17205346461[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
17205346461.zip
Size 101.0MB
Sample240510-er5vqsde42
SHA256 f38893f6750a755f163cb833b6aa9c9af5b1c3cbffa2d2f331f890468aa8db42
MD5 c47bb0d7b26bbf7fad6d49754c99ac50
SHA1 f391e8cbcf294f4ada3010653f256f4beafa0d99
SHA512 13e9fc5744c649ff90d7c9ae39291be7a39c01560bf43a1584d378bf60c36ef5fd5aea857ecc164e95c4d537c397f296c3fc8b3104098ec54cc94fbd2188a742
SSDEEP 3145728:wl2kD5RzowMbcZlorenXPhBF4xY5nwZjHWj:uDPzofAjXa4w9U
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

pdf evasion

Malware Config

Signatures

Malformed or missing cross-reference table in PDF
Malformed or missing cross-reference tables are often used to evade detection
pdf evasion

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/w2_1040 tax forms/g2m.dll

File Explorer

17205346461.zip

.zip 101.0MB
e8943ca9072d92c62c9c707ae8cc351e724aebe6bf45345a1570224f12f321d4

.zip 101.1MB
w2_1040 tax forms/1099Misc.inf

.pdf 220.0MB
w2_1040 tax forms/Marybeth 2023 Tax Docs.exe

.exe 31KB
w2_1040 tax forms/g2m.dll

.dll 8.4MB

17205346461.zip

SHA256 f38893f6750a755f163cb833b6aa9c9af5b1c3cbffa2d2f331f890468aa8db42
MD5 c47bb0d7b26bbf7fad6d49754c99ac50
SHA1 f391e8cbcf294f4ada3010653f256f4beafa0d99
SHA512 13e9fc5744c649ff90d7c9ae39291be7a39c01560bf43a1584d378bf60c36ef5fd5aea857ecc164e95c4d537c397f296c3fc8b3104098ec54cc94fbd2188a742
SSDEEP 3145728:wl2kD5RzowMbcZlorenXPhBF4xY5nwZjHWj:uDPzofAjXa4w9U
MD5 SHA1 SHA512 SSDEEP

Password

infected

w2_1040 tax forms/Marybeth 2023 Tax Docs.exe

IMPHASH 5419c6d0b7a37c6f48c0d961a0d909db
SHA256 a73709c1b5f1f875ee35f477c4e263a57050c36e2cff31ad1ceca17d9623e7cd
MD5 4db45c5fdb9e115b922bdf007523f082
SHA1 90297382a170ff3ea7931db2425329d0b2f70f04
SHA512 7f0bcb2ee96c523cce764d1ec7d197d3aadddcf6fae71b63e88c3a26883b2f2fb4a446187adfbb023be779056ebc0ea50a785c72bbe97bb7dca41a810d0ff6c7
SSDEEP 384:V4Kj/M8y6ryzqEt7a9Oey+IFdP64VYaEwDtiBgxoxlnLr2STchsCxXBhgBx4eMDg:VHDXr+VWOV+csoHViBBn+hRIqeMDGt
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

90:10:c1:28:da:90:ce:50:43:d1:8e:83:8b:91:69:13:ad:36:49:d0:e1:e4:4b:74:ec:98:20:87:00:85:01:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US

Chains

Sep 4, 2019

CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - May 30, 2020

Subject

CN=LogMeIn\, Inc.,O=LogMeIn\, Inc.,L=Boston,ST=Massachusetts,C=US

Serial Number

07:77:dd:21:cf:5d:c9:dc:78:5a:cb:ae:2a:02:bb:26

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 26, 2018 - Nov 3, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Minor OS version

Major OS version

Entry point

4111

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\Communication_Cloud\G2MWTEndpoint\Production\build-g2mwt-endpoint\output\G2M_Exe.pdb

w2_1040 tax forms/g2m.dll

IMPHASH 8d92ce4913322e1cf2d6cd6654f2944f
SHA256 a2628874cd8befaa87833bf11e4d2dd7791504e8e186cbac74effe2abe645e31
MD5 4e4ed9a1d3f931b3a9d3aebb154ac7d0
SHA1 88c7e957e59d43f7eda6dbadc3bee8aef404c5b1
SHA512 ec8b31cd97ec86504ec24c08ee5f749af82ea9e9c2b8321daa6016f4426ad8dfb90d859e5abc74d1aebe6fedf4dc119e376a8ab3e5de9e127d68f935eddb36fe
SSDEEP 98304:Oj0JobLouXKetlXSPc62k8Oc9eaxc3oKht59qziJqIPdqajzdUH:OjDLoemf2k8Oc9goCqziJqce
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2034231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\p4builds\Products\GoToMeeting\v4.8_builds\output\G2M.pdb

rpcrt4

IUnknown_AddRef_Proxy IUnknown_Release_Proxy CStdStubBuffer_QueryInterface CStdStubBuffer_AddRef CStdStubBuffer_Connect IUnknown_QueryInterface_Proxy CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease NdrCStdStubBuffer_Release RpcStringFreeW NdrOleAllocate NdrOleFree UuidCreate CStdStubBuffer_Disconnect UuidToStringW NdrDllGetClassObject

psapi

GetModuleBaseNameW EnumProcessModules GetModuleFileNameExW GetModuleInformation EnumProcesses

shlwapi

PathStripPathW StrFormatByteSizeW StrChrW PathRemoveExtensionW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

winmm

mixerClose waveOutGetDevCapsW waveInGetDevCapsW waveInGetNumDevs waveOutGetNumDevs timeKillEvent timeSetEvent mixerGetDevCapsA waveOutGetPosition waveOutSetVolume waveOutGetVolume mixerGetControlDetailsA waveOutGetDevCapsA waveInGetDevCapsA mixerGetLineInfoA mixerGetLineControlsA waveInUnprepareHeader waveInReset waveInPrepareHeader waveInAddBuffer waveInStart waveInStop waveInGetErrorTextW waveInGetPosition mmioOpenW mmioDescend mmioAscend waveOutUnprepareHeader waveOutReset waveOutPrepareHeader mmioRead waveOutPause waveOutWrite mmioClose mixerGetNumDevs mixerOpen mixerSetControlDetails mixerGetLineInfoW mixerGetDevCapsW waveInOpen waveOutOpen waveInClose waveOutClose mixerGetID waveInGetID waveOutGetID mixerGetLineControlsW mixerGetControlDetailsW timeGetTime

msacm32

acmStreamUnprepareHeader acmStreamClose acmStreamPrepareHeader acmStreamOpen acmStreamConvert

wininet

InternetSetOptionW InternetOpenW InternetCloseHandle InternetConnectW InternetErrorDlg HttpEndRequestW InternetQueryOptionW HttpSendRequestExW HttpQueryInfoW InternetReadFileExA InternetSetStatusCallbackW HttpOpenRequestW

kernel32

GetFileType GetStdHandle SetHandleCount RtlUnwind CreateThread ExitThread FreeLibrary RaiseException TlsGetValue TlsSetValue TlsAlloc GetProcAddress GetModuleHandleW IsBadReadPtr FormatMessageW GetModuleFileNameW GetCurrentProcess Sleep LoadLibraryW GetVersionExW SetUnhandledExceptionFilter GetLastError LocalFree OutputDebugStringW LoadLibraryExW CreateEventA GetSystemTimeAsFileTime CloseHandle UnmapViewOfFile WaitForSingleObject SetEvent MapViewOfFile CreateFileMappingW GetFileSize GetCurrentProcessId CreateFileW GetTempPathW GetCurrentThreadId HeapCreate HeapDestroy HeapAlloc HeapFree TlsFree FileTimeToSystemTime SystemTimeToFileTime GetSystemTime WideCharToMultiByte MultiByteToWideChar GetCurrentThread OpenProcess FindClose ReadFile WriteFile SetFilePointer SetEndOfFile FlushFileBuffers DeleteFileW CopyFileW GetFileAttributesW GetDiskFreeSpaceExW GetTempFileNameW FindFirstFileW MoveFileW GetSystemWindowsDirectoryW GetLocaleInfoW GetStartupInfoA GlobalMemoryStatusEx lstrlenA LocalAlloc lstrcmpiW ReleaseMutex CreateMutexW ResumeThread GetThreadContext SuspendThread InterlockedIncrement SetThreadPriority TerminateThread CreateProcessW TerminateProcess GetExitCodeProcess GetShortPathNameW CompareFileTime CreateDirectoryW RemoveDirectoryW GetSystemDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW GetLocalTime InitializeCriticalSection DeleteCriticalSection TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects GetTickCount GetTimeFormatW GetDateFormatW GetTimeZoneInformation QueryPerformanceCounter QueryPerformanceFrequency ResetEvent OpenEventW CreateEventW FindVolumeClose FindNextVolumeW QueryDosDeviceW FindFirstVolumeW FindNextFileW GetSystemDefaultLCID GetUserDefaultLCID GetUserDefaultUILanguage EnumResourceLanguagesW DisableThreadLibraryCalls InterlockedDecrement lstrlenW SizeofResource LoadResource FindResourceW OpenMutexW GetWindowsDirectoryW GetTempPathA CreateDirectoryA SetLastError SetWaitableTimer CreateWaitableTimerW WritePrivateProfileStringW GetPrivateProfileStringW VirtualFree VirtualAlloc GlobalLock GlobalFree GlobalUnlock GlobalAlloc FlushInstructionCache lstrcmpW MulDiv LockResource GetVersionExA ExpandEnvironmentStringsW Thread32Next Thread32First CreateToolhelp32Snapshot Process32NextW Process32FirstW GetFileTime ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetModuleHandleA HeapSize GetConsoleCP GetConsoleMode HeapReAlloc GetTimeFormatA GetDateFormatA CompareStringW SetConsoleCtrlHandler InitializeCriticalSectionAndSpinCount LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetProcessHeap CompareStringA SetEnvironmentVariableA InterlockedCompareExchange IsProcessorFeaturePresent GetCommandLineW ReleaseSemaphore CreateSemaphoreW GetVolumeInformationW DuplicateHandle GetVersion GlobalMemoryStatus GetFileInformationByHandle GetPrivateProfileSectionW GetPrivateProfileSectionNamesW CreateMutexA FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA GetFullPathNameA PeekNamedPipe GetCurrentDirectoryA FoldStringW FlushConsoleInputBuffer ReadConsoleInputA SetConsoleMode IsDebuggerPresent UnhandledExceptionFilter GetCommandLineA LoadLibraryA InterlockedExchange GetSystemInfo

gdi32

CreateDCW CreatePen SetPolyFillMode Polygon FrameRgn PaintRgn CreatePolygonRgn ExtTextOutW CreateBitmap SetROP2 FillRgn Polyline GetRegionData CreateRectRgnIndirect OffsetRgn GetRgnBox EqualRgn GetSystemPaletteEntries CreatePalette GetPaletteEntries GetDIBColorTable SetDIBColorTable CreateDIBSection RestoreDC SaveDC CreateRoundRectRgn GetBitmapBits GetTextMetricsW SetBkColor SetStretchBltMode StretchBlt GetDIBits CreateDIBitmap SetDIBits SelectClipRgn ExcludeClipRect SetMapMode SetWindowExtEx SetViewportExtEx SetWindowOrgEx SetViewportOrgEx LineTo MoveToEx SetPixelV GetTextExtentPoint32W CreateRectRgn SetRectRgn CombineRgn GetClipBox GetDCOrgEx SetTextColor TextOutW GetTextColor CreateFontW CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps BitBlt CreateSolidBrush GetPixel SetPixel SetBkMode SetBrushOrgEx CreateCompatibleDC CreateCompatibleBitmap SelectObject CreatePatternBrush DeleteDC DeleteObject GetBkMode

comdlg32

ChooseColorW GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoInitializeSecurity CoGetObject CoDisconnectObject OleInitialize CoGetCurrentProcess OleUninitialize CoUninitialize CoInitializeEx CoCreateFreeThreadedMarshaler CoTaskMemFree CoRegisterClassObject CoRevokeClassObject CoGetCallContext CoInitialize CreateStreamOnHGlobal CLSIDFromString CoGetClassObject OleLockRunning CLSIDFromProgID CoCreateGuid CoRegisterPSClsid StringFromCLSID CoSetProxyBlanket CoCreateInstance StringFromGUID2 CoTaskMemRealloc CoTaskMemAlloc

oleaut32

BSTR_UserFree BSTR_UserUnmarshal BSTR_UserMarshal BSTR_UserSize LPSAFEARRAY_UserFree LPSAFEARRAY_UserUnmarshal LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserSize VarUI4FromStr RegisterTypeLi SysStringLen SafeArrayDestroy SysAllocString SysAllocStringByteLen UnRegisterTypeLi SystemTimeToVariantTime SysStringByteLen SysAllocStringLen VariantInit VariantClear OleCreateFontIndirect LoadRegTypeLi OleLoadPicture DispCallFunc VarBstrCat VarBstrCmp OleLoadPicturePath SafeArrayGetElement SafeArrayCreate LoadTypeLi SafeArrayPutElement SysFreeString

secur32

GetUserNameExW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

comctl32

InitCommonControlsEx

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wsock32

WSASetLastError ntohs ioctlsocket htons gethostname connect socket send shutdown getsockname setsockopt select __WSAFDIsSet recv inet_ntoa gethostbyname WSAStartup WSACleanup WSAGetLastError getpeername closesocket inet_addr

Name

.text

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

151KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

963KB

Virtual Size

962KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=1, id=150, version=20413,

count=8, id=132, productName=VS2008 build 21022, version=21022,

count=40, id=109, productName=VS2005 build 50727, version=50727,

count=3, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=69, id=10, version=8447,

count=94, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=13, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=45, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=9, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=20, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=66, id=110, productName=VS2005 build 50727, version=50727,

count=3, id=138, version=30729,

count=37, id=123, productName=VS2005 build 50727, version=50727,

count=788, id=1, productName=Unmarked objects,

count=65, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=1735, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=560, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

Sharing

General

Malware Config

Signatures

File Explorer

17205346461.zip

e8943ca9072d92c62c9c707ae8cc351e724aebe6bf45345a1570224f12f321d4

w2_1040 tax forms/1099Misc.inf

w2_1040 tax forms/Marybeth 2023 Tax Docs.exe

kernel32

user32

g2m

generic

w2_1040 tax forms/g2m.dll

rpcrt4

psapi

shlwapi

version

winmm

msacm32

wininet

kernel32

gdi32

comdlg32

ole32

oleaut32

secur32

wtsapi32

comctl32

userenv

wsock32

generic