file2 (1).zip
- SHA256 880e73ea06db952d80f94c416b0fb7bc681e275017a56a99158f432cb99689a7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
testrha.exe
Resource
win7-20240215-en
windows7-x64
0 signatures
60 seconds
Behavioral task
behavioral2
Sample
testrha.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
60 seconds
General
- Target file2 (1).zip
- Size 571KB
- Sample240406-sfpw2ade53
- SHA256 880e73ea06db952d80f94c416b0fb7bc681e275017a56a99158f432cb99689a7
- MD5 bff0400a847e1e782a53b97191094898
- SHA1 1402363cc9dc5fff14f22bb852fc200e5e97a0e9
- SHA512 aa37476d8cdf8dfa33e459e4518833ddc58791002dcec245cc63172ef3d7283ee9442aeda8b7504568abe3330bb2c1c7c2b3f8efe304322fce071ecfb4483b96
- SSDEEP 12288:uzfMwRyflNfHx8lNrrHjybloSLhXlhx7WQChBMHTedFv/N2gA47:ujMwRyXHqlNrLubnFVhGaHqLsg5
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/g2m.dll
File Explorer
-
file2 (1).zip.zip 571KB
-
data.bin385KB
-
g2m.dll.dll 399KB
-
testrha.exe.exe 39KB
data.bin
- SHA256 2aebf81c6dd16ca5fc497165439785d53fd628745b9d67f07a9caf77c4dfbaff
- MD5 b9a5bc5a815ff1cce8cdb2c38a0cafae
- SHA1 b5ae29fca6222581725d30bf093a139036c3a881
- SHA512 7b40852c4109dfdd22edb350b6c248425bae0217ee015256887ca02158b637b5d09e19dfe62f91a97c8b65319d44186fc89c4329e9f77a2f57af9fb1bc9aaea0
- SSDEEP 12288:pzEwhCfL35HXylTVrHR0bHoUL1Llhf7Wq2jBiUHpLOP:pwwhCtHClTVzSbt5hhO0UJLOP
- MD5 SHA1 SHA512 SSDEEP
g2m.dll
- IMPHASH f86ae2df15d743de85c724c15b1dad25
- SHA256 93439fe9b45d7b6e9fcdc5e68fd47677ea17025e4eabb6f1468cb9ae98ee8a5b
- MD5 326683813b145cc5469dff1f77c701e3
- SHA1 b31eb0e91c6e70719a15dd61e7e374ce2b7782c1
- SHA512 981bf18aa03259a557eed4fc336d27f3f55b3a0421e70b6b59c5ef9753be885b537d5e55f2d58753621b57aa6079708d35732edddd4d97d4891b79600e631fc3
- SSDEEP 6144:u9rSWpovUahUzo+NY7+c2wkYUL8NuS3ZCXfrUNfu:u9TpofojwjUL8IJ8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
168116
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
F:\rust-dave-sideload\target\i686-pc-windows-msvc\release\deps\rust_dave_sideload.pdb
kernel32
GetEnvironmentVariableW
VirtualAlloc
CloseHandle
GetModuleHandleA
GetProcAddress
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetNativeSystemInfo
VirtualQuery
VirtualFree
VirtualProtect
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
GetLastError
FindNextFileW
FindClose
CreateFileW
SetFileInformationByHandle
FlushFileBuffers
GetFileInformationByHandle
GetFileInformationByHandleEx
SetFilePointerEx
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TlsGetValue
TlsSetValue
AcquireSRWLockShared
ReleaseSRWLockShared
CreateThread
SetThreadStackGuarantee
GetCurrentThread
WaitForSingleObject
CreateWaitableTimerExW
SetWaitableTimer
Sleep
SetHandleInformation
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
SetLastError
ReadFile
GetCurrentProcessId
QueryPerformanceCounter
ReleaseMutex
RtlCaptureContext
FreeEnvironmentStringsW
GetEnvironmentStringsW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
HeapFree
HeapReAlloc
GetModuleHandleW
FormatMessageW
ExitProcess
GetProcessHeap
HeapAlloc
GetCurrentDirectoryW
DecodePointer
GetFullPathNameW
GetModuleFileNameW
GetSystemTimeAsFileTime
GetCommandLineW
GetFileType
TerminateProcess
HeapSize
GetStringTypeW
SetStdHandle
GetConsoleOutputCP
WriteFile
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
InterlockedFlushSList
RaiseException
RtlUnwind
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
ntdll
RtlNtStatusToDosError
NtReadFile
NtWriteFile
ws2_32
WSAGetLastError
WSACleanup
WSAStartup
listen
bind
freeaddrinfo
getaddrinfo
closesocket
WSASocketW
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WaitOnAddress
DllMain
g2mchat_winmain
g2mcomm_winmain
g2mfeedback_winmain
g2mhost_winmain
g2minstaller_winmain
g2minsthigh_winmain
g2mlauncher_winmain
g2mmatchmaking_winmain
g2mmaterials_winmain
g2mpolling_winmain
g2mqanda_winmain
g2mrecorder_winmain
g2msessioncontrol_winmain
g2mstart_winmain
g2mtesting_winmain
g2mtranscoder_winmain
g2mui_winmain
g2muninstall_winmain
g2mvideoconference_winmain
g2mview_winmain
Name
.text
Size
221KB
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
80KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=139, id=261, version=30795,
count=20, id=260, version=30795,
count=31, id=261, version=33030,
count=16, id=260, version=33030,
count=20, id=259, version=33030,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=257, version=30795,
count=190, id=1, productName=Unmarked objects,
count=3, id=260, version=33133,
count=63, productName=Unmarked objects (old),
count=1, id=256, version=33133,
count=1, id=258, version=33133,
testrha.exe
- IMPHASH 6eb9cccf95968b8becec4c870f1101db
- SHA256 796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5
- MD5 f1b14f71252de9ac763dbfbfbfc8c2dc
- SHA1 dcc2dcb26c1649887f1d5ae557a000b5fe34bb98
- SHA512 636a32fb8a88a542783aa57fe047b6bca47b2bd23b41b3902671c4e9036c6dbb97576be27fd2395a988653e6b63714277873e077519b4a06cdc5f63d3c4224e0
- SSDEEP 768:YRQnUhG5bZDOTpkdD82YbQkRFokFWIILPUh:FWObZDOTpk5T6zqAh
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a9:67:63:96:99:c5:5b:7e:88:69:58:46:cb:9b:f7:d1:bb:bf:20:aa
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Citrix Online,OU=Operations+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Citrix Online,L=Fort Lauderdale,ST=Florida,C=US
Chains
Nov 14, 2012
Subject
CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US
Serial Number
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 1, 2012 - Dec 31, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Citrix Online,OU=Operations+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Citrix Online,L=Fort Lauderdale,ST=Florida,C=US
Serial Number
5c:5f:2b:a5:c9:99:4b:e5:ef:25:4f:fe:51:12:88:e1
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 30, 2012 - May 1, 2014
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb
g2m
g2mcomm_winmain
kernel32
GetModuleHandleW
GetCommandLineW
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetStartupInfoW
ExitProcess
user32
MessageBoxA
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,