ee537a5335c4658517c66e234cf2d6f4098e02668b2a1d4d09bd953effaf719b
- SHA256 ee537a5335c4658517c66e234cf2d6f4098e02668b2a1d4d09bd953effaf719b
Behavioral task
behavioral1
Sample
????.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
????.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
u????????_???U??????3.0???????@186_6840.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
u????????_???U??????3.0???????@186_6840.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target ee537a5335c4658517c66e234cf2d6f4098e02668b2a1d4d09bd953effaf719b
- Size 607KB
- Sample240613-rytghashma
- SHA256 ee537a5335c4658517c66e234cf2d6f4098e02668b2a1d4d09bd953effaf719b
- MD5 9008c84652393c40f4634c0f8801742b
- SHA1 8c27b45703ee04320816e86cfa0d0fe898cf3c83
- SHA512 45beab259ef777ab2449f9b7c9f4f436e3a50c680cc46f087ce3892f1eab93f476a8132efa26f2e7ab7a07cfa5612bc78e72ba9b851316e717690d1a65428188
- SSDEEP 12288:Z0iWYLzFzOYnRZdY/fkxBT0rCuhLgrQ7aHvl2v2P6rfPemUbHl0mgTSnlH8:Z0ibLz94cfCVGrQ7aH9KpbUbl0TMp8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/u????????_???U??????3.0???????@186_6840.exe upx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx
File Explorer
-
ee537a5335c4658517c66e234cf2d6f4098e02668b2a1d4d09bd953effaf719b.zip 607KB
-
????.html410B
-
????.txt1KB
-
u????????_???U??????3.0???????@186_6840.exe.exe 633KB
-
out.upx.exe 1.6MB
????.html
- SHA256 8d518dfe520c4464fe9fd28724ae8d9700ab0a6e5a648f9be8a85a526b095c87
- MD5 7bb7ae902ffeb8c37fe00b88fe68c1e7
- SHA1 c839f12d71b57aafbdbd7bca481e9438e8801579
- SHA512 46ccd91f2d826b19b272c1440b5f8ef7c96261e0ed8cc40d064a0ddc547400e8c35831280999ab37fb7df2a525c8c88d1d5f3e36161b0b633249c7f226b66803
- MD5 SHA1 SHA512
????.txt
- SHA256 4818be39330b3ec3ca4f9a0cb9d6759c0fb1789eb2d31796f60d06d3ba15e5f2
- MD5 6be2f9397d71ddf3c75c9c961057f954
- SHA1 00f656f9f3e710465ce52ae1480d08c69dee1260
- SHA512 871b915bf00e0ed66e1b62b1b8afdf69e6a15f5b4e2358ead03861afd00d45a26c0631eac1dd08e70e670a1b09e5e07279d4dc652394e62e1e7ccdb1fe61bdfe
- MD5 SHA1 SHA512
u????????_???U??????3.0???????@186_6840.exe
- SHA256 a27b060565a1bf76cc99b552984ba74faad13d226a6b4b4797e01c67f19c0560
- MD5 c767e45296e7e58761b9ad9393b19b71
- SHA1 9d9cefe8d27f2aed338f32c642fd0ead0b67f863
- SHA512 54e9a2418bc520adc9386183e56da80df765cdc560186b54b49b287339235bc1a4a716dbce4b6982a1cd9f86d2127d6a0ce955374e13d1fc4ee5267349b0ebf2
- SSDEEP 12288:GVvVUdCuZxPKqRGQHPynJBsU+6K08Q3lqZ/AtivlPtCyE174rkd8:GV9sPKqcnKIVCzdPAyEdd8
- MD5 SHA1 SHA512 SSDEEP
Digest
a4:e1:78:be:7f:da:e7:8e:2b:89:7b:15:f5:54:e0:94:7a:7c:94:96:23:91:e5:f8:c8:54:89:48:ab:79:7e:da
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91320804MA1MKN9Q0G,CN=Anhui Shabake Network Technology Co.\, Ltd.,OU=运营,O=Anhui Shabake Network Technology Co.\, Ltd.,L=Ma'anshan,ST=Anhui,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13094d6127616e7368616e,1.3.6.1.4.1.311.60.2.1.2=#1305416e687569,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
May 25, 2021
SERIALNUMBER=91320804MA1MKN9Q0G,CN=Anhui Shabake Network Technology Co.\, Ltd.,OU=运营,O=Anhui Shabake Network Technology Co.\, Ltd.,L=Ma'anshan,ST=Anhui,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13094d6127616e7368616e,1.3.6.1.4.1.311.60.2.1.2=#1305416e687569,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
SERIALNUMBER=91320804MA1MKN9Q0G,CN=Anhui Shabake Network Technology Co.\, Ltd.,OU=运营,O=Anhui Shabake Network Technology Co.\, Ltd.,L=Ma'anshan,ST=Anhui,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13094d6127616e7368616e,1.3.6.1.4.1.311.60.2.1.2=#1305416e687569,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
01:0f:ad:bc:e9:93:6c:e0:f1:09:87:51:9c:38:eb:cc
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 23, 2019 - Jan 26, 2022
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
5
Entry point
1680832
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
586KB
Virtual Size
588KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
37KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=16, id=241, version=40116,
count=182, id=243, version=40116,
count=32, id=242, version=40116,
count=5, id=199, version=41118,
count=26, id=259, version=26706,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=80, id=261, version=26706,
count=35, id=260, version=26706,
count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=534, id=1, productName=Unmarked objects,
count=92, id=260, version=27045,
count=74, id=261, version=27045,
count=85, id=265, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 13cf8f994938a3824fe5b25c653399a168e48d5a5d5a02529d95175e38788a38
- MD5 51ccb7586d262f0c66ee776fc812a3dc
- SHA1 44ffaf9ff6e9dc0bc7cad46f136622a22eac43c5
- SHA512 7e61c03d4f4e69d4e9eab0827c99fb0f6e4e007f8a0ff0e4d71d06704ac72da29af250a98379e405b877392a195965092db4adaed721f93b0c2a7be89b765cfe
- SSDEEP 24576:sowXdKJPF1L9NDyIvfxYMKmkv8hvIjgo9GyUPfWucghC5SOts4VYd:sRqFJyOfFS84uhNAstd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
1095864
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
253KB
Virtual Size
253KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=241, version=40116,
count=182, id=243, version=40116,
count=32, id=242, version=40116,
count=5, id=199, version=41118,
count=26, id=259, version=26706,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=80, id=261, version=26706,
count=35, id=260, version=26706,
count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=534, id=1, productName=Unmarked objects,
count=92, id=260, version=27045,
count=74, id=261, version=27045,
count=85, id=265, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,