Release.zip
- SHA256 275ea14a7479b277d772617a5effe9739a0c1fa7884cb1fb82a23c8607bd2b2d
Overview
overview
7Static
static
7Release.rar
windows7-x64
7Release.rar
windows10-2004-x64
3Release/Bu...re.dll
windows7-x64
1Release/Bu...re.dll
windows10-2004-x64
1Release/Bu....3.dll
windows7-x64
1Release/Bu....3.dll
windows10-2004-x64
1Release/Di...PC.dll
windows7-x64
1Release/Di...PC.dll
windows10-2004-x64
1Release/Loader.exe
windows7-x64
1Release/Loader.exe
windows10-2004-x64
1Release/Lo...xe.xml
windows7-x64
1Release/Lo...xe.xml
windows10-2004-x64
1Release/Loader.pdb
windows7-x64
3Release/Loader.pdb
windows10-2004-x64
3Release/Si...UI.dll
windows7-x64
1Release/Si...UI.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Release.rar
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Release.rar
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Release/Bunifu.Core.dll
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Release/Bunifu.Core.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Release/Bunifu_UI_v1.5.3.dll
Resource
win7-20240319-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Release/Bunifu_UI_v1.5.3.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Release/DiscordRPC.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Release/DiscordRPC.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Release/Loader.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
Release/Loader.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Release/Loader.exe.xml
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
Release/Loader.exe.xml
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Release/Loader.pdb
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
Release/Loader.pdb
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
Release/Siticone.UI.dll
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Release/Siticone.UI.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Release.zip
- Size 3.5MB
- Sample240418-p9fcxadh93
- SHA256 275ea14a7479b277d772617a5effe9739a0c1fa7884cb1fb82a23c8607bd2b2d
- MD5 2794166c9ddcb72846c4d9967feaffd7
- SHA1 1b3878c15a1688a417b3a859dbf36b80f67f945e
- SHA512 785a4613788d608a817056b7cf4d2f5dc826697e1826b0af770c82dcce7e79266d04c0fbc83fa2c223ee410f3ebdba009ba81976cc62c1fe9e74c0a262be4376
- SSDEEP 98304:Oh9fwTagPOX93KSEpJdZAnQ2Cw8p1PLiJNM9BLLmvIh8Bf5:O3c7ON3F4PZAQY8DBNoIh8Bx
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/Release/Bunifu.Core.dll agile_net - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/Bunifu_UI_v1.5.3.dll unpack001/Release/DiscordRPC.dll unpack001/Release/Loader.exe
File Explorer
-
Release.zip.rar 3.5MB
-
Release/Bunifu.Core.dll.dll 2.5MB
-
Release/Bunifu_UI_v1.5.3.dll.dll 323KB
-
Release/DiscordRPC.dll.dll 84KB
-
Release/Loader.exe.exe 2.0MB
-
Release/Loader.exe.config.xml 1KB
-
Release/Loader.pdb125KB
-
Release/Siticone.UI.dll.dll 1.3MB
Release/Bunifu.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f72650f6d3a4a9b77bcdd74159282fcf724bd34afb989df6b6e075ea1dd6bc3
- MD5 d9f830dffedbb2bc371fa60784c01221
- SHA1 d6a778249e05ee04c2e5e386c31f88598338ab84
- SHA512 e8e7c712638e0aace109e0587cc4421697e1c6cacb64ff5d56efbe570615d72e72b5dd3afadd468e59116b1ed1326b25c459d5f2110b9d643bfca750825efd61
- SSDEEP 49152:9mTi+XhlhlFZ5vG+2PkuAc1B/xWCcieUuebO0Syigfihlh5:9azHb9LcFW5ifLq9yigKhlL
- MD5 SHA1 SHA512 SSDEEP
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Digest
66:e5:91:04:8f:ef:28:ab:ad:c3:32:d3:66:a4:3d:af:b4:df:5f:03
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Chains
Aug 27, 2019
SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Serial Number
0a:e9:5f:ae:cd:be:04:c8:8a:3a:d1:15:e6:f7:dd:a2
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 26, 2019 - Mar 4, 2020
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
4
Entry point
2658906
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Willy\source\repos\bunifu\backup_branch\Obfuscation\1.5.4 _secured\Bunifu.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Bunifu_UI_v1.5.3.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 76e1d3ec95fdef74abaf90392dd6f4aa5e344922abf11e572707287d467f2930
- MD5 e0ef2817ee5a7c8cd1eb837195768bd2
- SHA1 426ea1e201c7d3dc3fadce976536edce4cd51bce
- SHA512 5ad95dd7f0e712d543acfe7fd4539695f7e894988c0a2c44231c43e5ee29e743cb1ffe6bdf1fbdbdcfd3aa374f036113bcc6a1befd0114954093520bac47234c
- SSDEEP 3072:cF7t/92eSp+nuthzYeSRwwdrmMaXyXL5NQKCZIWD144HcH0CbBxyKfoYA05bC61h:eOthMswV7aXyXLSO4HcHByY35b9DYr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
336126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
320KB
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/DiscordRPC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 db2e9346343257ba243adf620630f223dda14117cef4159228660395065e17a5
- MD5 696eb4e3427fb28b1b19465ee9609037
- SHA1 d35b5c6d4bf4dd15efe73bf5684642170ba64e88
- SHA512 a8ee6a772e56642a6f0710c02abf20db024cd9c0c380f776cc1eeb8c16cb685814c2b4a58a8dfc29211b26c54666c415285ac2944ceb9f584964b7d3758cec78
- SSDEEP 1536:qsettJkKPb2F2xqXl6C4owjL++mvxsSFaLCj:qsAJkibG2xqX/4xjC+mhaLCj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
92494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\plot6\Desktop\discord-rpc-csharp-master\DiscordRPC\obj\Debug\DiscordRPC.pdb
mscoree
_CorDllMain
Name
.text
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Loader.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1142fce9c3308f4937ed1b3e84a603619c1ca6eeeee3310aa2304c4f54e61d24
- MD5 6b39e8ac3dc84b7364e941897a0aea33
- SHA1 f5bb05c5edb1e2309318646cb566cc2f7dcca9b0
- SHA512 bc13e28c7ffbd710eb570f9cbefab569891d96ca38c79ebb9e0e340d2deecbde51085045be8eb03289c8c916fa012983fe3fe11823564cbcee7d90d782ca9576
- SSDEEP 49152:k3p373Vy68bIO5YbCsKm8uVxHTt+n/CknSDwAOU3:k3p373c68lY2mzEn/He3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1984834
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\enebi\Desktop\Keyauth-Login-main\Login\obj\Release\Loader.pdb
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
159KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Loader.exe.config
- SHA256 0f5b7f517b6f7858b412996be3777073e46059c40d5334ce9e3b5e5c2c62dbe0
- MD5 c0911d7b16e774d79b85d170e367dfee
- SHA1 36761b772e82f4f7cef9f92c8290e7bb5ae05695
- SHA512 e1078d5688969ee4b54e00994e6f84a1ed1153ea2749028000ed0403c3303fb00f7291e220991a61b44673fab1189e088008345c458fdca0e0b4c642b19d6007
- MD5 SHA1 SHA512
Release/Loader.pdb
- SHA256 69f1fab7fe19d06adcbdb24ae16f6d4a6eb7270b5d9ad6774c460ea859ba3944
- MD5 117ce9ff2ad21c33ab9d05a24200d575
- SHA1 98e23df0954e04c10989ec9f9bdf95cbdc6e9f5d
- SHA512 46a816529c60e25ad1d7288540b52c596cbf98c371b9e84cb060764d0049746b44f486e6daed919892e4707faabf743787ae498c223fb6f22caa5acfba77da10
- SSDEEP 1536:limPEdfN2jmmvBap8SZA8+www9kjOqTGIgwxzsgm0T7wxzs:lw98jmmvYI7jfGfwxYM7wxY
- MD5 SHA1 SHA512 SSDEEP
Release/Siticone.UI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 27c56a28cbde094157206da1bfcd7a395111ab97b8a5ff600b11c2175dcefb26
- MD5 750c58af2e56b6addecffcf152520ab8
- SHA1 14995e7f1d12498606d9d209d78d55fe6fd87802
- SHA512 2179790e23f61b3dfea828457f8609279c70b1e071cddc73b1dbda02caa664e0aae2553fc24a4956f9e89c477d66b1a704bde26fa23bc6db26c19e18db00abb5
- SSDEEP 24576:QVMCtIZJntOFmMlMqPilaiS4Yr6ugPngPfjv9tLF2cH8gb:u8NlaVeuHFb
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
34:8f:92:bf:68:07:1b:a4:18:d3:f6:b4:4e:02:5a:2c:51:c0:51:c0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Siticone Technology
Chains
Mar 24, 2020
Subject
CN=Siticone Technology
Serial Number
3a:93:0b:19:8f:29:72:9a:49:b0:8b:f3:6d:f8:17:ae
Issuer
CN=Siticone Root CA
Timespan
Feb 5, 2020 - Oct 22, 2030
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
4
Entry point
1344742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Siticone.UI\Build\Release\Siticone.UI.WinForms\Siticone.UI.pdb
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ