data.zip
- SHA256 5b3382faf060e55b994fb6fb9adc023b75ead723e0213c64fabd22a65f59e88c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
abc.exe
Resource
win10-20240404-en
windows10-1703-x64
5 signatures
1200 seconds
Behavioral task
behavioral2
Sample
abc.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
1 signatures
1200 seconds
Behavioral task
behavioral3
Sample
abc.exe
Resource
win11-20240412-en
windows11-21h2-x64
1 signatures
1200 seconds
General
- Target data.zip
- Size 1.4MB
- Sample240423-weabqsad2s
- SHA256 5b3382faf060e55b994fb6fb9adc023b75ead723e0213c64fabd22a65f59e88c
- MD5 f12f73f6680af8008ead5f36bf0bb603
- SHA1 a2baed066b275e827604cc537dc141237c3cd4a1
- SHA512 e56ac0c33e5e9f25a53b1df948b429a76b76a17a9209aa1e8e4f020f8eeed1214374217964c3e4dd84183362de07059762702f79256422e0e2ec5b139012b6c5
- SSDEEP 24576:ZQq5mgRbTCJJd/pMpFYc/CDPqQTF/aCxWRdajKHew/9/V8lh69w6JxLahYuq:ZQebTCJbGtaDdaCxadajkPN8lhkxs9q
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/g2m.dll
File Explorer
-
data.zip.zip 1.4MB
-
abc.exe.exe 39KB
-
data.bin1.4MB
-
g2m.dll.dll 399KB
abc.exe
- IMPHASH 6eb9cccf95968b8becec4c870f1101db
- SHA256 796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5
- MD5 f1b14f71252de9ac763dbfbfbfc8c2dc
- SHA1 dcc2dcb26c1649887f1d5ae557a000b5fe34bb98
- SHA512 636a32fb8a88a542783aa57fe047b6bca47b2bd23b41b3902671c4e9036c6dbb97576be27fd2395a988653e6b63714277873e077519b4a06cdc5f63d3c4224e0
- SSDEEP 768:YRQnUhG5bZDOTpkdD82YbQkRFokFWIILPUh:FWObZDOTpk5T6zqAh
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a9:67:63:96:99:c5:5b:7e:88:69:58:46:cb:9b:f7:d1:bb:bf:20:aa
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Citrix Online,OU=Operations+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Citrix Online,L=Fort Lauderdale,ST=Florida,C=US
Chains
Nov 14, 2012
Subject
CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US
Serial Number
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 1, 2012 - Dec 31, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Citrix Online,OU=Operations+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Citrix Online,L=Fort Lauderdale,ST=Florida,C=US
Serial Number
5c:5f:2b:a5:c9:99:4b:e5:ef:25:4f:fe:51:12:88:e1
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 30, 2012 - May 1, 2014
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb
g2m
g2mcomm_winmain
kernel32
GetModuleHandleW
GetCommandLineW
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetStartupInfoW
ExitProcess
user32
MessageBoxA
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
data.bin
- SHA256 ea0016db4d327ba924da287eba745dc148f342ffbe3913e34dd4bc75c222a91d
- MD5 f665637276f6e484d76cbfde36eed6c0
- SHA1 4425e9963fa2cf196713f58dfba03e6dd5cacd98
- SHA512 6df509a80c6eef9d7bd53581f41d56640e1acd941b00b2dbb8a42d3fa56e570267bd5b61eaf56eaae362a2bf3817e6fe7396fe18d2237bc7efce90ae2c08aa02
- SSDEEP 24576:VaQV5IAwUwkqAeJYT/Cri5g6tDqyT3AobkdfIijXu10P81ked/e6oWe4OB9XRw7E:VaQznwfqAsg6VfT3AnZuaU9W6le4OB5r
- MD5 SHA1 SHA512 SSDEEP
g2m.dll
- IMPHASH 1532936826f95b78bb364ebbb4a9e1da
- SHA256 52cceb7014050cfcecc7c10c7ea067b20c26dbf33cec0a9cef88cbddcb048836
- MD5 40a87fac95b1fee45a6660d56fe67930
- SHA1 9f7a6a9f30885607d66d0d12c422d4ecf668fc6c
- SHA512 13d8661cd3357057ab8ae1fd01e32cec925b4451fa1068932b5227f82a3b0b15adc12ed260d03f3e376ccea680c23165e8ca67904534ca1ecc3f5795e5d77380
- SSDEEP 6144:c1PrHGV3QVKxsytQJBxeMmQspEPhsGa3JB7UgG6H:c1PyV3AevQeEPhbiS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
168068
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
F:\rust-dave-sideload\target\i686-pc-windows-msvc\release\deps\rust_dave_sideload.pdb
kernel32
GetEnvironmentVariableW
VirtualAlloc
CloseHandle
GetModuleHandleA
GetProcAddress
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetNativeSystemInfo
VirtualQuery
VirtualFree
VirtualProtect
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
GetLastError
FindNextFileW
FindClose
CreateFileW
SetFileInformationByHandle
FlushFileBuffers
GetFileInformationByHandle
GetFileInformationByHandleEx
SetFilePointerEx
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TlsGetValue
TlsSetValue
AcquireSRWLockShared
ReleaseSRWLockShared
CreateThread
SetThreadStackGuarantee
GetCurrentThread
WaitForSingleObject
CreateWaitableTimerExW
SetWaitableTimer
Sleep
SetHandleInformation
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
SetLastError
ReadFile
GetCurrentProcessId
QueryPerformanceCounter
FreeEnvironmentStringsW
GetEnvironmentStringsW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
RtlCaptureContext
HeapFree
HeapReAlloc
GetModuleHandleW
FormatMessageW
ExitProcess
GetProcessHeap
HeapAlloc
GetCurrentDirectoryW
DecodePointer
GetFullPathNameW
GetModuleFileNameW
GetSystemTimeAsFileTime
GetCommandLineW
GetFileType
TerminateProcess
HeapSize
GetStringTypeW
SetStdHandle
GetConsoleOutputCP
WriteFile
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
InterlockedFlushSList
RaiseException
RtlUnwind
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
ntdll
RtlNtStatusToDosError
NtReadFile
NtWriteFile
ws2_32
WSAGetLastError
WSACleanup
WSAStartup
listen
bind
freeaddrinfo
getaddrinfo
closesocket
WSASocketW
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WaitOnAddress
DllMain
g2mchat_winmain
g2mcomm_winmain
g2mfeedback_winmain
g2mhost_winmain
g2minstaller_winmain
g2minsthigh_winmain
g2mlauncher_winmain
g2mmatchmaking_winmain
g2mmaterials_winmain
g2mpolling_winmain
g2mqanda_winmain
g2mrecorder_winmain
g2msessioncontrol_winmain
g2mstart_winmain
g2mtesting_winmain
g2mtranscoder_winmain
g2mui_winmain
g2muninstall_winmain
g2mvideoconference_winmain
g2mview_winmain
Name
.text
Size
221KB
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
80KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=139, id=261, version=30795,
count=20, id=260, version=30795,
count=31, id=261, version=33030,
count=16, id=260, version=33030,
count=20, id=259, version=33030,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=257, version=30795,
count=190, id=1, productName=Unmarked objects,
count=3, id=260, version=33133,
count=63, productName=Unmarked objects (old),
count=1, id=256, version=33133,
count=1, id=258, version=33133,