Quarantined Messages (1).zip
- SHA256 20ef76c154dc7e7ebb7a1dc49590fab234f0f082133ed085bd834f89bd16c66b
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
Mia_Malkova_Photos.zip
Resource
win11-20240709-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target Quarantined Messages (1).zip
- Size 644KB
- Sample240726-qkvxqszerp
- SHA256 20ef76c154dc7e7ebb7a1dc49590fab234f0f082133ed085bd834f89bd16c66b
- MD5 264a47dd7ef0c91fc72d036d4f29852c
- SHA1 4e889a2642e4aa21ba5e0c732f1a41dae8e1a257
- SHA512 cd56f2e64589197a26a30862f7cc94ae00cecaf122348864b31299710ecd902266183af1db7618b64fe3711a73861594f4e3394d4dd9754763dc9dfb5f91495f
- SSDEEP 12288:KX9OaxSIF8UI8DzWS6HAu+VRCrGSiPnL5q+9UGVFFMq8oogM1e14CEVAsGd:reIKbCrGSiPnQOFFMqZMUKCEfGd
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
Quarantined Messages (1).zip.zip 644KB
-
Mia_Malkova_Photos.zip.zip 683KB
-
'.exe 927KB
-
Mia_Malkova_Photos.vbs4.0MB
Mia_Malkova_Photos.zip
- SHA256 0cb5f0585caf83de99654973aa72d0dc89ab7a38877695e13a09e909ca5341b0
- MD5 56364382f90973b12ef1104850e9576c
- SHA1 4a97da530553906de8c4ea6d91e71a18fdaf1968
- SHA512 91b9fe6f7c8bea6f27c15ce030abe2baad46a0ba7c3b3870e1ddf2b3c2d9ce29f224d7d02787d2bed8a3370c43e7e356ea20324579da903f4d393f8259860640
- SSDEEP 12288:rdgMjgPFqxvy+nlygSH5e3zbm2ECy734LUou6616ZefekcbO/o1f0LPOeqHPXA:rdwPiy+05e3zyF9Yxu66oqcqwiLSA
- MD5 SHA1 SHA512 SSDEEP
Password
infected
'
- IMPHASH 0f1f50882245365b9ce5061a60975af4
- SHA256 acaa5403a8c73414495693520d7e94c423abc4ae4237eddad8cb0886e6b23724
- MD5 1acefd52b10b834de4e770df29a8e8b9
- SHA1 adace06de40d3a81e92e5e5368d0a6854d785115
- SHA512 f8206d24e3f370caefe81cea4212581afe33af8867f2647754b5a67b5f69dc472bb4c892d6b048b72685844b8b4865b1f118ceffebb4571146547997d3f9731a
- SSDEEP 12288:ltgnPhEgPMI+c45linVLYeXP54o3Mn53XBVF+2O/6yCbfLVZIfTbowek5+n5A7y7:EP6gPvh45liV0ey6MnFXk2O/wfIrbGKe
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Digest
ef:eb:41:6d:96:29:88:d1:e7:27:e0:cb:7c:3b:48:2f:5a:f9:f2:5e:41:bf:f3:95:7b:80:3d:ae:b8:4b:f6:f7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
Chains
Jan 19, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
Serial Number
0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 2, 2021 - Jul 10, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
2
Major OS version
5
Entry point
367616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
chrome_proxy.exe.pdb
advapi32
CreateProcessAsUserW
EventRegister
EventUnregister
EventWrite
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SystemFunction036
kernel32
AcquireSRWLockExclusive
AssignProcessToJobObject
CloseHandle
CompareStringW
CreateEventW
CreateFileW
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsSetValue
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesW
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessId
GetProductInfo
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadId
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExW
GetWindowsDirectoryW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
InitializeProcThreadAttributeList
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LocalFree
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
ResetEvent
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetHandleInformation
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnregisterWaitEx
UpdateProcThreadAttribute
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
shell32
CommandLineToArgvW
SHGetFolderPathW
SHGetKnownFolderPath
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
user32
AllowSetForegroundWindow
ole32
CoInitializeEx
CoRegisterInitializeSpy
CoRevokeInitializeSpy
CoTaskMemFree
CoUninitialize
winmm
timeGetTime
GetHandleVerifier
Name
.text
Size
712KB
Virtual Size
711KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
134KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
37KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
297B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Mia_Malkova_Photos.vbs
- SHA256 20f8f27cdfbd0a0346a2e43348b3ae626d3aa4712ab559dce8286b74a58ddeb8
- MD5 83959ea07eae4d7f08fb11862ed707cb
- SHA1 80f40a35bde7a1500476bb17401948f4f811c7b0
- SHA512 16faa156267bd072d9c889c951a109c827cc61d01b5962a74c912a8a63d5582802a6d1cb78875294ee3cb1fe361cfc41545837c22a4f76765f74e9b609942d05
- SSDEEP 12288:X999t9t9t9t9t99999999999t99t99999999tttt9tt9t9t99t99tt9t9t9ttttE:EGg
- MD5 SHA1 SHA512 SSDEEP