exes[.]zip | Triage

Resubmissions

01-07-2024 19:23

240701-x37sksyeqj 1

01-07-2024 19:23

240701-x3t7gsvdqf 1

Sharing

Copy URL

Twitter E-mail

General

Target

exes.zip
Size

420KB
MD5

0a8ab783a26aca653574c7b19ee7932d
SHA1

90976cd71ee5b10abb2768b4cd38d2cf683f5784
SHA256

d7238e1d13df998de7215971864327aa83af9e6e76f492017dc1a7293d7dd18f
SHA512

4b059e3e18e00bb924ca83e824e40a5f4cb44b41cfb98405e1a0740674976f1ac167ea2a09c984d25bdab192a134826aa5a050daa18473a91d88d00c6c8c3346
SSDEEP

12288:Et3gdojIh+tK8urfIFoEWbdn7wypmXmwUpZiaY:ESiK+tK8ui/WJn7wUwiJY

Score

1^/10

Malware Config

Signatures

Files

exes.zip
.zip
exes/XeroxSetup.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

8f:ac:8a:fe:e4:a4:f4:94:35:cc:63:6a:34:28:ac:3d
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-12-2015 00:00

Not After

08-12-2016 23:59

Subject

CN=Xerox Corporation,O=Xerox Corporation,POSTALCODE=06850,STREET=45 Glover Ave,L=Norwalk,ST=Connecticut,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:5a:7b:a8:89:b6:29:a2:28:87:6a:8c:ab:52:30:84:39:c3:68:9e
Signer

Actual PE Digest

6d:5a:7b:a8:89:b6:29:a2:28:87:6a:8c:ab:52:30:84:39:c3:68:9e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB Paths

C:\Program Files (x86)\Xerox\DSC Packager\Util\DownloadManager\DownloadManager\Output\DownloadManager.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 755KB - Virtual size: 755KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
exes/sqlceme35.dll
.dll windows:5 windows x64 arch:x64

ea15ebbe34d3b66152c2a6ca4fbb4923

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22-08-2007 22:31

Not After

25-08-2012 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07-12-2009 22:40

Not After

07-03-2011 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25-07-2008 19:02

Not After

25-07-2013 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d6:52:66:d1:d3:4b:ca:b1:03:fc:e7:b0:6d:e9:e8:b0:6a:90:0f:93
Signer

Actual PE Digest

d6:52:66:d1:d3:4b:ca:b1:03:fc:e7:b0:6d:e9:e8:b0:6a:90:0f:93

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

sqlceme35.pdb

Imports

kernel32

GetLastError
MultiByteToWideChar
FormatMessageW
GetProcAddress
FreeLibrary
GetLocalTime
MoveFileExW
WaitForSingleObject
WideCharToMultiByte
ReleaseMutex
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
CloseHandle
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
LoadLibraryW
GetModuleHandleW
GetLocaleInfoW
OutputDebugStringW
CreateFileW

ole32

CLSIDFromString
CoCreateGuid

oleaut32

VariantClear
SysAllocStringLen
VariantInit
SysAllocString
SysFreeString

msvcr80

__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
__C_specific_handler
_amsg_exit
_decode_pointer
free
_encoded_null
_initterm_e
_initterm
_malloc_crt
_encode_pointer
_wcsnicmp
memcpy
_vsnwprintf
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memset
wcsncpy
_snwprintf
wcsrchr
wprintf
_itow
_vsnprintf
_wcsicmp
_vswprintf

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

DllAddRef
DllCanUnloadNow
DllMain
DllRelease
ME_AbortTransaction
ME_CleanupTombstoneData
ME_CleanupTrackingMetadata
ME_CleanupTransactionData
ME_ClearErrorInfo
ME_CloseStore
ME_CommitTransaction
ME_CompileQueryPlan
ME_CreateCommand
ME_CreateDatabase
ME_CreateErrorInstance
ME_DeleteArray
ME_DeleteRecord
ME_DisableChangeTracking
ME_EnableChangeTracking
ME_ExecuteQueryPlan
ME_ExitChangeTracking
ME_GetBookmark
ME_GetChangeTrackingInfo
ME_GetColumnInfo
ME_GetColumnOrdinal
ME_GetColumnsUpdated
ME_GetContextErrorInfo
ME_GetContextErrorMessage
ME_GetCurrentTrackingTxBsn
ME_GetCurrentTrackingTxCsn
ME_GetDatabaseInstanceID
ME_GetEncryptionMode
ME_GetIndexColumnOrdinals
ME_GetKeyInfo
ME_GetLocale
ME_GetLocaleFlags
ME_GetMinorError
ME_GetNativeVersionInfo
ME_GetParameterInfo
ME_GetSqlCeVersionInfo
ME_GetTrackingContext
ME_GetTrackingOptions
ME_GetTransactionBsn
ME_GetTransactionFlags
ME_GetValues
ME_GotoBookmark
ME_InitChangeTracking
ME_InsertRecord
ME_IsTableChangeTracked
ME_Move
ME_OpenCursor
ME_OpenStore
ME_OpenTransaction
ME_Prepare
ME_Read
ME_ReadAt
ME_Rebuild
ME_SafeDelete
ME_SafeRelease
ME_Seek
ME_SetColumnInfo
ME_SetContextErrorInfo
ME_SetRange
ME_SetTableInfoAsSystem
ME_SetTrackingContext
ME_SetTransactionFlag
ME_SetValue
ME_SetValues
ME_UpdateRecord
uwrda_Pull
uwrda_Push
uwrda_RemoteDataAccess
uwrda_SubmitSql
uwrda_SysFreeString
uwrda_get_CompressionLevel
uwrda_get_ConnectTimeout
uwrda_get_ConnectionManager
uwrda_get_ConnectionRetryTimeout
uwrda_get_ErrorPointer
uwrda_get_InternetLogin
uwrda_get_InternetPassword
uwrda_get_InternetProxyLogin
uwrda_get_InternetProxyPassword
uwrda_get_InternetProxyServer
uwrda_get_InternetUrl
uwrda_get_LocalConnectionString
uwrda_get_ReceiveTimeout
uwrda_get_SendTimeout
uwrda_put_CompressionLevel
uwrda_put_ConnectTimeout
uwrda_put_ConnectionManager
uwrda_put_ConnectionRetryTimeout
uwrda_put_InternetLogin
uwrda_put_InternetPassword
uwrda_put_InternetProxyLogin
uwrda_put_InternetProxyPassword
uwrda_put_InternetProxyServer
uwrda_put_InternetUrl
uwrda_put_LocalConnectionString
uwrda_put_ReceiveTimeout
uwrda_put_SendTimeout
uwrepl_AddSubscription
uwrepl_AsyncReplication
uwrepl_Cancel
uwrepl_DropSubscription
uwrepl_GetSyncResult
uwrepl_Initialize
uwrepl_LoadProperties
uwrepl_ReinitializeSubscription
uwrepl_Replication
uwrepl_Run
uwrepl_SaveProperties
uwrepl_Terminate
uwrepl_WaitForNextStatusReport
uwrepl_get_CompressionLevel
uwrepl_get_ConnectTimeout
uwrepl_get_ConnectionManager
uwrepl_get_ConnectionRetryTimeout
uwrepl_get_Distributor
uwrepl_get_DistributorAddress
uwrepl_get_DistributorLogin
uwrepl_get_DistributorNetwork
uwrepl_get_DistributorPassword
uwrepl_get_DistributorSecurityMode
uwrepl_get_ErrorPointer
uwrepl_get_ExchangeType
uwrepl_get_HostName
uwrepl_get_InternetLogin
uwrepl_get_InternetPassword
uwrepl_get_InternetProxyLogin
uwrepl_get_InternetProxyPassword
uwrepl_get_InternetProxyServer
uwrepl_get_InternetUrl
uwrepl_get_LoginTimeout
uwrepl_get_PostSyncCleanup
uwrepl_get_ProfileName
uwrepl_get_Publication
uwrepl_get_Publisher
uwrepl_get_PublisherAddress
uwrepl_get_PublisherChanges
uwrepl_get_PublisherConflicts
uwrepl_get_PublisherDatabase
uwrepl_get_PublisherLogin
uwrepl_get_PublisherNetwork
uwrepl_get_PublisherPassword
uwrepl_get_PublisherSecurityMode
uwrepl_get_QueryTimeout
uwrepl_get_ReceiveTimeout
uwrepl_get_SendTimeout
uwrepl_get_SnapshotTransferType
uwrepl_get_Subscriber
uwrepl_get_SubscriberChanges
uwrepl_get_SubscriberConflicts
uwrepl_get_SubscriberConnectionString
uwrepl_get_Validate
uwrepl_put_CompressionLevel
uwrepl_put_ConnectTimeout
uwrepl_put_ConnectionManager
uwrepl_put_ConnectionRetryTimeout
uwrepl_put_Distributor
uwrepl_put_DistributorAddress
uwrepl_put_DistributorLogin
uwrepl_put_DistributorNetwork
uwrepl_put_DistributorPassword
uwrepl_put_DistributorSecurityMode
uwrepl_put_ExchangeType
uwrepl_put_HostName
uwrepl_put_InternetLogin
uwrepl_put_InternetPassword
uwrepl_put_InternetProxyLogin
uwrepl_put_InternetProxyPassword
uwrepl_put_InternetProxyServer
uwrepl_put_InternetUrl
uwrepl_put_LoginTimeout
uwrepl_put_PostSyncCleanup
uwrepl_put_ProfileName
uwrepl_put_Publication
uwrepl_put_Publisher
uwrepl_put_PublisherAddress
uwrepl_put_PublisherDatabase
uwrepl_put_PublisherLogin
uwrepl_put_PublisherNetwork
uwrepl_put_PublisherPassword
uwrepl_put_PublisherSecurityMode
uwrepl_put_QueryTimeout
uwrepl_put_ReceiveTimeout
uwrepl_put_SendTimeout
uwrepl_put_SnapshotTransferType
uwrepl_put_Subscriber
uwrepl_put_SubscriberConnectionString
uwrepl_put_Validate
uwutil_ConvertFromDBTIMESTAMP
uwutil_ConvertToDBTIMESTAMP
uwutil_ReleaseCOMPtr
uwutil_SysFreeString
uwutil_ZeroMemory
uwutil_get_Error
uwutil_get_ErrorCount

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

8f:ac:8a:fe:e4:a4:f4:94:35:cc:63:6a:34:28:ac:3dCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

6d:5a:7b:a8:89:b6:29:a2:28:87:6a:8c:ab:52:30:84:39:c3:68:9eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 755KB - Virtual size: 755KB

.rsrc Size: 54KB - Virtual size: 53KB

.reloc Size: 512B - Virtual size: 12B

ea15ebbe34d3b66152c2a6ca4fbb4923

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

d6:52:66:d1:d3:4b:ca:b1:03:fc:e7:b0:6d:e9:e8:b0:6a:90:0f:93Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ole32

oleaut32

msvcr80

advapi32

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 64KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 512B - Virtual size: 364B

8f:ac:8a:fe:e4:a4:f4:94:35:cc:63:6a:34:28:ac:3d
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

6d:5a:7b:a8:89:b6:29:a2:28:87:6a:8c:ab:52:30:84:39:c3:68:9e
Signer

.text
Size: 755KB - Virtual size: 755KB

.rsrc
Size: 54KB - Virtual size: 53KB

.reloc
Size: 512B - Virtual size: 12B

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

d6:52:66:d1:d3:4b:ca:b1:03:fc:e7:b0:6d:e9:e8:b0:6a:90:0f:93
Signer

.text
Size: 64KB - Virtual size: 64KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 512B - Virtual size: 364B