1ab1496325f25fc846d39b1b144e5ab9-sample[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

1ab1496325f25fc846d39b1b144e5ab9-sample.zip
Size

15KB
MD5

b0e3e8b88a4f244b326327bfaec9913c
SHA1

101fd86f9823955b254a6931103037591a767a1c
SHA256

38c1437f5c8bad1e5c67a55e7fc320d3e111af758363b15ba3d1deed725f2f05
SHA512

ea48ffff8fe4791e784cfaf791648761ed0f228c914f7e6673f41331dcebe020b90fb7f4e46e17179bda45b6bdffc157eba7cf0a0df048358df6f14a32b73558
SSDEEP

384:nXy8Jtb4e4SFcKvgPPNVBZIUPEN4on1UDlc9Pr7P8R:nNJtbwUS3NJIUsWdD5R

Score

1^/10

Malware Config

Signatures

Files

1ab1496325f25fc846d39b1b144e5ab9-sample.zip
.zip

Password: infected
pythonw.exe
.exe windows:5 windows x86 arch:x86

b6e1d710e728da07aea7a22da373d0c8

Code Sign

8f:bf:c5:6f:f9:9b:44:63:49:31:c4:76:f5:99:9f:7b
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/10/2020, 00:00

Not After

01/10/2022, 23:59

Subject

CN=ActiveState Software Inc,O=ActiveState Software Inc,POSTALCODE=V6E2K3,STREET=1177 Hastings St W Unit 1000,L=Vancouver,ST=British Columbia,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:fb:27:e1:74:f7:73:4a:11:c6:ed:85:49:43:51:7f:09:3d:77:33
Signer

Actual PE Digest

a7:fb:27:e1:74:f7:73:4a:11:c6:ed:85:49:43:51:7f:09:3d:77:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\build\camel\work\python\PCBuild\pythonw.pdb

Imports

python27

Py_Main

msvcr90

__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
_configthreadlocale
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
__argc
__argv

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentProcessId

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 452B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

b6e1d710e728da07aea7a22da373d0c8

Code Sign

8f:bf:c5:6f:f9:9b:44:63:49:31:c4:76:f5:99:9f:7bCertificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

a7:fb:27:e1:74:f7:73:4a:11:c6:ed:85:49:43:51:7f:09:3d:77:33Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

python27

msvcr90

kernel32

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 900B

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 512B - Virtual size: 452B

8f:bf:c5:6f:f9:9b:44:63:49:31:c4:76:f5:99:9f:7b
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

a7:fb:27:e1:74:f7:73:4a:11:c6:ed:85:49:43:51:7f:09:3d:77:33
Signer

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 900B

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 512B - Virtual size: 452B