AROTutorial.zip
- SHA256 1f733a59d0984b6eeeafc88b72d148840cbc52fedb0c73655bfa329a6fe97101
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AROTutorial/AROTutorial.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
AROTutorial/aross.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
300 seconds
General
- Target AROTutorial.zip
- Size 159KB
- Sample240610-hy44kaec89
- SHA256 1f733a59d0984b6eeeafc88b72d148840cbc52fedb0c73655bfa329a6fe97101
- MD5 45507aad1fcd356a0265a2bc969ecafb
- SHA1 2aa181faced92e50e9b0c1967306b70bdaf5464a
- SHA512 e2455d8a2756f2368e6cff77735ebef27206e58b484ba145f4b2c3801a21182f70da76d8a53f99a27a2461a5f210ccaaabbeb21891c72804b6f556fc2d2c97c6
- SSDEEP 3072:ctVFw63b69ul9qsP5kBqgP2SgbR+0XetuqhJ8RNC0gQeBdl:Mc6G07bP5kg02bbuuqhsY9Jdl
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AROTutorial/aross.dll
File Explorer
-
AROTutorial.zip.zip 159KB
-
AROTutorial/AROTutorial.exe.exe 69KB
-
AROTutorial/aross.dat122KB
-
AROTutorial/aross.dll.dll 20KB
-
AROTutorial/std.cfg5KB
AROTutorial/AROTutorial.exe
- IMPHASH 5b7477f8c6bf8d17f125a9424fe4bf92
- SHA256 18a98c2d905a1da1d9d855e86866921e543f4bf8621faea05eb14d8e5b23b60c
- MD5 64ff0a8730472e36e62ce29a20f61529
- SHA1 6e8165999acf896e27db0da266a96189efd335e8
- SHA512 46375849a493445f3ac1e757321a02d19822d79e866fac6ab19a99c01f0ec38e70b5c8eb6bf32ddef8d86f046b22a036ded4929a6a0b5b123261d9828b675c6d
- SSDEEP 1536:D/hbA6KVv6j79bI4tlWGUOoIJJevnqvCbl:9b/k4tlLUOoIJJ8qMl
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US
Serial Number
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 1, 2012 - Dec 31, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Support.com\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Support.com\, Inc.,L=Redwood City,ST=California,C=US
Serial Number
63:12:88:bf:c2:c3:e6:7b:77:91:ee:5a:55:cb:24:6f
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 2, 2010 - Jul 12, 2013
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Minor OS version
0
Major OS version
4
Entry point
5335
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
GetProcAddress
LocalAlloc
FreeLibrary
InterlockedExchange
GetLastError
RaiseException
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
Name
.text
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=125, productName=VS2005 build 50727, version=50727,
count=75, id=109, productName=VS2005 build 50727, version=50727,
count=28, id=110, productName=VS2005 build 50727, version=50727,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=82, id=1, productName=Unmarked objects,
count=2, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
AROTutorial/aross.dat
- SHA256 d8e69e479dbf5e478306e9b1593678b30ff9f454ae094ba4f377101390b0c06e
- MD5 4adc19f40f1fd3ec6149c1a1ac895445
- SHA1 4d47cdecd1d634b5b27d9a5447c7c911ed37d2dd
- SHA512 28230876ccafe2f40125a7f15ac18da68a060d9a81202706a0afc02303434cde8c6262ffed2f05687859cace855ffa8340a132346fdd478ac8292db6b949cdc8
- SSDEEP 3072:/7ZqeNCvaAgtSDVpsP5kBqgP2WgbR+0XeRkV4ZewDwwPT:zZqTafOYP5kg02fb74ZeET
- MD5 SHA1 SHA512 SSDEEP
AROTutorial/aross.dll
- IMPHASH 240286f8e07046af4b0420b5a6fdc9dc
- SHA256 22f591d6df14cc97acd2922cb4f63479e080a3760e750ee34ffd1890e29745a4
- MD5 69b34eeaa93884d81b1445a272cd27df
- SHA1 a10312b366b76d39d45d571ed37e6768ab1429df
- SHA512 20872067ed4617a1b5ccb27202b783df8edbee210cd699efb092003ab24eabe4a4cd81149064ffcc231bb16745908a93721fb299b4dc76643d674681d1348a47
- SSDEEP 48:SpWIVblx09ORiHrazTSyVaYncTd8cVjYG4gh/CDtx+r2rOZAe6N7pqRq:2svHrYTfE4cScChxuZ+7z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5873
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_adjust_fdiv
malloc
_initterm
free
strncmp
kernel32
GetProcAddress
ExpandEnvironmentStringsA
CreateFileA
WriteFile
ReadFile
DeleteFileA
GetModuleHandleA
GetModuleHandleW
CloseHandle
GetFileSize
lstrcatA
user32
GetFocus
CxiVxQ958
Name
.text
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
600B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
208B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=19, version=8034,
count=4, id=10, version=8047,
count=3, id=4, version=8047,
count=19, id=1, productName=Unmarked objects,
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
AROTutorial/std.cfg
- SHA256 695555b7b6e36586546ebc9fc7efbb365a696f3c02c7dd8296a9f72b20f7706c
- MD5 734573433ff2bd5eaaf7bf033c8abc49
- SHA1 f5644501e063646398decb5c5df6130591d29a32
- SHA512 4daaeee09a33b450bf61b7681e0a34091ba788285308dd816118e51ed4d6c6282af0dfc62aedc9593276386cde24ca0dba2a89d2e164b645a8a25e44e0192ad4
- SSDEEP 96:ugbXD33wR7HjPYXcR2IiTFMVgJ6WCjnBKK5L98oqKWHdTHaCXmwCNNvfTf:ugbz338DPkIW6VyMBn8jKW96CXmwmNvz
- MD5 SHA1 SHA512 SSDEEP