17541178989.zip
- SHA256 55a35e274170365cb002d6fb694f02fe5b69311aa610b4979166e48057c12191
Password
infected
Behavioral task
behavioral1
Sample
d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 17541178989.zip
- Size 7.4MB
- Sample240603-lcsp7aaa4z
- SHA256 55a35e274170365cb002d6fb694f02fe5b69311aa610b4979166e48057c12191
- MD5 b4398714fb1d346cc679d102787a5c53
- SHA1 8c54de012ecddac388d2425961c2f2546c776975
- SHA512 7d4ab8ee326a3194ef407579df35538f0392a856eb0e25c70014f28f2c7d17c9f48af3bd7d1b087b87bf66742c1278bf1374bc2b3d6a0d6be1a52c9df298cf99
- SSDEEP 196608:fE/SXiVnsgof1qg9CVpXNfPi+OyF34YXoCKv5Ou7264kLM:fCSSV4tIr0DvvCKxOfx
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack003/red.exe unpack005/CFDI8320e9890-a437239bd3233-b454ac564f37713533/CFDI8320e9890-a437239bd3233-b454ac564f37713533.dll unpack008/jli.dll
File Explorer
-
17541178989.zip.zip 7.4MB
-
0f8de2a116f590ace3a818302d2531af9f3c972816638c92773048c640807acc.iso 442KB
-
out.iso.iso 442KB
-
Reader.lnk.lnk 2KB
-
red.exe.exe 376KB
-
3e5b7ad3e91d565bb8a53fbec96c9f8dcb6d4c7664452841dc39000aefa5ad8d.iso 1022KB
-
out.iso.iso 1022KB
-
CFDI8320e9890-a437239bd3233-b454ac564f37713533.pdf.lnk.lnk 2KB
-
CFDI8320e9890-a437239bd3233-b454ac564f37713533/CFDI8320e9890-a437239bd3233-b454ac564f37713533.dll.dll 567KB
-
CFDI8320e9890-a437239bd3233-b454ac564f37713533/CFDI8320e9890-a437239bd3233-b454ac564f37713533.exe.exe 255KB
-
CFDI8320e9890-a437239bd3233-b454ac564f37713533/CFDI8320e9890-a437239bd3233-b454ac564f37713533.exe.config.xml 1KB
-
CFDI8320e9890-a437239bd3233-b454ac564f37713533/CFDI8320e9890-a437239bd3233-b454ac564f37713533.pdf.pdf 127KB
-
898d57eaf64673a18e958c983036392540b02f3b903d979d60090a767062f859.iso 5.2MB
-
out.iso.iso 5.2MB
-
Vesak.lnk.lnk 2KB
-
Vesak.pdf.pdf 1.9MB
-
java-rmi.exe.exe 23KB
-
jli.dll.dll 2.7MB
-
8e62ab99c72f89f7d2b4a1e40ef1a9ee729f2ab171ce675b643e77c36e477f0e.iso 1022KB
-
90765a1bd6fa8712ea1414b737c4fed172f129993203e3504b4c55db27dc0aac.iso 2.8MB
-
b86667e9bfbaf6580110d41c52ff14aa6286932d2002bdfb2662a7ae3e247e88.iso 2.8MB
-
bb7e53eed72e41a99c2245e2f108c982f0bad939b707d917ba19db74682102d6.iso 1022KB
-
d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08.iso 544KB
0f8de2a116f590ace3a818302d2531af9f3c972816638c92773048c640807acc
- SHA256 0f8de2a116f590ace3a818302d2531af9f3c972816638c92773048c640807acc
- MD5 1b4bbc6a2cfe628395c5d670d5ef470d
- SHA1 ef2565c789316612d8103056cec25f77674d78d1
- SHA512 c6d31110810087a8d10f0449963b41178b25d36c9c4f6ce5afbc08c9a71de6397ab57e48704d4c9967804c9bfc6f13531f5622a3f30128ef2e999368ce8f5e16
- SSDEEP 12288:ktgKIxfbbezR1WpOJJMjihU030/qRMrKSk:kupxTSzRKODPhDufN
- MD5 SHA1 SHA512 SSDEEP
out.iso
- SHA256 0f8de2a116f590ace3a818302d2531af9f3c972816638c92773048c640807acc
- MD5 1b4bbc6a2cfe628395c5d670d5ef470d
- SHA1 ef2565c789316612d8103056cec25f77674d78d1
- SHA512 c6d31110810087a8d10f0449963b41178b25d36c9c4f6ce5afbc08c9a71de6397ab57e48704d4c9967804c9bfc6f13531f5622a3f30128ef2e999368ce8f5e16
- SSDEEP 12288:ktgKIxfbbezR1WpOJJMjihU030/qRMrKSk:kupxTSzRKODPhDufN
- MD5 SHA1 SHA512 SSDEEP
Reader.lnk
- SHA256 61f36c5ae038faa2b58a9a17b464d01414b4265e46634f353319c471d0a35789
- MD5 66bb9363e23c7ef2d16c89cd654b491e
- SHA1 c20e8d536804cf97584eec93d9a89c09541155bc
- SHA512 b7a751e49218230d574ca9cc4cbbb1995d89798268124b1617889c7558c66902f81fdb77a299edcc6d96452cec81adb76768172710e00c9272d30821ab0089c5
- MD5 SHA1 SHA512
red.exe
- IMPHASH 29525f792856afcbe668712dc050a52b
- SHA256 2289706f678585059502a24283e0f55d56cf477524753c606f64825bba66fca8
- MD5 120c6ddfc24274b6e2e3a1ba7dc519ab
- SHA1 29936b1aa952a89905bf0f7b7053515fd72d8c5c
- SHA512 dd9b2fb6cd5f6f044daa80ef634078849032ebbdbd1d293bb7bcb0270aa8b7360c39addb0826c7a3ddc8714b559bf8828e8e506ac91bcb4702a72f4c8ec4850a
- SSDEEP 6144:KFtgKBIxGS/bbWGGJK8PpzR1WpOJOQMeEBwhUg5bBDNPbsP/qrscpyj4CVKSkn:+tgKIxfbbezR1WpOJJMjihU030/qRMra
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
147365
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
TerminateThread
LoadLibraryA
CloseHandle
GetNativeSystemInfo
CreateThread
SetVolumeMountPointW
GetProcAddress
LocalFree
DeleteCriticalSection
ExitProcess
GetCurrentProcessId
GetModuleHandleW
CopyFileW
GetVolumePathNamesForVolumeNameW
lstrcpyW
SleepEx
GetDiskFreeSpaceExA
CreateEventA
FindNextVolumeW
lstrcmpiW
CreateIoCompletionPort
GetTickCount
lstrcmpW
GetDriveTypeW
GetComputerNameA
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
QueryDosDeviceW
GetFinalPathNameByHandleW
K32GetModuleFileNameExW
DuplicateHandle
CreateEventW
GetWindowsDirectoryW
FindVolumeClose
GetFileType
GetTickCount64
GetCurrentThread
GetSystemTimeAsFileTime
ReadFile
GetFileSizeEx
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
GetSystemInfo
GlobalMemoryStatusEx
ReadConsoleW
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
GetDiskFreeSpaceExW
SetEvent
GetLastError
Sleep
MultiByteToWideChar
PostQueuedCompletionStatus
GetLocaleInfoA
GetModuleHandleA
GetCurrentThreadId
GetFileAttributesW
CreateFileW
WaitForSingleObject
FindClose
lstrlenA
GetQueuedCompletionStatus
SetErrorMode
InitializeCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
lstrlenW
GetModuleFileNameW
GetUserDefaultLangID
WriteFile
GetCurrentProcess
FindNextFileW
GetCommandLineW
EnterCriticalSection
FindFirstVolumeW
FindFirstFileExW
GetLogicalDrives
MoveFileW
OutputDebugStringW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapAlloc
QueryPerformanceCounter
lstrcatW
HeapFree
HeapReAlloc
GetStdHandle
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetStringTypeW
WideCharToMultiByte
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
RtlUnwind
RaiseException
WriteConsoleW
user32
DefWindowProcW
GetCursorPos
CreateWindowExW
RegisterClassW
MessageBoxW
advapi32
AdjustTokenPrivileges
CryptReleaseContext
OpenThreadToken
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
ControlService
EnumDependentServicesW
QueryServiceConfigW
ChangeServiceConfigW
OpenServiceW
EnumServicesStatusW
QueryServiceStatusEx
LookupPrivilegeValueW
CreateServiceW
RegCloseKey
CryptAcquireContextW
CloseServiceHandle
RegQueryValueExA
CryptGenRandom
OpenSCManagerW
RegSetValueExW
OpenProcessToken
StartServiceW
RegOpenKeyExA
RegOpenKeyExW
GetTokenInformation
shell32
CommandLineToArgvW
ShellExecuteW
bcrypt
BCryptGenRandom
netapi32
NetShareEnum
NetApiBufferFree
shlwapi
wnsprintfA
StrCmpNIW
StrCmpNW
StrStrIW
PathFileExistsW
SHDeleteKeyW
UrlUnescapeA
UrlEscapeA
wnsprintfW
iphlpapi
GetIpNetTable
ws2_32
inet_ntoa
wininet
InternetQueryOptionW
HttpOpenRequestW
InternetOpenW
InternetCloseHandle
InternetConnectW
InternetSetOptionW
HttpSendRequestW
InternetCrackUrlW
InternetReadFile
InternetQueryDataAvailable
Name
.text
Size
267KB
Virtual Size
266KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=179, id=261, version=30795,
count=79, id=261, version=33030,
count=19, id=260, version=33030,
count=23, id=259, version=33030,
count=23, id=260, version=30795,
count=21, id=257, version=30795,
count=212, id=1, productName=Unmarked objects,
count=57, id=264, version=33134,
count=1, id=255, version=33134,
count=1, id=258, version=33134,
3e5b7ad3e91d565bb8a53fbec96c9f8dcb6d4c7664452841dc39000aefa5ad8d
- SHA256 3e5b7ad3e91d565bb8a53fbec96c9f8dcb6d4c7664452841dc39000aefa5ad8d
- MD5 7d11fa2b37409a17db02fb5864cf8a76
- SHA1 be5c5dc4daf91ea9293ddc6520db372b1e40ce3d
- SHA512 919106bcd13cda9db7d5fcfd3f0989462450a048c13776becdd99e62323a9ef11dd73de632f152a562ad1742daab7905aa2bb1269728126f62071a1b539e54cf
- SSDEEP 24576:fMUro9WB0ptkC/x4t3BsMim7N9/rS1bs:ieKkC/x41txl3
- MD5 SHA1 SHA512 SSDEEP
out.iso
- SHA256 3e5b7ad3e91d565bb8a53fbec96c9f8dcb6d4c7664452841dc39000aefa5ad8d
- MD5 7d11fa2b37409a17db02fb5864cf8a76
- SHA1 be5c5dc4daf91ea9293ddc6520db372b1e40ce3d
- SHA512 919106bcd13cda9db7d5fcfd3f0989462450a048c13776becdd99e62323a9ef11dd73de632f152a562ad1742daab7905aa2bb1269728126f62071a1b539e54cf
- SSDEEP 24576:fMUro9WB0ptkC/x4t3BsMim7N9/rS1bs:ieKkC/x41txl3
- MD5 SHA1 SHA512 SSDEEP
CFDI8320e9890-a437239bd3233-b454ac564f37713533.pdf.lnk
- SHA256 a872ac30da894cd1cd45219a7ee8a1d4db330bc9058eb309dfa5c36935277a45
- MD5 c05278c507a12b44ca7812edc32e76dd
- SHA1 65119da929e5072a8bc0c0e681279036df8080dd
- SHA512 3401ea7de60abf1b1b71d249aeb3ae1f7d6e214d9de63fcfb686641d333a4daa77024603fc0f436b498e32db1c22d5011aa25a7b9717dd82a02126cbe42fa1e6
- MD5 SHA1 SHA512
CFDI8320e9890-a437239bd3233-b454ac564f37713533/CFDI8320e9890-a437239bd3233-b454ac564f37713533.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ac39a7c3f5d2226e28323c5b77d017cc09721ec075afd8a0f697109a145c16ff
- MD5 0d8316258a4e12bfc693586f3ba18077
- SHA1 d824145c1685ae3f783780bb622590ef0daeb404
- SHA512 7f72d437d6d770f1dd39a2130dd214468a273353a24134ea3b44920eab156e449fa7f5942cab7e35649fda79b304e3a866bb5994a71d5505ba0ea1100f66752f
- SSDEEP 12288:VX8IXuJs75ZvreNjn9WWS0ptkgPhUiZDy0aDJ64X2ystaH0L5YKBVliap0H99HYa:VMUro9WB0ptkC/x4t3BsM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
598154
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
; x|
Size
478KB
Virtual Size
477KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
814B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CFDI8320e9890-a437239bd3233-b454ac564f37713533/CFDI8320e9890-a437239bd3233-b454ac564f37713533.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b60eb62f6c24d4a495a0dab95cc49624ac5099a2cc21f8bd010a410401ab8cc3
- MD5 4d7d4d92dc7d86b72abf81821ff83837
- SHA1 9672cade96c657a8860d60923afdbe4c46a2935d
- SHA512 6f00518b4b261f49c4f3f16858c728dbffc34c3768769f78c5346748d87daf488eafd0755bc8833a2fea7bf17ea6247cf41263471b2ed310e857751271cc856e
- SSDEEP 3072:Oao0QHGUQWWimj9q/NLpj/WWqvAw2XpFU4rwOeOubZS5f02RFi6x2u23dT:1oZTTWxxqVpqWVRXfVZ02biArSd
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
85:38:16:c6:79:c2:31:7a:50:f1:a5:92:3a:ff:f9:f8:18:ac:09:89:c6:b4:03:0b:8f:ce:c4:36:12:dc:56:bb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 23, 2024
PE Signature issue
Digest
09:8e:ff:57:d0:d7:dd:ca:b8:47:05:14:67:27:5f:a4:f8:8e:45:ce
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 7, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12B4-2D5F-87D4,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bc:0b:2e:1a:7b:8a:b1:c7:91:00:00:00:00:00:bc
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 12, 2018 - Jul 26, 2019
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 12, 2018 - Jul 26, 2019
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
236142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
mscoree
_CorExeMain
Name
.text
Size
223KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CFDI8320e9890-a437239bd3233-b454ac564f37713533/CFDI8320e9890-a437239bd3233-b454ac564f37713533.exe.config
- SHA256 9849eca05c7dc04e46244c34f006a23522eacf98e1b24d35fef51ce2c3545512
- MD5 e296e6181b2e5fa0dab6c08aab92373c
- SHA1 67af125b2cdd8521617ec2cac8ccc0fd2004eeb2
- SHA512 85133ca0a97a4996807ec35671f0fee669c81f74efdc4b758a27274e671ab649d666e092138c862095e0df561eac4e21a1cf04fdefc82894f621dd4905591951
- MD5 SHA1 SHA512
CFDI8320e9890-a437239bd3233-b454ac564f37713533/CFDI8320e9890-a437239bd3233-b454ac564f37713533.pdf
- SHA256 fe13179147c486924c01d74b6f5670e74d960f03759060bc5458d2cd7c90db33
- MD5 78879e6971eba70286ac930129b6d59d
- SHA1 e626fc7ae151840d9e2ad4e56ce03f24484143e1
- SHA512 1fc6f04c03832030c71c8dc4518612546f4b5406c85eaa1f35e2a4ab66af3823820e519e5d35e0792dd7f372a9aa2769888bda7b564e73d20ca8c18c8a995bcd
- SSDEEP 3072:R9oXc/W5u/trL/W/2JOKfEMH9j1Z2vTp1nJ:Ru3ytfvlfEhvTTJ
- MD5 SHA1 SHA512 SSDEEP
Extracted URLs
-
file http://rosys.com.mx
898d57eaf64673a18e958c983036392540b02f3b903d979d60090a767062f859
- SHA256 898d57eaf64673a18e958c983036392540b02f3b903d979d60090a767062f859
- MD5 2a2172df605350316d0455be25542d5a
- SHA1 c2cbf54860405e2ab94c6390d489da2c499901ff
- SHA512 67ac817a9ebcc994bb28f1bb91af6c7d19be565766901212c38018c30a37035375ff6fa6cb0ce433797d26801fffe46b4d923b9bb6f7bb7c90c6478f1bb8aa17
- SSDEEP 49152:H4D1jZohM9y0nWofVWqEl3ab0T2io826OkxBK6DBWWAlt:YiM5sK//Qxrol
- MD5 SHA1 SHA512 SSDEEP
out.iso
- SHA256 898d57eaf64673a18e958c983036392540b02f3b903d979d60090a767062f859
- MD5 2a2172df605350316d0455be25542d5a
- SHA1 c2cbf54860405e2ab94c6390d489da2c499901ff
- SHA512 67ac817a9ebcc994bb28f1bb91af6c7d19be565766901212c38018c30a37035375ff6fa6cb0ce433797d26801fffe46b4d923b9bb6f7bb7c90c6478f1bb8aa17
- SSDEEP 49152:H4D1jZohM9y0nWofVWqEl3ab0T2io826OkxBK6DBWWAlt:YiM5sK//Qxrol
- MD5 SHA1 SHA512 SSDEEP
Vesak.lnk
- SHA256 897906d5020f06d4f5d947099fb9c7b1656df14b1d99bd7b212ca6fa5441f0d7
- MD5 264e738082f0a609b49f56761fea4aad
- SHA1 49d974b5a63ee6e0a9e616d49888376c9d4c7c05
- SHA512 3f08bc57bf6edfe6535c26d9004be9966e0b13f2fcb0273a5179be6b14c2a5268522fb5b9aa368ac58d69a4376517c6c0f3538bf73cf05b16827c6b1096068bd
- MD5 SHA1 SHA512
Vesak.pdf
- SHA256 44984ed753f684b192ec67c79883c1f1ed87162642c3f0a7198393fd8768dc48
- MD5 8e8a5a68763d30c3fa6221d75ee5da48
- SHA1 dfd19dd7d17eaf196f8fdbecaeae814eac9d45c8
- SHA512 89b639392f3f7672ce724bb71274a212fc178baf7a2121bfc367f3d958c760e31c70197805d0c6f4e7b2217ba21d4203a08d62fa85255d3a3b563a9c9994b3ba
- SSDEEP 49152:89y0nWofVWqEl3ab0T2io826OkxBK6DBWWAltd:85sK//Qxroln
- MD5 SHA1 SHA512 SSDEEP
java-rmi.exe
- IMPHASH f53274be29838ade881227180f507b96
- SHA256 1d785b779c23fd3aab57d7e8c5a413a95bcd54d305093fe03fa402c0eb30ec34
- MD5 522f3bb8af891052b722754493184a79
- SHA1 b146e026a2074a6c855e4504eb4b7a9097ef39a4
- SHA512 e7ecca1bc26bde08bd3af8f086b540c6a428d9eddd77933fdb8857dcf4afccaf3cecc68283677e8ab4b9ea2d9447a3eca422ecd9e181e875c00dce724bbd7f9e
- SSDEEP 384:AtdGI14rKF56Cef4IYi1oi+FAM+o/8E9VF0Ny84UL:Iz1VF4vfhYi2FAMxkEML
- MD5 SHA1 SHA512 SSDEEP
Digest
11:7b:e5:fc:f8:a4:b4:c9:df:9a:6f:38:58:f8:a2:ab:4d:85:41:06:02:da:9c:67:4e:bb:cb:54:08:80:84:fa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US
Chains
Oct 4, 2023
CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US
Serial Number
06:0e:2f:8f:9e:1b:8b:e5:18:d5:fe:2b:69:cf:cc:b1
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 9, 2023 - Mar 11, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
5156
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\jenkins\workspace\8-2-build-windows-x64-cygwin-sans-NAS\jdk8u391\514\build\windows-x64\jdk\objs\java-rmi_objs\java-rmi.pdb
jli
JLI_GetStdArgc
JLI_CmdToArgs
JLI_Launch
JLI_MemAlloc
JLI_GetStdArgs
kernel32
RtlCaptureContext
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlVirtualUnwind
RtlLookupFunctionEntry
GetModuleHandleW
vcruntime140
memset
__current_exception_context
__C_specific_handler
__current_exception
memcpy
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
__p___argv
_crt_atexit
_seh_filter_exe
_set_app_type
__p___argc
terminate
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_configure_narrow_argv
_register_onexit_function
_initialize_onexit_table
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=2, id=257, version=27412,
count=18, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=9, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=2, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=3, id=257, version=31104,
count=55, id=1, productName=Unmarked objects,
count=1, id=260, version=31104,
count=1, id=255, version=31104,
count=1, id=258, version=31104,
jli.dll
- IMPHASH ac376a74d92692595d3c32fde7150034
- SHA256 cdefa0246891b8d3ff74c04dbecf0fe35de88fa3765b700944c08214b7e55594
- MD5 7b8f61b56b71b0b102f9fd462768d86a
- SHA1 539f146742afd8b453b1c4664d2fded49da40eb7
- SHA512 6100896b8ddf5c0fab434d58ecb716a670ff404c8b13ab5ba524077a13b743fc03b54e61cd41c67d8c364a4a529d21af1665bb669c0ba2e2cf02e10b4f004b18
- SSDEEP 24576:Xob5PEVN8xKXVArHojd/iVkM9LQuNwnS1Pb5QeoTs+Wf:X4D1jZoh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
30228
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetConsoleWindow
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
WideCharToMultiByte
WriteConsoleW
WriteFile
user32
ShowWindow
JLI_CmdToArgs
JLI_GetStdArgc
JLI_GetStdArgs
JLI_Launch
JLI_MemAlloc
Name
.text
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
863KB
Virtual Size
867KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
140B
Characteristics
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
218KB
Virtual Size
218KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
8e62ab99c72f89f7d2b4a1e40ef1a9ee729f2ab171ce675b643e77c36e477f0e
- SHA256 8e62ab99c72f89f7d2b4a1e40ef1a9ee729f2ab171ce675b643e77c36e477f0e
- MD5 7c13d6d9d1900f87e77244f9796bc0f0
- SHA1 d3300b441fabfaa3d41afae800395684e3e42b37
- SHA512 8f2355fdf61b4b607993ca0001912eaa79a6671327f25c5e9841057656e27cfaab6111ff0d242a9de3e32f6cf459aea91286356f1d3465bfc79a462960ada9ba
- SSDEEP 12288:vMRO7t/G5gdBNO9E5nTtiywe3YB95KUmjlpNpvPVSQS2AHEsQUxbU/pG3m8vCAMg:UQV/Bs+Bg23MMUmjlpbA0m7N9/rSrbs
- MD5 SHA1 SHA512 SSDEEP
90765a1bd6fa8712ea1414b737c4fed172f129993203e3504b4c55db27dc0aac
- SHA256 90765a1bd6fa8712ea1414b737c4fed172f129993203e3504b4c55db27dc0aac
- MD5 15a4f11c61316a71b076a3f1343126d6
- SHA1 3fc9e04c3f0c1605c90a3ad530ab008a51322baa
- SHA512 ff51829ffdb12de16d7959cc49355b1307f62342174e7c8e7b68402d8b615b3639eebd19d02c50201aba248bf1c706190433df5a512147c465494beee948997f
- SSDEEP 24576:OTk6TQsWljJPVVwTxvfNuGxb6neqHSEEO:upTJaS4
- MD5 SHA1 SHA512 SSDEEP
b86667e9bfbaf6580110d41c52ff14aa6286932d2002bdfb2662a7ae3e247e88
- SHA256 b86667e9bfbaf6580110d41c52ff14aa6286932d2002bdfb2662a7ae3e247e88
- MD5 663bdf3df5a5b1229a5ae463f4992d0c
- SHA1 84e4c9c4f70b23525b793d025e4fe41435952dc4
- SHA512 2bdea8b2d7da1624de19d31b465ce5c13325481961a0e796af6f9e31511efe188b0fab8d719003cbe0b7f342fa2fd75844d985b76f47f52191c1a3a6f1e022d8
- SSDEEP 24576:2Tk6TQsWljJPVVwTxvfNuGxb6neqHSEE:2pTJaS
- MD5 SHA1 SHA512 SSDEEP
bb7e53eed72e41a99c2245e2f108c982f0bad939b707d917ba19db74682102d6
- SHA256 bb7e53eed72e41a99c2245e2f108c982f0bad939b707d917ba19db74682102d6
- MD5 4deca1976f1eee12d0e3b0de6f9af4a8
- SHA1 6d25543096cc6624600a6792e30b771922330761
- SHA512 b75168c7eb0d12a739b5ae38e221b5434a41e9146c5e1863f4102d6dfc6e3ec3c37843ed98cf2b0c73b4d0e8828bcc2d88c4f1e4b89121312ff4cc26f61f1b11
- SSDEEP 24576:xQ2CpY/vAlSwfSOJEo/q5bC2m7N9/rSfbs:KgmfRE4PxlN
- MD5 SHA1 SHA512 SSDEEP
d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08
- SHA256 d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08
- MD5 d201bd19e60d500963aff0c235b07727
- SHA1 341552a8650d2bdad5f3ec12e333e3153172ee66
- SHA512 4afa7da1bf2a86dc9a3b94b674ecffea638304c42c43c955631bbe29c605be673b7182ed1fcb8997c55c6bbd2a48e5ec46177e8327e9e903781d1ffb2abd991c
- SSDEEP 6144:h0wmbI4/Z4SHvrxw6zaIST1w9wEPDasWxxsBhS37b8o6XCFyPwCMa6qnXxq/y:Gzv66zaISTW9asWxxAh4IlXC4PUqBq/
- MD5 SHA1 SHA512 SSDEEP