rdamy (1).zip
- SHA256 c864ab5ef50b025944037f9ee0feec332ca62a734f7650e6c411617d1b7dc174
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
g2m.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
60 seconds
Behavioral task
behavioral2
Sample
g2m.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
60 seconds
Behavioral task
behavioral3
Sample
install.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
60 seconds
Behavioral task
behavioral4
Sample
install.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
60 seconds
Behavioral task
behavioral5
Sample
run.bat
Resource
win7-20240221-en
windows7-x64
2 signatures
60 seconds
Behavioral task
behavioral6
Sample
run.bat
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
60 seconds
General
- Target rdamy (1).zip
- Size 577KB
- Sample240610-wpd3nsvhrj
- SHA256 c864ab5ef50b025944037f9ee0feec332ca62a734f7650e6c411617d1b7dc174
- MD5 77a7361c39bc68feff4eec8c0be71226
- SHA1 f3e6d9bb49c646dcfbaf8a97e056da0c06ec9ec5
- SHA512 e86011b3d57096563b5c841fcf2086334bb8aac89042f388b385b1f24c1832de5f18e074b1983e3e3cf7ec39c72e29b7796d448e19ff9eae82455be078b5bc76
- SSDEEP 12288:+REEFAAyYO4y4P+6cGTpmO1uWaBO0GF9CqM:OEEtO4y4m6NFduW0OD6
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/g2m.dll
File Explorer
-
rdamy (1).zip.zip 577KB
-
data.bin385KB
-
g2m.dll.dll 400KB
-
install.exe.exe 39KB
-
run.bat73B
data.bin
- SHA256 2d83fb3f93c339ad34771c212586545dc3c7deb518ffde76411326fabf9725cf
- MD5 94d7d9d8ff2e1f29e1ab7a906bbbf9c3
- SHA1 4fd3485f3ce162f3b35a87ef7e7fcfd510546ee0
- SHA512 4ce02b4e56410f7ce069223187b2dffb7930d855dafa377df60c9b669f27002dd431f65bbc203130e5d88e2f060247e8b226ceae2b6f39082a58eb5c538ace0a
- SSDEEP 6144:xYRfxtyDDTO5qwPAAy+/g+OPGUCl085ceyrXIP7KwqGfcaqersiMsj:eRyEFAAyMA4C4P+6US7Msj
- MD5 SHA1 SHA512 SSDEEP
g2m.dll
- IMPHASH 09fce2c0958259beb65890ef260df81f
- SHA256 d1b14d951ccaafc14ab24992678b2fee915838bbc89a32944833268cbba10f68
- MD5 9e0c959df25e74c80dfa5adba4eaa5c7
- SHA1 9c5a3ed851e32617b1b294bb2c749a60988439d1
- SHA512 36520d6e61833ce446b4e9f01c065bc08f47e91a3125305c5d0fe27f01f2cc19be59c9b4eacc6f0b8fc74536b718decccc7aa1aac8e9de5e685d1893e10a786a
- SSDEEP 6144:Nt262Yh8H++Xz5YRa5bfpLECjVllx76r2xaP23O/d120:HIF+8Rx4CJTx76r2xaYOO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
168114
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
your_package_name.pdb
kernel32
GetNativeSystemInfo
VirtualQuery
VirtualFree
VirtualProtect
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
HeapSize
GetStringTypeW
GetProcAddress
GetLastError
GetModuleHandleA
SetThreadStackGuarantee
SetStdHandle
GetConsoleOutputCP
WriteFile
GetCommandLineA
GetCPInfo
TlsGetValue
TlsSetValue
QueryPerformanceCounter
FlushFileBuffers
SetFileInformationByHandle
GetCurrentProcess
SetFilePointerEx
GetCurrentProcessId
ReadFile
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
SetLastError
SetHandleInformation
LCMapStringW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
CloseHandle
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
lstrlenW
CreateMutexA
VirtualAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateThread
GetCurrentThread
WaitForSingleObject
CreateWaitableTimerExW
SetWaitableTimer
Sleep
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetEnvironmentVariableW
GetCurrentDirectoryW
DeleteCriticalSection
GetFullPathNameW
GetModuleFileNameW
TerminateProcess
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
FormatMessageW
ExitProcess
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
EncodePointer
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
RtlCaptureContext
GetCommandLineW
GetFileType
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
RaiseException
RtlUnwind
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
DecodePointer
ws2_32
listen
bind
freeaddrinfo
WSASocketW
WSAGetLastError
closesocket
getaddrinfo
WSACleanup
WSAStartup
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
ntdll
NtReadFile
RtlNtStatusToDosError
NtWriteFile
DllMain
g2mchat_winmain
g2mcomm_winmain
g2mfeedback_winmain
g2mhost_winmain
g2minstaller_winmain
g2minsthigh_winmain
g2mlauncher_winmain
g2mmatchmaking_winmain
g2mmaterials_winmain
g2mpolling_winmain
g2mqanda_winmain
g2mrecorder_winmain
g2msessioncontrol_winmain
g2mstart_winmain
g2mtesting_winmain
g2mtranscoder_winmain
g2mui_winmain
g2muninstall_winmain
g2mvideoconference_winmain
g2mview_winmain
Name
.text
Size
222KB
Virtual Size
221KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
80KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=139, id=261, version=30795,
count=20, id=260, version=30795,
count=31, id=261, version=33218,
count=16, id=260, version=33218,
count=20, id=259, version=33218,
count=185, id=1, productName=Unmarked objects,
count=3, id=260, version=33523,
count=75, productName=Unmarked objects (old),
count=1, id=256, version=33523,
count=1, id=258, version=33523,
install.exe
- IMPHASH 6eb9cccf95968b8becec4c870f1101db
- SHA256 796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5
- MD5 f1b14f71252de9ac763dbfbfbfc8c2dc
- SHA1 dcc2dcb26c1649887f1d5ae557a000b5fe34bb98
- SHA512 636a32fb8a88a542783aa57fe047b6bca47b2bd23b41b3902671c4e9036c6dbb97576be27fd2395a988653e6b63714277873e077519b4a06cdc5f63d3c4224e0
- SSDEEP 768:YRQnUhG5bZDOTpkdD82YbQkRFokFWIILPUh:FWObZDOTpk5T6zqAh
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a9:67:63:96:99:c5:5b:7e:88:69:58:46:cb:9b:f7:d1:bb:bf:20:aa
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Citrix Online,OU=Operations+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Citrix Online,L=Fort Lauderdale,ST=Florida,C=US
Chains
Nov 14, 2012
Subject
CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US
Serial Number
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 1, 2012 - Dec 31, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Citrix Online,OU=Operations+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Citrix Online,L=Fort Lauderdale,ST=Florida,C=US
Serial Number
5c:5f:2b:a5:c9:99:4b:e5:ef:25:4f:fe:51:12:88:e1
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 30, 2012 - May 1, 2014
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb
g2m
g2mcomm_winmain
kernel32
GetModuleHandleW
GetCommandLineW
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetStartupInfoW
ExitProcess
user32
MessageBoxA
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
run.bat
- SHA256 c9ee9421067791957a1382ef092232b20ed90ba30feb6bd2d6c16c86307e9e16
- MD5 ed0af6063e22a6abf2073ba2321a9731
- SHA1 0142b9f8e7518951113104f13e53c1fa24bd654a
- SHA512 02c24d1189114ecacc78adcdd7e0e6331ac8c349e70b382ed964d2d57c9456e7891092cc5bf224a126522073b0164eec1eba3e5e16eff3c81254aba1d1ca9b88
- MD5 SHA1 SHA512