file_0f196e9dfc30463e8352da98075ff38e_2024-07-04_12_19_36_469000[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

file_0f196e9dfc30463e8352da98075ff38e_2024-07-04_12_19_36_469000.zip
Size

22.8MB
MD5

d2ecd49037cc006500de6c9793a7e55a
SHA1

0e5cf8600c62b325732330e9c9959d4b8f1735a2
SHA256

b088905a58efd6cbcaefb70caac4bcf2395415bdffc3e36ac324d7d28f142faf
SHA512

eb96d28a342d56281ca54eab53a7f5507e6e10f374769d40e4a9413d5332e170db864330586da43a32a75d1dde207f47c844fbb4ddd0f84f006b2adac04156e7
SSDEEP

393216:3ywJSCu+9zyQCOB29wLIJ1vmYawlYXaS5+swFXONCC+qFEQu48Ic0k77t0m2H:3BJSCu+gOY6LmvmRJF5+swFXN7cEQuPa

Score

1^/10

Malware Config

Signatures

Files

file_0f196e9dfc30463e8352da98075ff38e_2024-07-04_12_19_36_469000.zip
.zip
entry_1_0/EXCEL.EXE
.exe windows:6 windows x86 arch:x86

Code Sign

33:00:00:05:56:c9:20:2b:1f:74:32:5d:2d:00:00:00:00:05:56
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2023 19:51

Not After

16-10-2024 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:a4:cb:e3:56:b8:cb:7f:e4:27:00:00:00:00:03:a4
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2023 19:51

Not After

16-10-2024 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:3d:12:8c:3d:25:87:e0:42:b6:37:76:a4:ad:6d:d9:be:af:82:a1:de:98:3e:e2:e2:3c:68:6c:84:6f:85:7b
Signer

Actual PE Digest

ab:3d:12:8c:3d:25:87:e0:42:b6:37:76:a4:ad:6d:d9:be:af:82:a1:de:98:3e:e2:e2:3c:68:6c:84:6f:85:7b

Digest Algorithm

sha256

PE Digest Matches

true

ab:3d:12:8c:3d:25:87:e0:42:b6:37:76:a4:ad:6d:d9:be:af:82:a1:de:98:3e:e2:e2:3c:68:6c:84:6f:85:7b
Signer

Actual PE Digest

ab:3d:12:8c:3d:25:87:e0:42:b6:37:76:a4:ad:6d:d9:be:af:82:a1:de:98:3e:e2:e2:3c:68:6c:84:6f:85:7b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\excel.pdb

Exports

Exports

BeginUpgradeASPPModel
DllGetLCID
GetDMCLRRuntime
GetDMCLRRuntimeInAppDomain
LinkASPPModelTable
MdCallBack
MdCallBack12
UpgradeASPPModel
_LPenHelper

Sections

.text
Size: 36.2MB - Virtual size: 36.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 719KB - Virtual size: 786KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.c2r
Size: 512B - Virtual size: 400B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
manifest.json

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:05:56:c9:20:2b:1f:74:32:5d:2d:00:00:00:00:05:56Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

33:00:00:03:a4:cb:e3:56:b8:cb:7f:e4:27:00:00:00:00:03:a4Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

ab:3d:12:8c:3d:25:87:e0:42:b6:37:76:a4:ad:6d:d9:be:af:82:a1:de:98:3e:e2:e2:3c:68:6c:84:6f:85:7bSigner

ab:3d:12:8c:3d:25:87:e0:42:b6:37:76:a4:ad:6d:d9:be:af:82:a1:de:98:3e:e2:e2:3c:68:6c:84:6f:85:7bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Exports

Exports

Sections

.text Size: 36.2MB - Virtual size: 36.2MB

.rdata Size: 5.2MB - Virtual size: 5.2MB

.data Size: 719KB - Virtual size: 786KB

.detourc Size: 4KB - Virtual size: 4KB

.c2r Size: 512B - Virtual size: 400B

.rsrc Size: 5.5MB - Virtual size: 5.5MB

.reloc Size: 1.4MB - Virtual size: 1.4MB

33:00:00:05:56:c9:20:2b:1f:74:32:5d:2d:00:00:00:00:05:56
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

33:00:00:03:a4:cb:e3:56:b8:cb:7f:e4:27:00:00:00:00:03:a4
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

ab:3d:12:8c:3d:25:87:e0:42:b6:37:76:a4:ad:6d:d9:be:af:82:a1:de:98:3e:e2:e2:3c:68:6c:84:6f:85:7b
Signer

ab:3d:12:8c:3d:25:87:e0:42:b6:37:76:a4:ad:6d:d9:be:af:82:a1:de:98:3e:e2:e2:3c:68:6c:84:6f:85:7b
Signer

.text
Size: 36.2MB - Virtual size: 36.2MB

.rdata
Size: 5.2MB - Virtual size: 5.2MB

.data
Size: 719KB - Virtual size: 786KB

.detourc
Size: 4KB - Virtual size: 4KB

.c2r
Size: 512B - Virtual size: 400B

.rsrc
Size: 5.5MB - Virtual size: 5.5MB

.reloc
Size: 1.4MB - Virtual size: 1.4MB