aab0e74b9c6f1326d7ecea9a0de137c76d52914103763ac6751940693f26cbb1.zip
- SHA256 6f81731020a9fb782476cf2a1ad6e2d69761c71b52136d050e753efb93105c52
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
aab0e74b9c6f1326d7ecea9a0de137c76d52914103763ac6751940693f26cbb1.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
General
- Target aab0e74b9c6f1326d7ecea9a0de137c76d52914103763ac6751940693f26cbb1.zip
- Size 622KB
- Sample240402-lyv3fadh73
- SHA256 6f81731020a9fb782476cf2a1ad6e2d69761c71b52136d050e753efb93105c52
- MD5 6c00fc41c6d4f2d6e6c35324687b5b7c
- SHA1 84024387f362f5db28f97b607fd693a9acb2ccac
- SHA512 6f1a1e927e7c72bdb14df630c3477b1103c180495620fd42efbf5a7aa7c12ad225102e4d22c49a490e3ccf9b585f07dfa8ebd08849a960981a0bf6aca433482d
- SSDEEP 12288:eo83LW8CSjH4sjOy3oIIrIWadLz3MjGvmpe7KgNRAhSNKZZ2rA9Fzq5tx:m7Flf3UTUH3iEIgNRISG2E95if
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
aab0e74b9c6f1326d7ecea9a0de137c76d52914103763ac6751940693f26cbb1.zip.zip 622KB
-
aab0e74b9c6f1326d7ecea9a0de137c76d52914103763ac6751940693f26cbb1.exe.exe 1.4MB
aab0e74b9c6f1326d7ecea9a0de137c76d52914103763ac6751940693f26cbb1.exe
- IMPHASH 66fd4e61aeff559a6af394a29c49ac49
- SHA256 aab0e74b9c6f1326d7ecea9a0de137c76d52914103763ac6751940693f26cbb1
- MD5 14389a809bd305dc1603ea636fd322f1
- SHA1 9c2618ee0d0bc65989beec623cf3009422decf8c
- SHA512 4809d1d559e4f152eb674c877eb9b2f5d7568d5bac0d1a45450d4ca44b7267ea5965b9a7a87ffedf77bf1bca778dfc5a0704643a6fcf57cbc25a6f68f40400f6
- SSDEEP 24576:v3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6D:ymYqHU7pHYY00VcCDdowG3tMa6D
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
d1:02:a0:db:76:ce:72:1e:f7:ab:63:24:8a:ea:97:ea:bb:a3:52:28:bf:11:13:7d:46:03:dd:4e:14:2f:79:c1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Feb 19, 2024
Subject
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Serial Number
56:b6:29:cd:34:bc:78:f6
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 31, 2017 - May 30, 2042
Subject
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 26, 2019 - Mar 22, 2034
Subject
SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
5e:90:65:01:75:69:20:86:f7:3d:d0:5e:e1:4b:3d:a5
Issuer
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 26, 2024 - Jan 25, 2025
Subject
CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Issuer
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 9, 2022 - Dec 6, 2032
Subject
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Issuer
CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 13, 2019 - Nov 12, 2034
Minor OS version
0
Major OS version
6
Entry point
530848
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\xml-data\build-dir\CODRU-CL23M-SOURCES\bin\Win32\Release\BdUserHost.pdb
crypt32
CryptMsgGetParam
CryptMsgClose
CertFindCertificateInStore
CertCloseStore
CertFreeCTLContext
CertFreeCRLContext
CertFreeCertificateContext
CryptQueryObject
CertGetNameStringW
kernel32
InitializeCriticalSectionEx
DecodePointer
CreateThread
SetCurrentDirectoryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCommandLineW
SetEvent
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CreateEventW
GetModuleHandleA
OpenProcess
OpenEventW
GetExitCodeThread
LocalFree
LocalAlloc
GetCurrentProcess
LockFile
UnlockFile
WriteFile
SetEnvironmentVariableW
GetSystemDirectoryW
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
GetCurrentProcessId
ProcessIdToSessionId
CreateFileW
GetLastError
FormatMessageA
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
GetModuleHandleExW
DeleteCriticalSection
CloseHandle
Sleep
RaiseException
SetDllDirectoryW
GetACP
IsValidCodePage
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStdHandle
ExitProcess
GetFileType
SetStdHandle
FreeLibraryAndExitThread
ExitThread
SetConsoleCtrlHandler
TlsFree
GetStringTypeW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
AreFileApisANSI
DeviceIoControl
GetFileInformationByHandleEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
EncodePointer
LCMapStringEx
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetSystemTimeAsFileTime
GetTickCount64
GetLocaleInfoEx
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
GetFileSizeEx
SetFilePointer
DebugBreak
OutputDebugStringA
SetLastError
WaitForSingleObject
GetProcessTimes
GetCurrentThread
GetLocalTime
GetWindowsDirectoryW
GetModuleFileNameA
LoadLibraryExA
LoadLibraryA
FormatMessageW
SetSearchPathMode
FileTimeToSystemTime
K32GetMappedFileNameW
WriteConsoleW
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
GetLongPathNameW
QueryDosDeviceW
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
user32
DispatchMessageW
PeekMessageW
TranslateMessage
RegisterClassExW
CreateWindowExW
ShowWindow
UpdateWindow
BeginPaint
EndPaint
PostQuitMessage
DefWindowProcW
MsgWaitForMultipleObjects
advapi32
ConvertSidToStringSidW
LookupAccountSidW
GetAclInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetSecurityDescriptorDacl
GetFileSecurityW
GetAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueW
GetNamedSecurityInfoW
GetTokenInformation
OpenProcessToken
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegOpenKeyExW
RegGetValueW
RegCloseKey
shell32
SHGetKnownFolderPath
CommandLineToArgvW
ole32
StringFromCLSID
CLSIDFromString
CoTaskMemFree
winmm
timeGetTime
wintrust
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
shlwapi
PathIsRelativeW
ntdll
NtQuerySystemInformation
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
GetUserProcessHost
Name
.text
Size
708KB
Virtual Size
708KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
504KB
Virtual Size
503KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=27412,
count=180, id=261, version=27412,
count=25, id=260, version=27412,
count=19, id=260, version=30034,
count=23, id=259, version=30034,
count=7, id=261, version=30151,
count=95, id=261, version=30034,
count=1, id=262, version=27412,
count=23, id=257, version=27412,
count=260, id=1, productName=Unmarked objects,
count=6, id=265, version=30151,
count=1, id=256, version=30151,
count=1, id=255, version=30151,
count=1, id=151,
count=1, id=258, version=30151,