloc
GetCurrentProcess
LockFile
UnlockFile
WriteFile
SetEnvironmentVariableW
GetSystemDirectoryW
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
GetCurrentProcessId
ProcessIdToSessionId
CreateFileW
GetLastError
FormatMessageA
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
GetModuleHandleExW
DeleteCriticalSection
CloseHandle
Sleep
RaiseException
SetDllDirectoryW
GetACP
IsValidCodePage
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStdHandle
ExitProcess
GetFileType
SetStdHandle
FreeLibraryAndExitThread
ExitThread
SetConsoleCtrlHandler
TlsFree
GetStringTypeW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
AreFileApisANSI
DeviceIoControl
GetFileInformationByHandleEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
EncodePointer
LCMapStringEx
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetSystemTimeAsFileTime
GetTickCount64
GetLocaleInfoEx
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
GetFileSizeEx
SetFilePointer
DebugBreak
OutputDebugStringA
SetLastError
WaitForSingleObject
GetProcessTimes
GetCurrentThread
GetLocalTime
GetWindowsDirectoryW
GetModuleFileNameA
LoadLibraryExA
LoadLibraryA
FormatMessageW
SetSearchPathMode
FileTimeToSystemTime
K32GetMappedFileNameW
WriteConsoleW
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
GetLongPathNameW
QueryDosDeviceW
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
user32
DispatchMessageW
PeekMessageW
TranslateMessage
RegisterClassExW
CreateWindowExW
ShowWindow
UpdateWindow
BeginPaint
EndPaint
PostQuitMessage
DefWindowProcW
MsgWaitForMultipleObjects
advapi32
ConvertSidToStringSidW
LookupAccountSidW
GetAclInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetSecurityDescriptorDacl
GetFileSecurityW
GetAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueW
GetNamedSecurityInfoW
GetTokenInformation
OpenProcessToken
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegOpenKeyExW
RegGetValueW
RegCloseKey
shell32
SHGetKnownFolderPath
CommandLineToArgvW
ole32
StringFromCLSID
CLSIDFromString
CoTaskMemFree
winmm
timeGetTime
wintrust
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
shlwapi
PathIsRelativeW
ntdll
NtQuerySystemInformation
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
GetUserProcessHost
Name
.text
Size
708KB
Virtual Size
708KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
504KB
Virtual Size
503KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=27412,
count=180, id=261, version=27412,
count=25, id=260, version=27412,
count=19, id=260, version=30034,
count=23, id=259, version=30034,
count=7, id=261, version=30151,
count=95, id=261, version=30034,
count=1, id=262, version=27412,
count=23, id=257, version=27412,
count=260, id=1, productName=Unmarked objects,
count=6, id=265, version=30151,
count=1, id=256, version=30151,
count=1, id=255, version=30151,
count=1, id=151,
count=1, id=258, version=30151,