sample 2.zip
- SHA256 a1734b81d261fc0f40ba0ee37ba97b44ae4383934e43909381ef18d6122fb601
Password
virus
Static task
static1
Behavioral task
behavioral1
Sample
sample 2.exe
Resource
win10-20240611-en
windows10-1703-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
sample 2.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral3
Sample
sample 2.exe
Resource
win11-20240508-en
windows11-21h2-x64
4 signatures
300 seconds
General
- Target sample 2.zip
- Size 825KB
- Sample240613-mefdbavbrg
- SHA256 a1734b81d261fc0f40ba0ee37ba97b44ae4383934e43909381ef18d6122fb601
- MD5 f73553dc49e25574ffb6d932776f0d07
- SHA1 8be7a64f4c02ad981d58ecfbd6dc5392b98e4a33
- SHA512 161beba7c57775db032ec167d386652644dfe517d907bd1f356738467717a89d8bc237058745382b4a31725a7ec84cfaa7c91b5b546946bda34284f722a54154
- SSDEEP 24576:HZrbln+1GgFItZoUVNEGVdir1X3v5gZSTnNv5Et46:Rbln+1GB3oUVNEGVdir1X3BgQp5Et46
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
sample 2.zip.zip 825KB
-
sample 2.exe.exe 1.6MB
sample 2.exe
- IMPHASH 8d13d0d6835a017bb3f9676f13031b39
- SHA256 40e20dcbb27b523b3d06d0d295c67b90d71c76a2aacc88c7bd58c4979dfc1248
- MD5 8ca442f45afe4458f4d057e53d6129e5
- SHA1 8203c97d9e8c31cb8dd898f9c896ba9ae4ce81b4
- SHA512 91db3aa237a1aaa12e3d044c2564316d01551680509f2da23d92edfdf6d214787b2db56d9a369a844479f2be1b7bdee02d9a1f850ccc659c4cf5543963fd16ab
- SSDEEP 49152:lUVv3IETDKTKK4KKDyK5FZ1EEEEmEEE1EEEEEEEEEEElKK1KKK1KKKyLk3OEkmJ4:lUS2KTKK4KKDyK5FZ1EEEEmEEE1EEEEd
- MD5 SHA1 SHA512 SSDEEP
Password
virus
PE Signature issue
Digest
f3:ab:0b:3f:87:3f:00:69:47:fb:cb:b3:28:44:3f:e8:d6:4d:63:27
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Hangzhou Infogo Tech Co.\, Ltd.,O=Hangzhou Infogo Tech Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN
Chains
Jun 12, 2024
Subject
CN=Hangzhou Infogo Tech Co.\, Ltd.,O=Hangzhou Infogo Tech Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN
Serial Number
02:0e:b5:27:ba:c0:10:99:59:3e:2e:a9:02:e3:97:cb
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 12, 2018 - Jul 15, 2021
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Minor OS version
2
Major OS version
5
Entry point
417944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\jenkins\workspace\ci.dingding.manual.new\DingTalk-Win\win\bin\release\DingTalk.exe.pdb
advapi32
SystemFunction036
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
FreeSid
SetEntriesInAclW
GetSecurityInfo
GetSidSubAuthority
InitializeSid
CreateWellKnownSid
CopySid
LookupPrivilegeValueW
DuplicateToken
CreateRestrictedToken
SetThreadToken
GetTokenInformation
CreateProcessAsUserW
AccessCheck
EqualSid
IsValidSid
GetNamedSecurityInfoW
MapGenericMask
ImpersonateLoggedOnUser
ConvertSidToStringSidW
DuplicateTokenEx
GetKernelObjectSecurity
SetKernelObjectSecurity
GetAce
OpenProcessToken
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDisablePredefinedCache
RevertToSelf
kernel32
LoadLibraryExW
GetCommandLineW
SetEnvironmentVariableW
CreateFileW
GetFileAttributesW
ReadFile
OutputDebugStringW
SetUnhandledExceptionFilter
SetErrorMode
GetVersionExW
FindResourceExW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryA
LocalFree
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStdHandle
SetStdHandle
GetConsoleMode
GetConsoleOutputCP
GetProcAddress
GetModuleHandleW
RtlUnwindEx
FreeLibrary
UnmapViewOfFile
CreateFileMappingW
WriteFile
GetFileSize
GetPrivateProfileStringW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
IsWow64Process
WriteProcessMemory
ReadProcessMemory
VirtualProtectEx
VirtualAllocEx
CreateProcessW
TerminateProcess
ExitProcess
WaitForSingleObject
SetLastError
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
VirtualFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
LoadLibraryW
IsDebuggerPresent
RtlPcToFileHeader
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
GetCPInfo
HeapSetInformation
GetCurrentDirectoryW
GetLocalTime
GetTickCount
OutputDebugStringA
FormatMessageA
CreateIoCompletionPort
CreateEventW
CreateThread
ResetEvent
GetQueuedCompletionStatus
SetEvent
RegisterWaitForSingleObject
UnregisterWait
TerminateJobObject
PostQueuedCompletionStatus
DuplicateHandle
SetInformationJobObject
GetUserDefaultLangID
GetUserDefaultLCID
GetUserDefaultLocaleName
EnumSystemLocalesEx
GetProductInfo
GetNativeSystemInfo
GetCurrentProcessId
ProcessIdToSessionId
Sleep
RtlUnwind
GetThreadId
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnregisterWaitEx
GetFileType
SetHandleInformation
AssignProcessToJobObject
MapViewOfFile
GetCurrentProcessorNumber
SetThreadAffinityMask
GetProcessHandleCount
GetProcessHeaps
SignalObjectAndWait
ExpandEnvironmentStringsW
QueryDosDeviceW
GetLongPathNameW
VirtualFreeEx
GetModuleHandleExW
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
RtlCaptureStackBackTrace
TlsGetValue
AcquireSRWLockExclusive
CreateNamedPipeW
CreateRemoteThread
CreateJobObjectW
QueryInformationJobObject
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CreateMutexW
SetCurrentDirectoryW
TlsAlloc
TlsFree
TlsSetValue
SetFilePointerEx
GetFileSizeEx
SetEndOfFile
FlushFileBuffers
SearchPathW
lstrlenW
DebugBreak
FindClose
FindNextFileW
FindFirstFileExW
GetStringTypeW
VirtualProtect
EncodePointer
LCMapStringEx
ole32
CoTaskMemFree
CoUninitialize
CoInitialize
shell32
SHGetFolderPathW
user32
CreateDesktopW
CloseWindowStation
SetProcessWindowStation
CreateWindowStationW
GetUserObjectInformationW
GetProcessWindowStation
CloseDesktop
GetThreadDesktop
dbghelp
SymCleanup
SymSetOptions
SymInitialize
SymGetSearchPathW
SymSetSearchPathW
SymFromAddr
SymGetLineFromAddr64
winmm
timeGetTime
Name
.text
Size
565KB
Virtual Size
565KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
124KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
884KB
Virtual Size
883KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=260, version=27412,
count=14, id=259, version=27412,
count=187, id=261, version=27412,
count=1, id=253, version=28518,
count=19, id=260, version=30034,
count=10, id=259, version=30034,
count=2, id=257, version=30146,
count=305, productName=Unmarked objects (old),
count=2, id=257, version=30152,
count=1, id=262, version=27412,
count=91, id=261, version=30034,
count=32, id=257, version=27412,
count=5, id=257, version=30141,
count=398, id=1, productName=Unmarked objects,
count=12, id=261, version=30141,
count=1, id=256, version=30141,
count=1, id=255, version=30141,
count=1, id=151,
count=1, id=258, version=30141,