maladro[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

maladro.zip
Size

1.8MB
MD5

fd3e9814b55c88ebfc35ec44aaa6ce09
SHA1

b530c1ad2a50bde2e057a29986335ba3b0a21caf
SHA256

878b0781c63afded6d6517ab9a8ca3562ab986d2bb4d5590af24484909ca17ca
SHA512

97f3c07d415f61de759aaadcb47ff0f45359a19c94e1d0f61addde7bfc7939606993b347f99c63e8c9b69e59cdadaf63a1d757b38b6c9f61f30e6e4bae7c7196
SSDEEP

49152:iWzM4RWr66tRKyJcVvui/VwyS+6choROKH1N:b3W9tnC9L2FyhCDH1N

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/x.dll	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/x.dll
unpack002/out.upx

Files

maladro.zip
.zip
s.exe
.exe windows:5 windows x64 arch:x64

49267756c53f107d9c60af9a41e0c72b

Code Sign

01:b9:61:78:3f:84:2b:68:8b:8e:68:87:e5:9a:9c:86
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/01/2021, 00:00

Not After

25/10/2021, 23:59

Subject

SERIALNUMBER=23310837,CN=Trend Micro\, Inc.,O=Trend Micro\, Inc.,L=Da’an District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

24:8e:9f:c1:44:61:7a:2f:0e:41:fb:a3:83:cd:44:91:c7:61:b2:39:8e:17:71:1e:09:46:00:ae:f8:97:7a:1b
Signer

Actual PE Digest

24:8e:9f:c1:44:61:7a:2f:0e:41:fb:a3:83:cd:44:91:c7:61:b2:39:8e:17:71:1e:09:46:00:ae:f8:97:7a:1b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\ci-jenkins\workspace\Airsupport\AirSupport_Client6.0\AirSupport-Client-6.0\src\build\symbol\Release\x64\Update.pdb

Imports

ws2_32

connect
closesocket
bind
socket
WSAGetLastError
__WSAFDIsSet
select
send
shutdown
htonl
gethostbyname
getservbyname
recv
WSASetLastError
gethostname
ioctlsocket
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
WSAIoctl
setsockopt
ntohs
htons
getpeername
getsockname
getsockopt

wldap32

ord127
ord27
ord26
ord118
ord41
ord208
ord216
ord147
ord14
ord46
ord219
ord167
ord142
ord79
ord133
ord301
ord145

kernel32

GlobalMemoryStatus
FlushConsoleInputBuffer
LoadLibraryA
LocalFree
GetCurrentProcess
GetSystemTimeAsFileTime
HeapAlloc
GetProcessHeap
HeapFree
lstrlenW
WideCharToMultiByte
lstrcpyW
GetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
ReadFile
SetLastError
FormatMessageA
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
GetSystemDirectoryW
VerifyVersionInfoW
WaitForSingleObjectEx
ExpandEnvironmentStringsA
PeekNamedPipe
WaitForMultipleObjects
GetFullPathNameW
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetExitCodeProcess
GetVersionExW
GetSystemInfo
InitializeCriticalSection
GetCurrentProcessId
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
ResetEvent
LocalAlloc
FindClose
TerminateProcess
GetDriveTypeW
GetTimeZoneInformation
ReadConsoleW
GetConsoleCP
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetLocaleInfoW
CompareStringW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlCaptureContext
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
FileTimeToSystemTime
GetFileInformationByHandle
FileTimeToLocalFileTime
SetFilePointerEx
LoadLibraryExW
ExitThread
CreateThread
SetConsoleMode
ReadConsoleInputA
QueryPerformanceCounter
MultiByteToWideChar
GetModuleHandleW
GetVersion
GetCurrentThreadId
WriteFile
GetFileType
GetStdHandle
RtlVirtualUnwind
GetFileSize
CreateFileW
FreeLibrary
GetProcAddress
LoadLibraryW
OpenProcess
GetTickCount
FindNextFileW
MoveFileExW
Sleep
CreateSemaphoreW
GetTimeFormatW
GetDateFormatW
GetUserDefaultUILanguage
CreateDirectoryW
GetFileAttributesW
RemoveDirectoryW
GetLocalTime
FindFirstFileW
SetFileAttributesW
DeleteFileW
LeaveCriticalSection
EnterCriticalSection
GetFileAttributesExW
IsValidLocale
GetModuleFileNameW
CopyFileW
OutputDebugStringW
WaitForSingleObject
GetLastError
SetEvent
CloseHandle
CreateEventA
SetStdHandle
FindFirstFileExW
GetThreadTimes
InitializeSListHead
WriteConsoleW
SetEnvironmentVariableA
GetConsoleMode
IsProcessorFeaturePresent
IsDebuggerPresent
SetConsoleCtrlHandler
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetCommandLineW
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SystemTimeToFileTime
OpenEventA
GetStringTypeExW
GetUserDefaultLCID
LCMapStringW
InitializeCriticalSectionAndSpinCount
HeapSize
HeapReAlloc
HeapDestroy
RaiseException
DecodePointer
EncodePointer
GetCurrentThread
GetStringTypeW
GetCurrentDirectoryW
GetSystemTime

user32

DispatchMessageW
GetWindowRect
TranslateMessage
MsgWaitForMultipleObjects
FindWindowExW
GetSystemMetrics
FindWindowW
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
SendMessageW
PeekMessageW
LoadStringW

advapi32

GetSecurityDescriptorOwner
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegisterEventSourceW
ReportEventW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegFlushKey
RegQueryValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitializeSecurityDescriptor
MakeAbsoluteSD
GetSecurityDescriptorControl
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetAclInformation
AddAce
InitializeAcl
IsValidSid
GetLengthSid
CopySid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
RegEnumValueW
RegSetValueExW
DeregisterEventSource

shell32

SHGetFolderPathW

ole32

CoCreateGuid

shlwapi

PathFindFileNameA
PathFileExistsW

gdiplus

GdiplusShutdown

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

rpcrt4

RpcStringFreeW
UuidToStringW

crypt32

CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 800KB - Virtual size: 800KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 382KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x.dll
.dll windows:5 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

Init

Sections

UPX0
Size: - Virtual size: 124KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 73KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:5 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

Init

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49267756c53f107d9c60af9a41e0c72b

Code Sign

01:b9:61:78:3f:84:2b:68:8b:8e:68:87:e5:9a:9c:86Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

24:8e:9f:c1:44:61:7a:2f:0e:41:fb:a3:83:cd:44:91:c7:61:b2:39:8e:17:71:1e:09:46:00:ae:f8:97:7a:1bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

wldap32

kernel32

user32

advapi32

shell32

ole32

shlwapi

gdiplus

version

rpcrt4

crypt32

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 800KB - Virtual size: 800KB

.data Size: 382KB - Virtual size: 428KB

.pdata Size: 137KB - Virtual size: 137KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 73KB - Virtual size: 73KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 124KB

UPX1 Size: 73KB - Virtual size: 76KB

.rsrc Size: 1024B - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 109KB - Virtual size: 108KB

.rdata Size: 47KB - Virtual size: 46KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 5KB - Virtual size: 5KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 512B - Virtual size: 432B

.reloc Size: 2KB - Virtual size: 1KB

01:b9:61:78:3f:84:2b:68:8b:8e:68:87:e5:9a:9c:86
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

24:8e:9f:c1:44:61:7a:2f:0e:41:fb:a3:83:cd:44:91:c7:61:b2:39:8e:17:71:1e:09:46:00:ae:f8:97:7a:1b
Signer

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 800KB - Virtual size: 800KB

.data
Size: 382KB - Virtual size: 428KB

.pdata
Size: 137KB - Virtual size: 137KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 73KB - Virtual size: 73KB

UPX0
Size: - Virtual size: 124KB

UPX1
Size: 73KB - Virtual size: 76KB

.rsrc
Size: 1024B - Virtual size: 4KB

.text
Size: 109KB - Virtual size: 108KB

.rdata
Size: 47KB - Virtual size: 46KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 5KB - Virtual size: 5KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 512B - Virtual size: 432B

.reloc
Size: 2KB - Virtual size: 1KB