Ghostpress[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

Ghostpress.zip
Size

7.3MB
MD5

4a2fe69e24454bc45cdf7cb4c5d16614
SHA1

3acf8e808f003f8f62b8a8b90afa4ab3238aaa17
SHA256

bba117558703b80e9e3dec401f3de3989b8ce720e4f5fe07e82a253be6e129fb
SHA512

23dc963a9e245037d757070f52809f7b6c865f612e1c5803f3f07ac92eec4f7398d40b682de1e076b7ea7a2d42df98d297d5f6c0f6d9c5fdfccb3d2b1c14dc35
SSDEEP

196608:g9fiuy15gdcTpiC6gvxd64f8goVib6yTJXggVKPOJ9:4fiuyCGsC6s3f8Pc1QgV689

Score

1^/10

Malware Config

Signatures

Files

Ghostpress.zip
.zip
Ghostpress.exe
.exe windows:4 windows x86 arch:x86

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19-05-2021 05:32

Not After

18-05-2036 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

71:fb:97:d5:df:ee:fb:1b:9d:d4:91:fb:72:c0:f0:dc
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

25-03-2024 17:15

Not After

20-03-2026 13:00

Subject

CN=schiffer.tech UG (haftungsbeschränkt),O=schiffer.tech UG (haftungsbeschränkt),L=Waldfeucht,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19-05-2021 05:32

Not After

18-05-2036 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:fb:97:d5:df:ee:fb:1b:9d:d4:91:fb:72:c0:f0:dc
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

25-03-2024 17:15

Not After

20-03-2026 13:00

Subject

CN=schiffer.tech UG (haftungsbeschränkt),O=schiffer.tech UG (haftungsbeschränkt),L=Waldfeucht,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e4:57:18:be:91:0f:ec:81:49:a4:c7:c7:67:6a:80:96:55:5d:28:01:c1:9f:78:a8:57:af:a9:af:20:33:4b:a4
Signer

Actual PE Digest

e4:57:18:be:91:0f:ec:81:49:a4:c7:c7:67:6a:80:96:55:5d:28:01:c1:9f:78:a8:57:af:a9:af:20:33:4b:a4

Digest Algorithm

sha256

PE Digest Matches

true

7a:3b:2e:a8:c2:28:29:1b:f6:78:c4:20:5f:ac:a4:af:14:5c:c1:1e
Signer

Actual PE Digest

7a:3b:2e:a8:c2:28:29:1b:f6:78:c4:20:5f:ac:a4:af:14:5c:c1:1e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 473KB - Virtual size: 976KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

schiffer
Size: - Virtual size: 9.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Ghostpress_Data/Lang/DE.ini
Ghostpress_Data/Lang/EN.ini
Ghostpress_Data/Lang/ES.ini
Ghostpress_Data/Lang/FR.ini
Ghostpress_Data/Lang/IT.ini
Ghostpress_Data/Lang/NL.ini
Ghostpress_Data/Lang/PL.ini
Ghostpress_Data/Lang/PT.ini
Ghostpress_Data/Reset All.cmd
Ghostpress_Data/Reset Settings.cmd
Ghostpress_Data/Reset Setup.cmd
Ghostpress_Data/UI.wav
Help.pdf
.pdf

Sharing

General

Malware Config

Signatures

Files

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

71:fb:97:d5:df:ee:fb:1b:9d:d4:91:fb:72:c0:f0:dcCertificate

Extended Key Usages

Key Usages

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

71:fb:97:d5:df:ee:fb:1b:9d:d4:91:fb:72:c0:f0:dcCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

e4:57:18:be:91:0f:ec:81:49:a4:c7:c7:67:6a:80:96:55:5d:28:01:c1:9f:78:a8:57:af:a9:af:20:33:4b:a4Signer

7a:3b:2e:a8:c2:28:29:1b:f6:78:c4:20:5f:ac:a4:af:14:5c:c1:1eSigner

Headers

DLL Characteristics

File Characteristics

Sections

Size: 473KB - Virtual size: 976KB

Size: 12KB - Virtual size: 12KB

Size: 512B - Virtual size: 12B

.idata Size: 512B - Virtual size: 8KB

.rsrc Size: 13KB - Virtual size: 13KB

schiffer Size: - Virtual size: 9.6MB

.boot Size: 6.6MB - Virtual size: 6.6MB

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

71:fb:97:d5:df:ee:fb:1b:9d:d4:91:fb:72:c0:f0:dc
Certificate

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

71:fb:97:d5:df:ee:fb:1b:9d:d4:91:fb:72:c0:f0:dc
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

e4:57:18:be:91:0f:ec:81:49:a4:c7:c7:67:6a:80:96:55:5d:28:01:c1:9f:78:a8:57:af:a9:af:20:33:4b:a4
Signer

7a:3b:2e:a8:c2:28:29:1b:f6:78:c4:20:5f:ac:a4:af:14:5c:c1:1e
Signer

.idata
Size: 512B - Virtual size: 8KB

.rsrc
Size: 13KB - Virtual size: 13KB

schiffer
Size: - Virtual size: 9.6MB

.boot
Size: 6.6MB - Virtual size: 6.6MB