d8f54575aff075268200250b3ed4af1da894db2199432b7110605003c6afba4a
- SHA256 d8f54575aff075268200250b3ed4af1da894db2199432b7110605003c6afba4a
Static task
static1
1 signatures
General
- Target d8f54575aff075268200250b3ed4af1da894db2199432b7110605003c6afba4a
- Size 319KB
- Sample240517-rlfd4sbe59
- SHA256 d8f54575aff075268200250b3ed4af1da894db2199432b7110605003c6afba4a
- MD5 a0e268be651237d247b00de5054d46ef
- SHA1 cc7f6e53b4e43ec5e37b03eabd07bfbc5ecef180
- SHA512 79b39b8b1a474ef252e2e0a8ee93c2c0eabb6af617b00c01feb4062a9185f4be613eba32e3bf5aa828064b895909faabc5836af1976490dbbe6f94eb19963f43
- SSDEEP 6144:khSoctB/Rul9dnOlXnuD4dU81CZWKie8TYS+dHJptZTjjoVi+nofGC94J:kGn/ROO+D4dUvqYS+JTEiNlWJ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/220509 - (Cabinet Meeting 2022)/libcef.dll
File Explorer
-
d8f54575aff075268200250b3ed4af1da894db2199432b7110605003c6afba4a.rar 319KB
-
220509 - (Cabinet Meeting 2022)/Increasingly confident US is baiting China.exe.exe 397KB
-
220509 - (Cabinet Meeting 2022)/libcef.dll.dll 190KB
-
220509 - (Cabinet Meeting 2022)/~.docx 150KB
220509 - (Cabinet Meeting 2022)/Increasingly confident US is baiting China.exe
- IMPHASH febe62fb64b14f2d00c0f57e6e829729
- SHA256 4761183bc8bff993a5551916eda73c84bb8f9eadd24c4c19587045bb91609a83
- MD5 c751af3a2b5e5085e0cf4a66a09480d9
- SHA1 0d451c8ee760d3fdf1233b44b657dc10e0450bb6
- SHA512 bd88ea76db942b4fd865ed986be75d6df6a90d10f3600a4c3f330a0d7935b1906b536a2eb2cc0211dd199bf2a37440d0a8febbbe6c6ad9b9027e6e59c9511e01
- SSDEEP 12288:n5RmQFpKMFeO7Blp/B8Z7QZLJZpT6672GbziER839l/d6LYE2B38jqLX:Z/l839l/ooEC
- MD5 SHA1 SHA512 SSDEEP
Digest
88:85:68:e7:6b:14:36:d9:d9:fa:1d:89:5c:ad:22:22:43:a3:39:71:94:1d:18:af:8c:16:a5:3a:f3:b6:e6:27
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Nov 29, 2021
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
05:35:93:bf:71:f7:48:1b:9f:b7:6b:cb:4e:cc:f5:78
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 19, 2020 - Dec 20, 2022
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
197193
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\jenkins\workspace\NGLWORKFLOW\master\Acrobat\winx86\Release\project\win\ngl-workflow\Win32\Release (Acrobat)\adobe_licensing_wf_helper_acro.pdb
kernel32
GetLastError
SetLastError
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LCMapStringW
GetStringTypeW
GetCPInfo
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
LoadLibraryExW
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetFileType
GetProcessHeap
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
SetFilePointerEx
HeapSize
FlushFileBuffers
GetConsoleCP
GetConsoleMode
CreateFileW
WriteConsoleW
Name
.text
Size
240KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=26213,
count=154, id=261, version=26213,
count=22, id=260, version=26213,
count=20, id=259, version=24123,
count=34, id=260, version=24123,
count=3, id=257, version=26213,
count=60, id=261, version=24123,
count=122, id=261, productName=VS2019 v16.10.4 build 30040, version=30040,
count=220, id=1, productName=Unmarked objects,
count=3, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
220509 - (Cabinet Meeting 2022)/libcef.dll
- IMPHASH 98df8a21f6715eafba0fde960c0a49ac
- SHA256 966ab1c468e3fc7d8d8b2d73a9ca9a85d352a0db8043c5eab36dd304a5915812
- MD5 268d61837aa248c1d49a973612a129ce
- SHA1 1da0d7053ace976847cc2c9ff783743195178013
- SHA512 ec9015ffb5d7f5b545ce30f91314de961757c1f885ef3a66a7b918418f48cfbe38dcfa9d2ac9c8969469560d50696a55c8a9d5b55f58f675e1248b7328ccbcaa
- SSDEEP 3072:GZyxSazBuliXpfiRFc/E4RqaHH+h2hsD1ZeTir6l9ZsyBtPUb:Gn4pKrcZqWH+hGsfeTZL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
54624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ExitProcess
WaitForSingleObject
GetModuleHandleW
VirtualFree
CopyFileW
CreateEventA
GetModuleFileNameW
GetProcAddress
VirtualAlloc
OpenEventA
SetCurrentDirectoryW
lstrcatW
ResumeThread
CloseHandle
CreateFileW
SetStdHandle
GetLastError
CreateDirectoryA
GetSystemTimeAsFileTime
GetCurrentThreadId
DecodePointer
GetCommandLineA
EncodePointer
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapValidate
IsBadReadPtr
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
WriteFile
LoadLibraryW
RtlUnwind
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LCMapStringW
MultiByteToWideChar
GetStringTypeW
IsProcessorFeaturePresent
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
user32
GrayStringW
shell32
SHGetSpecialFolderPathW
?CreateGraphicsResources__Close@@YAHXZ
?CreateGraphicsResources__Help@@YAXXZ
?CreateGraphicsResources__Min@@YAXXZ
?CreateGraphicsResources__Stop@@YAXXZ
?CreateGraphicsResources__Support@@YAXXZ
?GraphicsMainWindow_Code@@YAAAVGraphicsMainWindow@@XZ
?GraphicsMainWindow_Main@@YAAAVGraphicsMainWindow@@XZ
?Graphics_res_DeleteJob@GraphicsMainWindow@@QAEXK@Z
?Graphics_res_FreeJob@GraphicsMainWindow@@QAEXK@Z
?Graphics_res_GetLastError@GraphicsMainWindow@@QAEXPB_W@Z
?Graphics_res_PageHelp@GraphicsMainWindow@@QAEXXZ
?Graphics_res_SetLastError@GraphicsMainWindow@@QAEXXZ
cef_api_hash
Name
.text
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=43, id=171, productName=VS2010 build 30319, version=30319,
count=16, id=158, productName=VS2010 build 30319, version=30319,
count=100, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=5, id=175, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
220509 - (Cabinet Meeting 2022)/~
- SHA256 0f80fb8dd52c9aa22db0212cc6ebee8c95f9ff81cd281dfe6d89a3edb0e7c983
- MD5 cf75e2ab9caeefd678039acb3fadf657
- SHA1 52625f8def2441e441bb2de1099f2d78b4dd2d4f
- SHA512 b560c00c8c4d8536409e55afc78a7b7268113849e5d218ef824f3bd94b8d411b1f049c0918953eee20d17ea53ac767101ca4127b192310d1a3cef63ecec81201
- SSDEEP 3072:wHLfryBHGy7RXXz5ij5S0pOvBGAmf08So3qE5aztUm:wHLfry8ylXdwVpki09tn
- MD5 SHA1 SHA512 SSDEEP