a06a36de9b35bf54940b70a0ba4c3f836e42613b51c96bc265ee8910c6ae1849.zip
- SHA256 4c5e1fadb78a044e3199a5a26e448a44dafd35b8596c5f0c5bb963b43f76e57d
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
a06a36de9b35bf54940b70a0ba4c3f836e42613b51c96bc265ee8910c6ae1849.exe
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
General
- Target a06a36de9b35bf54940b70a0ba4c3f836e42613b51c96bc265ee8910c6ae1849.zip
- Size 622KB
- Sample240402-lyvfxadh67
- SHA256 4c5e1fadb78a044e3199a5a26e448a44dafd35b8596c5f0c5bb963b43f76e57d
- MD5 2336632f656e1ea61d053d0a8c9edaed
- SHA1 85d6822928ccbae33d07e6f11206b5a617219030
- SHA512 a84251c197c681f4712814aeab07d4b34b6faaf945c76dded42cbc33b6f900b4c4e6de975edf22f6d19e790c8f22a4a9d7e9fa0ef9f16b4a7524fbb560004d02
- SSDEEP 12288:FpTyqFp1ujdoDiJ+LTQ3/BPeEC1j8PlrVec0ahTToqw7Gb:F5nFfuhoDkYY4EVrIceLc
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
a06a36de9b35bf54940b70a0ba4c3f836e42613b51c96bc265ee8910c6ae1849.zip.zip 622KB
-
a06a36de9b35bf54940b70a0ba4c3f836e42613b51c96bc265ee8910c6ae1849.exe.exe 1.4MB
a06a36de9b35bf54940b70a0ba4c3f836e42613b51c96bc265ee8910c6ae1849.exe
- IMPHASH 66fd4e61aeff559a6af394a29c49ac49
- SHA256 a06a36de9b35bf54940b70a0ba4c3f836e42613b51c96bc265ee8910c6ae1849
- MD5 b3fa794fdfb6b417ecdb135ff28b7899
- SHA1 83fe427d99d06744dfb0f3556105d54dd2c2f6cc
- SHA512 7aea585c01fe1ab92fa55fb638d7c10c7855cc38ecb0f3b9774bf1dd76ae0a46610689c75e4d48b02513598cabff638c1081c9856469569926046c0a2d57af82
- SSDEEP 24576:U3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6:XmYqHU7pHYY00VcCDdowG3tMa6
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
64:6b:bf:ba:9a:d4:4e:a9:42:48:83:0f:c7:85:7b:b8:14:cf:1c:4c:c6:5f:16:58:83:bc:b2:4f:6c:45:8b:a9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Feb 19, 2024
Subject
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Serial Number
56:b6:29:cd:34:bc:78:f6
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 31, 2017 - May 30, 2042
Subject
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 26, 2019 - Mar 22, 2034
Subject
SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
5e:90:65:01:75:69:20:86:f7:3d:d0:5e:e1:4b:3d:a5
Issuer
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 26, 2024 - Jan 25, 2025
Subject
CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Issuer
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 9, 2022 - Dec 6, 2032
Subject
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Issuer
CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 13, 2019 - Nov 12, 2034
Minor OS version
0
Major OS version
6
Entry point
530848
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\xml-data\build-dir\CODRU-CL23M-SOURCES\bin\Win32\Release\BdUserHost.pdb
crypt32
CryptMsgGetParam
CryptMsgClose
CertFindCertificateInStore
CertCloseStore
CertFreeCTLContext
CertFreeCRLContext
CertFreeCertificateContext
CryptQueryObject
CertGetNameStringW
kernel32
InitializeCriticalSectionEx
DecodePointer
CreateThread
SetCurrentDirectoryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCommandLineW
SetEvent
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CreateEventW
GetModuleHandleA
OpenProcess
OpenEventW
GetExitCodeThread
LocalFree
LocalAlloc
GetCurrentProcess
LockFile
UnlockFile
WriteFile
SetEnvironmentVariableW
GetSystemDirectoryW
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
GetCurrentProcessId
ProcessIdToSessionId
CreateFileW
GetLastError
FormatMessageA
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
GetModuleHandleExW
DeleteCriticalSection
CloseHandle
Sleep
RaiseException
SetDllDirectoryW
GetACP
IsValidCodePage
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStdHandle
ExitProcess
GetFileType
SetStdHandle
FreeLibraryAndExitThread
ExitThread
SetConsoleCtrlHandler
TlsFree
GetStringTypeW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
AreFileApisANSI
DeviceIoControl
GetFileInformationByHandleEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
EncodePointer
LCMapStringEx
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetSystemTimeAsFileTime
GetTickCount64
GetLocaleInfoEx
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
GetFileSizeEx
SetFilePointer
DebugBreak
OutputDebugStringA
SetLastError
WaitForSingleObject
GetProcessTimes
GetCurrentThread
GetLocalTime
GetWindowsDirectoryW
GetModuleFileNameA
LoadLibraryExA
LoadLibraryA
FormatMessageW
SetSearchPathMode
FileTimeToSystemTime
K32GetMappedFileNameW
WriteConsoleW
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
GetLongPathNameW
QueryDosDeviceW
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
user32
DispatchMessageW
PeekMessageW
TranslateMessage
RegisterClassExW
CreateWindowExW
ShowWindow
UpdateWindow
BeginPaint
EndPaint
PostQuitMessage
DefWindowProcW
MsgWaitForMultipleObjects
advapi32
ConvertSidToStringSidW
LookupAccountSidW
GetAclInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetSecurityDescriptorDacl
GetFileSecurityW
GetAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueW
GetNamedSecurityInfoW
GetTokenInformation
OpenProcessToken
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegOpenKeyExW
RegGetValueW
RegCloseKey
shell32
SHGetKnownFolderPath
CommandLineToArgvW
ole32
StringFromCLSID
CLSIDFromString
CoTaskMemFree
winmm
timeGetTime
wintrust
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
shlwapi
PathIsRelativeW
ntdll
NtQuerySystemInformation
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
GetUserProcessHost
Name
.text
Size
708KB
Virtual Size
708KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
504KB
Virtual Size
503KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=27412,
count=180, id=261, version=27412,
count=25, id=260, version=27412,
count=19, id=260, version=30034,
count=23, id=259, version=30034,
count=7, id=261, version=30151,
count=95, id=261, version=30034,
count=1, id=262, version=27412,
count=23, id=257, version=27412,
count=260, id=1, productName=Unmarked objects,
count=6, id=265, version=30151,
count=1, id=256, version=30151,
count=1, id=255, version=30151,
count=1, id=151,
count=1, id=258, version=30151,