17585088207[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

17585088207.zip
Size

3.3MB
MD5

29fa9364552f0a9339d572ecb3d082a9
SHA1

81486128cd12a40baecba7a81424d0824fbd0e11
SHA256

4bcbf70efe80c1a6218f3c0c971d1f45f26a3b4c5ef73086d1e1af93ba97db2c
SHA512

f0764818c08cc5c1704289cf86500272eb351c17b1f24f4a6987086f2b044099b8df7b0580bd585a9e1a7d6c62f87785d678817ca0b4e11a463b0ffbc814ca40
SSDEEP

98304:WhlD0k8VMwh4l7Y8h7NRxAMPqXs46XBXn:WhlD0VVMwh4lc8hJRxhPXn

Score

1^/10

Malware Config

Signatures

Files

17585088207.zip
.zip

Password: infected
2a713e03dd91846160f4bf2d0e3a5640056e16bcfe6983f4e008ed9ca809c7de
.exe windows:4 windows x86 arch:x86

6d57410eac221411f82d9566eaa38760

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:66:97:96:88:4e:c1:bd:63:c4:cf:e3
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

15/09/2023, 15:37

Not After

30/10/2024, 09:21

Subject

SERIALNUMBER=J40/5585/2003,CN=INNOVATIVE SOLUTIONS GRUP SRL,O=INNOVATIVE SOLUTIONS GRUP SRL,STREET=Str. Prinosului Nr 2 Bloc 2 Apartament 3 \, Sectorul 4,L=Bucharest,ST=Municipality of Bucharest,C=RO,1.2.840.113549.1.9.1=#0c2364616e69656c2e73746174657363752e6e6567756c6573637540676d61696c2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#1302524f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9b:55:d7:55:64:41:95:02:2d:02:8a:ed:3b:40:bc:96:37:7a:ed:37:77:90:cc:fa:c4:ef:28:1f:2e:48:5e:31
Signer

Actual PE Digest

9b:55:d7:55:64:41:95:02:2d:02:8a:ed:3b:40:bc:96:37:7a:ed:37:77:90:cc:fa:c4:ef:28:1f:2e:48:5e:31

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord470
ord2854
ord3871
ord3312
ord4078
ord2706
ord2567
ord6051
ord4073
ord1768
ord4390
ord5237
ord2377
ord5157
ord6370
ord4347
ord3793
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord5273
ord4621
ord3569
ord2070
ord4294
ord2371
ord4401
ord384
ord3867
ord4118
ord755
ord6168
ord2372
ord6865
ord3792
ord3084
ord6195
ord5977
ord2644
ord1662
ord6597
ord6920
ord4273
ord2776
ord6655
ord924
ord859
ord3982
ord711
ord413
ord4229
ord5261
ord4370
ord4847
ord4992
ord6048
ord1767
ord5276
ord4419
ord3592
ord809
ord2114
ord5706
ord3284
ord4158
ord6617
ord807
ord554
ord556
ord325
ord4704
ord2914
ord1826
ord5061
ord4629
ord4601
ord4710
ord4744
ord4602
ord5010
ord4369
ord4846
ord2507
ord4828
ord355
ord4224
ord6399
ord3447
ord3517
ord5286
ord3397
ord3706
ord783
ord567
ord4270
ord2104
ord933
ord939
ord935
ord937
ord920
ord3049
ord836
ord5210
ord6664
ord834
ord5929
ord3875
ord3420
ord3050
ord832
ord3051
ord929
ord919
ord5852
ord3629
ord1635
ord2445
ord2400
ord536
ord397
ord699
ord1834
ord1789
ord1899
ord1829
ord1792
ord1831
ord1890
ord1897
ord3087
ord5155
ord5156
ord5154
ord4899
ord4736
ord4970
ord4942
ord4352
ord4371
ord4848
ord5283
ord4829
ord768
ord489
ord4253
ord6451
ord818
ord4472
ord324
ord1808
ord1761
ord6871
ord5624
ord1644
ord2455
ord909
ord1173
ord4180
ord394
ord696
ord3638
ord1243
ord5268
ord2362
ord5267
ord2350
ord319
ord2293
ord2351
ord2331
ord2290
ord2332
ord2291
ord2294
ord1930
ord6193
ord4282
ord2072
ord3133
ord3798
ord5858
ord6140
ord2634
ord6211
ord4279
ord3491
ord2144
ord2081
ord609
ord2423
ord1088
ord816
ord562
ord6166
ord1821
ord3605
ord656
ord5506
ord1640
ord429
ord3443
ord1657
ord5228
ord5264
ord5571
ord2133
ord434
ord433
ord432
ord2385
ord464
ord1932
ord4265
ord6375
ord3016
ord4109
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6017
ord5869
ord5790
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord3591
ord6190
ord6607
ord3222
ord3403
ord3753
ord3737
ord6124
ord3747
ord5142
ord3380
ord2078
ord4042
ord6330
ord6489
ord1137
ord5462
ord1863
ord4155
ord4028
ord3579
ord543
ord803
ord6303
ord521
ord2715
ord2382
ord3054
ord5094
ord5097
ord4461
ord4298
ord3345
ord5006
ord975
ord5468
ord3398
ord2874
ord2873
ord4146
ord4072
ord5233
ord2641
ord1658
ord4421
ord3618
ord674
ord366
ord4237
ord4430
ord4451
ord4493
ord2111
ord2109
ord2004
ord6878
ord5278
ord3865
ord6376
ord6191
ord4589
ord2858
ord6266
ord6374
ord1186
ord3805
ord2857
ord5024
ord4718
ord4901
ord4803
ord5048
ord795
ord4532
ord4768
ord4975
ord4331
ord4577
ord5248
ord5047
ord6456
ord6594
ord6584
ord5284
ord4433
ord2046
ord4425
ord6525
ord6485
ord6564
ord4254
ord4709
ord2638
ord6593
ord6481
ord3393
ord3728
ord810
ord4668
ord6004
ord3995
ord3298
ord3282
ord4120
ord2637
ord2403
ord2015
ord4213
ord2570
ord4392
ord6732
ord6498
ord6776
ord2574
ord4396
ord3365
ord3635
ord6898
ord3993
ord3991
ord5949
ord5815
ord3642
ord837
ord930
ord838
ord6777
ord1105
ord3577
ord2631
ord5945
ord4470
ord6130
ord4524
ord4538
ord5681
ord3269
ord3348
ord3574
ord439
ord736
ord5491
ord1840
ord1933
ord5867
ord3296
ord3281
ord3905
ord6896
ord6631
ord2577
ord6150
ord2522
ord4359
ord4051
ord5467
ord4116
ord2381
ord5079
ord1702
ord1707
ord4398
ord5230
ord6365
ord5254
ord2436
ord3289
ord3479
ord6065
ord2003
ord3290
ord4360
ord1703
ord1708
ord5275
ord5058
ord5244
ord3725
ord6237
ord6316
ord3714
ord793
ord6910
ord6758
ord2053
ord1196
ord3909
ord1612
ord3694
ord5599
ord3221
ord6003
ord1941
ord6437
ord6238
ord2092
ord2085
ord3288
ord6882
ord6754
ord4400
ord3724
ord5812
ord3603
ord4638
ord1764
ord6362
ord2405
ord2016
ord4212
ord3572
ord2932
ord5886
ord3092
ord3716
ord4219
ord2809
ord326
ord2115
ord3292
ord3291
ord3356
ord2359
ord4677
ord2680
ord6771
ord2108
ord1794
ord1615
ord4447
ord5259
ord3703
ord3870
ord6466
ord6880
ord6668
ord941
ord942
ord1143
ord1637
ord2430
ord3649
ord2576
ord4215
ord4199
ord2756
ord2717
ord686
ord693
ord4197
ord6868
ord641
ord3494
ord925
ord2506
ord6113
ord2520
ord2810
ord3434

msvcrt

wcschr
isdigit
_wsplitpath
_wmakepath
towupper
wcsncpy
iswdigit
_wcsnicmp
wcsncmp
wcslen
rand
srand
time
wcstod
_strdup
setlocale
towlower
qsort
_purecall
wcsstr
toupper
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
swscanf
_initterm
_wtol
_wcsicoll
wcstoul
wcstol
swprintf
ceil
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
isalpha
localtime
_mbschr
fgets
fgetws
_CxxThrowException
_wcsicmp
memset
memcpy
_ftol
free
__CxxFrameHandler
_wtoi
_CIpow
memmove
wcsspn
isspace
floor
malloc
_controlfp
__setusermatherr
_wcsdup
wcscmp

kernel32

ResumeThread
GetCurrentProcessId
lstrcatW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetLastError
GlobalSize
GetUserDefaultLangID
GetPrivateProfileStringW
InterlockedIncrement
GetTimeFormatW
LocalAlloc
GetDriveTypeW
InterlockedDecrement
SetEndOfFile
GetFileSize
GetDateFormatW
SystemTimeToFileTime
LocalFileTimeToFileTime
lstrcmpiW
GetCurrentThreadId
lstrcpynW
GetVersion
FreeLibrary
GetNumberFormatW
GetCurrencyFormatW
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoW
GetComputerNameW
GlobalAlloc
GlobalFree
FormatMessageW
LocalFree
GetCurrentThread
GetVersionExW
GlobalLock
GlobalUnlock
GetSystemDirectoryW
GetWindowsDirectoryW
lstrcmpW
GetCurrentProcess
GetModuleFileNameW
CreateProcessW
ExpandEnvironmentStringsW
GetTempFileNameW
GetTempPathW
MoveFileW
GetTickCount
CopyFileW
CreateDirectoryW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFileAttributesW
WaitForSingleObject
FindFirstFileW
FindNextFileW
FindClose
GetLongPathNameW
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileW
SetFileTime
DeleteFileW
MoveFileExW
GetProcessHeap
HeapAlloc
HeapFree
GetACP
MulDiv
RemoveDirectoryW
OpenProcess
SetFileAttributesW
Sleep
lstrlenW
LoadLibraryW
CloseHandle
CreateMutexW
GetLastError
lstrcpyW
GetModuleHandleW
GetProcAddress
lstrlenA
VirtualQuery
InterlockedCompareExchange
VirtualProtect
FlushInstructionCache
SetThreadContext
GetThreadContext
VirtualFree
SuspendThread
DebugBreak
VirtualAlloc
SetThreadPriority
WinExec
InterlockedExchange
GetStartupInfoW

user32

MessageBoxW
AppendMenuW
IsMenu
GetMenuItemInfoW
SetMenuItemInfoW
GetSubMenu
DeleteMenu
GetMenuState
ModifyMenuW
GetMenuStringW
SetMenuInfo
GetMenuItemCount
GetMenuItemID
InsertMenuW
PostMessageW
GetKeyState
MapVirtualKeyW
GetKeyNameTextW
GetKeyboardLayout
OpenInputDesktop
CloseDesktop
GetLastInputInfo
PeekMessageW
ScreenToClient
IsDialogMessageW
TranslateMessage
EnumClipboardFormats
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
PtInRect
FillRect
EnableWindow
GetFocus
GetDlgItem
InvalidateRect
IsWindowEnabled
GetSysColorBrush
CallWindowProcW
DefWindowProcW
DrawTextW
GetWindowThreadProcessId
RegisterClipboardFormatW
LoadBitmapW
DrawIconEx
GetIconInfo
GetWindowLongW
GetMonitorInfoW
MonitorFromWindow
MonitorFromRect
MonitorFromPoint
ShowScrollBar
WindowFromDC
GetClientRect
IsRectEmpty
DrawTextA
GetTabbedTextExtentW
SetCursor
LoadCursorW
LoadImageW
GetDC
ReleaseDC
CopyRect
InflateRect
DestroyIcon
LoadMenuW
GetSysColor
GetForegroundWindow
GetParent
IsWindow
SendMessageW
SetForegroundWindow
GetDesktopWindow
RegisterWindowMessageW
OffsetRect
IntersectRect
SystemParametersInfoW
IsIconic
GetWindowRect
GetSystemMetrics
ClientToScreen
GetWindowTextW
wvsprintfW
GetWindow
EqualRect
IsChild
GetNextDlgTabItem
ChildWindowFromPoint
WindowFromPoint
CopyIcon
SetRect
MapDialogRect
RedrawWindow
SetCapture
ReleaseCapture
GetMessagePos
TrackPopupMenuEx
DrawEdge
IsClipboardFormatAvailable
GetClipboardFormatNameW
wsprintfW
KillTimer
GetDlgCtrlID
GetLastActivePopup
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowLongW
GetClassNameW
CallNextHookEx
DrawFrameControl
IsWindowVisible
SetRectEmpty
UpdateWindow
SetTimer
TabbedTextOutW
GrayStringW
GetScrollPos
SetParent
BeginDeferWindowPos
EndDeferWindowPos
SetWindowPos
DeferWindowPos
GetScrollInfo
GetCapture
IsZoomed
CheckMenuRadioItem
TrackPopupMenu
SetMenuDefaultItem
SetMenu
RegisterHotKey
UnregisterHotKey
LockWindowUpdate
SetActiveWindow
SetFocus
RegisterClassW
LoadIconW
GetClassInfoW
IsCharAlphaNumericW
GetDoubleClickTime
TrackMouseEvent
GetWindowDC
DrawFocusRect
GetActiveWindow
CreateWindowExW
GetCaretPos
ScrollWindowEx
SetScrollPos
SubtractRect
GetScrollRange
EndPaint
BeginPaint
ShowCaret
FindWindowW
FindWindowExW
DrawAnimatedRects
DestroyCursor
GetCursor
PostThreadMessageW
EnumWindows
SendMessageTimeoutW
RemoveMenu
CheckMenuItem
EnableMenuItem
MessageBeep
DestroyWindow
SetWindowTextW
DragDetect
MoveWindow
ShowWindow
GetCursorPos
CreatePopupMenu
UnionRect
DispatchMessageW

gdi32

GetTextColor
Polygon
GetDIBColorTable
Escape
TextOutW
RectVisible
PtVisible
SetDIBits
ExtTextOutW
BitBlt
SetTextColor
SetBkColor
SetBkMode
SelectObject
DeleteDC
GetDIBits
SaveDC
RestoreDC
DeleteObject
CreateFontIndirectW
GetObjectW
SetPixelV
Rectangle
Polyline
GetWindowOrgEx
LineTo
MoveToEx
GetCurrentObject
SetTextJustification
EnumFontsW
CopyMetaFileW
CreatePalette
RealizePalette
GetStockObject
GetDeviceCaps
GetTextExtentPoint32W
GetTextMetricsW
RoundRect
CreateSolidBrush
CreatePen
GetBkColor
CreateCompatibleBitmap
CreateDIBSection
CreateCompatibleDC

advapi32

RegDeleteKeyW
OpenProcessToken
GetUserNameW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
RegQueryValueW
RegQueryValueExW
RegEnumValueW
RegEnumKeyW
GetTokenInformation

shell32

SHAppBarMessage
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
StrStrW
SHGetFileInfoW
ExtractIconExW
SHChangeNotify
SHGetSpecialFolderPathW
ShellExecuteW
DragQueryFileW
Shell_NotifyIconW
DragFinish

comctl32

ImageList_GetImageCount
ImageList_Remove
ImageList_Draw
ImageList_AddMasked
ImageList_GetIconSize
ImageList_GetIcon
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_Destroy
ImageList_Create
ImageList_DragEnter
ImageList_DragLeave
ImageList_BeginDrag
ImageList_DragMove
ImageList_DragShowNolock
ImageList_EndDrag
ImageList_ReplaceIcon

ole32

StgCreateDocfile
CoCreateInstance
OleCreateFromFile
OleCreateLinkToFile
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleSetContainedObject
OleRun
CoInitialize
CoUninitialize

olepro32

ord252

oleaut32

GetErrorInfo
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysAllocString
OleLoadPicturePath
VariantClear

urlmon

URLDownloadToFileW

shlwapi

PathCanonicalizeW
PathRelativePathToW
PathIsURLW
UrlCreateFromPathW
PathCreateFromUrlW
StrCmpW
PathIsRelativeW

msimg32

GradientFill

rpcrt4

UuidFromStringW

wininet

DeleteUrlCacheEntry
InternetQueryOptionW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

PlaySoundW

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 444KB - Virtual size: 442KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 345KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourd
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

6d57410eac221411f82d9566eaa38760

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

0e:66:97:96:88:4e:c1:bd:63:c4:cf:e3Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

9b:55:d7:55:64:41:95:02:2d:02:8a:ed:3b:40:bc:96:37:7a:ed:37:77:90:cc:fa:c4:ef:28:1f:2e:48:5e:31Signer

Headers

File Characteristics

Imports

mfc42u

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

olepro32

oleaut32

urlmon

shlwapi

msimg32

rpcrt4

wininet

version

winmm

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 444KB - Virtual size: 442KB

.data Size: 172KB - Virtual size: 345KB

.detourc Size: 8KB - Virtual size: 4KB

.detourd Size: 4KB - Virtual size: 12B

.rsrc Size: 1.9MB - Virtual size: 1.9MB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

0e:66:97:96:88:4e:c1:bd:63:c4:cf:e3
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

9b:55:d7:55:64:41:95:02:2d:02:8a:ed:3b:40:bc:96:37:7a:ed:37:77:90:cc:fa:c4:ef:28:1f:2e:48:5e:31
Signer

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 444KB - Virtual size: 442KB

.data
Size: 172KB - Virtual size: 345KB

.detourc
Size: 8KB - Virtual size: 4KB

.detourd
Size: 4KB - Virtual size: 12B

.rsrc
Size: 1.9MB - Virtual size: 1.9MB