Ausado_Fiscal_N°_539547852.tar
- SHA256 54c06f73257dcc2bbc4a3f45a024cedf51f1f06b2893237377bef66c16f4e56f
Password
2023
Static task
static1
Behavioral task
behavioral1
Sample
Ausado_Fiscal_N°_539547852..exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ausado_Fiscal_N°_539547852..exe
Resource
win10v2004-20240412-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target Ausado_Fiscal_N°_539547852.tar
- Size 804KB
- Sample240416-3ex65aha31
- SHA256 54c06f73257dcc2bbc4a3f45a024cedf51f1f06b2893237377bef66c16f4e56f
- MD5 190ac2d22e5c5374fa01e93313856ede
- SHA1 7fa7aea5a19fdf2b698e2f80a2b8cf33b2329bce
- SHA512 ae4cc44a83462247cc80c181dfeb9f0927537e7b03003b921c2ba232b5f2e40700408d07fee19764c0bcd97bc246c19396bcef4f943617998433710e57da9f72
- SSDEEP 24576:NlvWix+eB9L7BuQvT9oh7Utn6vIa20calSb6N/m:Nlt+eB9Lxv5oh7Utn6v920GZ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
Ausado_Fiscal_N°_539547852.tar.rar 804KB
-
Ausado_Fiscal_N°_539547852..exe.exe 1.9MB
Ausado_Fiscal_N°_539547852..exe
- IMPHASH 2da9251dfa0d83c4d9d7bd8ddfa3fbb5
- SHA256 1fd4779aa6c191eb618ba6507af331ff16576ef54b73ac8d5f9293e21006abd0
- MD5 8d3e7a96486cd9edeb9a22c1752d887c
- SHA1 c725164a9a588b8ed7608fb38a5595cd9e06f573
- SHA512 6ec4fc6f3f5fdf7348758c664151bbdaedd76de01db042163ec6e106287598f9bb5e2a95a35d71de9497919fd88f25649de0a8367ce78067336eb4ef291dedb6
- SSDEEP 49152:uZ/OA5hwEGrI1IYdK6dXELnT2cSg1/3brvri:7AzGrI1IOK0XELni1yrPi
- MD5 SHA1 SHA512 SSDEEP
Password
2023
PE Signature issue
Digest
7f:45:87:16:c3:56:c1:b3:09:bc:db:9c:d1:75:5d:e9:ec:41:8a:d0:75:20:6f:34:62:1f:25:a1:99:1c:3a:83
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha 4,C=CZ
Chains
Jan 26, 2021
CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha 4,C=CZ
CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
PE Signature issue
Digest
da:9a:e8:33:e9:a7:12:9e:45:b3:d2:9b:da:d2:28:5f:ab:48:2e:15
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha 4,C=CZ
Chains
Jan 26, 2021
CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha 4,C=CZ
CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
Subject
CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha 4,C=CZ
Serial Number
04:5b:d7:bd:e9:5f:97:12
Issuer
CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 9, 2020 - Oct 9, 2021
Subject
CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
Serial Number
07
Issuer
CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 3, 2011 - May 3, 2031
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha 4,C=CZ
Serial Number
04:5b:d7:bd:e9:5f:97:12
Issuer
CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 9, 2020 - Oct 9, 2021
Subject
CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
Serial Number
07
Issuer
CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 3, 2011 - May 3, 2031
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 24, 2016 - Jun 24, 2027
Minor OS version
0
Major OS version
5
Entry point
1028086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\vmagent_new\bin\joblist\796026\out\Release\PromoUtil.pdb
kernel32
OpenMutexW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TerminateProcess
LocalAlloc
CreateProcessW
GetBinaryTypeW
GetModuleHandleA
CreateEventA
FlushInstructionCache
RaiseException
GetSystemTimeAsFileTime
InterlockedIncrement
GetTempPathW
GetTempFileNameW
CreateDirectoryW
ReleaseSemaphore
CreateSemaphoreW
FileTimeToSystemTime
CompareFileTime
MulDiv
CopyFileW
lstrlenA
lstrcmpiA
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
FreeConsole
GlobalFree
GetTimeZoneInformation
FileTimeToLocalFileTime
SetCurrentDirectoryW
GlobalAlloc
GlobalLock
GlobalUnlock
GetCommandLineW
DeleteFileA
GetStartupInfoW
QueryPerformanceCounter
GetComputerNameExW
SetErrorMode
lstrcmpW
lstrcmpA
GetFileAttributesW
SetWaitableTimer
OpenEventA
CompareStringW
CompareStringA
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeA
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
GetStringTypeW
LCMapStringW
LCMapStringA
RtlUnwind
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExitThread
TlsFree
TlsAlloc
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
OutputDebugStringW
TlsGetValue
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapSize
HeapReAlloc
HeapDestroy
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
SetEnvironmentVariableA
GetCurrentThreadId
FreeResource
GetFileAttributesExW
lstrcmpiW
GetSystemInfo
DeleteFileW
SystemTimeToFileTime
GetSystemDirectoryW
GetSystemWindowsDirectoryW
ReadFile
GetFileSize
GetPrivateProfileIntW
WritePrivateProfileStringW
CloseHandle
GetModuleFileNameW
GetWindowsDirectoryW
GetVersionExW
GetPrivateProfileStringW
CreateThread
ResetEvent
CreateFileW
GetShortPathNameW
OpenProcess
InterlockedDecrement
GetSystemPowerStatus
HeapFree
GetProcessHeap
HeapAlloc
WideCharToMultiByte
GetCurrentProcess
lstrlenW
SetLastError
ProcessIdToSessionId
LoadLibraryA
GetUserDefaultUILanguage
LoadLibraryExW
GetModuleHandleW
MultiByteToWideChar
ReleaseMutex
CreateMutexW
GetCurrentProcessId
IsValidLocale
DeviceIoControl
InterlockedExchange
FindClose
FindNextFileW
FindFirstFileW
ResumeThread
SetEvent
CreateEventW
LoadLibraryW
GetProcAddress
InterlockedCompareExchange
Sleep
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
DeleteCriticalSection
GetTickCount
LocalFree
GetLastError
GetVersion
WaitForMultipleObjects
WaitForSingleObject
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateWaitableTimerA
user32
SetWindowLongW
IsWindowVisible
GetWindowThreadProcessId
GetSystemMetrics
UnregisterClassA
LoadStringW
PostMessageW
IsWindow
GetLastInputInfo
GetCursorPos
RedrawWindow
ClientToScreen
MoveWindow
LoadImageW
PostQuitMessage
CharNextW
PeekMessageW
DestroyAcceleratorTable
InvalidateRgn
FillRect
CreateAcceleratorTableW
GetSysColor
GetClassNameW
GetDlgItem
GetFocus
DefWindowProcW
CallWindowProcW
KillTimer
DestroyWindow
SetTimer
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
SetRectEmpty
IsRectEmpty
FindWindowW
SendMessageTimeoutW
GetWindowPlacement
ShowWindow
EnableWindow
GetParent
SendMessageW
SetWindowPos
SetFocus
RegisterWindowMessageW
GetDC
ReleaseDC
ScreenToClient
GetWindowRect
PtInRect
SetCapture
ReleaseCapture
GetMonitorInfoW
AllowSetForegroundWindow
GetForegroundWindow
AttachThreadInput
SetForegroundWindow
SetActiveWindow
GetKeyboardState
keybd_event
GetDesktopWindow
MonitorFromRect
SetWindowRgn
InvalidateRect
UpdateWindow
MessageBoxW
GetActiveWindow
GetClientRect
IsDialogMessageW
CopyRect
OffsetRect
MapWindowPoints
MonitorFromWindow
GetWindow
SetWindowTextW
GetMessageW
TranslateMessage
DispatchMessageW
DrawTextW
GetMessagePos
SetRect
UpdateLayeredWindow
SetCursor
GetWindowDC
GetClassLongW
SetClassLongW
IsChild
EndPaint
BeginPaint
GetWindowTextW
GetWindowTextLengthW
GetWindowLongW
gdi32
CreateFontW
CreateDIBSection
CreateRectRgnIndirect
CreateCompatibleDC
DeleteDC
GetTextExtentPoint32W
GetStockObject
GetObjectA
GetTextMetricsW
SelectObject
GetObjectW
GetDeviceCaps
SetViewportOrgEx
BitBlt
CreateCompatibleBitmap
GetPixel
CreateRectRgn
CombineRgn
DeleteObject
CreateSolidBrush
advapi32
ConvertSidToStringSidW
GetTokenInformation
LookupAccountSidW
OpenProcessToken
CryptAcquireContextW
CryptReleaseContext
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegQueryValueExW
RegDeleteKeyW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegOpenKeyW
GetSidSubAuthority
RegCreateKeyA
RegQueryInfoKeyW
CryptGenRandom
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
shell32
CommandLineToArgvW
ord680
ShellExecuteW
ord165
SHGetFolderPathW
SHGetSpecialFolderPathW
ole32
CLSIDFromString
CoGetClassObject
OleLockRunning
StringFromGUID2
OleUninitialize
OleInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CreateStreamOnHGlobal
CLSIDFromProgID
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
oleaut32
VariantInit
VariantClear
SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
SysStringLen
OleCreateFontIndirect
VarUI4FromStr
VarBstrCmp
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
DispCallFunc
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
SafeArrayCopy
SafeArrayGetVartype
SafeArrayPutElement
SafeArrayCreate
SysAllocString
SysFreeString
shlwapi
PathIsDirectoryW
PathRemoveFileSpecW
StrStrIW
PathFileExistsW
PathCombineW
SHGetValueW
PathAppendW
SHSetValueW
SHDeleteValueW
StrStrIA
PathUnquoteSpacesW
SHGetValueA
SHDeleteValueA
SHSetValueA
ord437
PathStripPathW
PathCompactPathW
ColorRGBToHLS
ColorHLSToRGB
PathFindExtensionA
wnsprintfW
PathFindFileNameW
PathFindExtensionW
StrCmpIW
comctl32
InitCommonControlsEx
gdiplus
GdipTranslateWorldTransform
GdipSetPathGradientGammaCorrection
GdipSetPathGradientCenterPoint
GdipAddPathLine2
GdipGetPathWorldBoundsI
GdipPrivateAddMemoryFont
GdipDrawImageRectRectI
GdipDrawLine
GdipAddPathLine
GdipAddPathArc
GdipSaveImageToFile
GdipDeletePrivateFontCollection
GdipNewPrivateFontCollection
GdipAddPathPie
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSetInterpolationMode
GdipAddPathEllipseI
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipDrawImagePointRectI
GdipResetWorldTransform
GdipRotateWorldTransform
GdipSetPathGradientCenterColor
GdipCreatePathGradientFromPath
GdipCreateFromHWND
GdipDrawString
GdipGetFontHeight
GdipFillRectangle
GdipResetClip
GdipSetClipRectI
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipSetTextRenderingHint
GdipMeasureString
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFont
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipDeleteFontFamily
GdipSetLinePresetBlend
GdipDrawLineI
GdipCreatePen2
GdipDrawRectangleI
GdipCreateLineBrushFromRect
GdipAddPathRectangleI
GdipGetPixelOffsetMode
GdipSetPenWidth
GdipDrawEllipseI
GdipSetPenDashStyle
GdipSetPenDashOffset
GdipAddPathLineI
GdipSetPixelOffsetMode
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipBitmapSetPixel
GdipBitmapGetPixel
GdipGetImageHeight
GdipGetImageWidth
GdipDrawPath
GdipDeletePen
GdipCreatePen1
GdipFillPath
GdipCreateSolidFill
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipDeletePath
GdipCreatePath
GdipFillRectangleI
GdipCloneBrush
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateLineBrushFromRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipClosePathFigure
GdipAddPathArcI
GdipResetPath
GdipDeleteStringFormat
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
psapi
GetModuleFileNameExW
wininet
InternetOpenUrlW
InternetOpenW
InternetSetOptionW
InternetCloseHandle
HttpQueryInfoW
InternetReadFile
InternetCrackUrlA
InternetGetConnectedState
DeleteUrlCacheEntryW
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
userenv
GetUserProfileDirectoryW
dnsapi
DnsQuery_A
DnsFree
ws2_32
inet_ntoa
htons
htonl
ntohl
ntohs
imm32
ImmDisableIME
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
231KB
Virtual Size
232KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
509KB
Virtual Size
509KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=40, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=206, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=100, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=109, productName=VS2005 build 50727, version=50727,
count=43, id=123, productName=VS2005 build 50727, version=50727,
count=630, id=1, productName=Unmarked objects,
count=115, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,