vm.zip
- SHA256 63b0e303a05ad2eb2a93e2f9cd96e50361cf1e0d29f9cab8b0a98d1185347f8a
Overview
overview
10Static
static
3g2m.dll
windows7-x64
3g2m.dll
windows10-1703-x64
3g2m.dll
windows10-2004-x64
3g2m.dll
windows11-21h2-x64
3runvm.bat
windows7-x64
1runvm.bat
windows10-1703-x64
10runvm.bat
windows10-2004-x64
10runvm.bat
windows11-21h2-x64
10vm.exe
windows7-x64
1vm.exe
windows10-1703-x64
10vm.exe
windows10-2004-x64
10vm.exe
windows11-21h2-x64
10Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
g2m.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral2
Sample
g2m.dll
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
g2m.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
g2m.dll
Resource
win11-20240709-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
runvm.bat
Resource
win7-20240705-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral6
Sample
runvm.bat
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
300 seconds
Behavioral task
behavioral7
Sample
runvm.bat
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral8
Sample
runvm.bat
Resource
win11-20240709-en
windows11-21h2-x64
7 signatures
300 seconds
Behavioral task
behavioral9
Sample
vm.exe
Resource
win7-20240704-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
vm.exe
Resource
win10-20240611-en
windows10-1703-x64
6 signatures
300 seconds
Behavioral task
behavioral11
Sample
vm.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
300 seconds
General
- Target vm.zip
- Size 290KB
- Sample240727-qpgkxavblb
- SHA256 63b0e303a05ad2eb2a93e2f9cd96e50361cf1e0d29f9cab8b0a98d1185347f8a
- MD5 8090d3ff2bf334b750478761c31bf25e
- SHA1 ec048b210369dd140be8ed66d07ac4466ab5f7e4
- SHA512 dfbbb3468c2012bdf920b8c09dfdb655f3e1369ea9465228e505f1d1de3aef9ec9757d7b501c4091c3ff7859f57d2ca646430b4e5cf0e5292ab602b0fb28f654
- SSDEEP 6144:/3eshJ2mAOSiLZh4CPIKBZW7ZN7o8PDj6QN9Q1xipM8QHxwM4Dngzi:feshYbDi1OwDW9Ns8PDjxQ1x8MjR6Dnz
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/g2m.dll
File Explorer
-
vm.zip.zip 290KB
-
data.bin103KB
-
g2m.dll.dll 389KB
-
runvm.bat49B
-
vm.exe.exe 39KB
data.bin
- SHA256 1d6c79dfff9e47928457c86cdefaeaab185b3476fd3f568ad668252cd53f8877
- MD5 3d5a228a61fc2fbfafb6d63a6f6c77a7
- SHA1 d76ddcbb0eef778f5c72b628a5696b8f67edd32c
- SHA512 1b04bca4c65377b406e04a8267cab9b5d853b5e339a3b2aec6eceb70a8c3a64cba5de390193f9cc0dd26a7b57a0c520622dae9dfaf2eb3202c7eaa3d48da5cd5
- SSDEEP 3072:8cK8hPo9OmXlpd2zSAaSJAMCjOnjTaGcAXb87:8toOhl2mAaSOFIT6AXw7
- MD5 SHA1 SHA512 SSDEEP
g2m.dll
- IMPHASH e9d136b97ed9d9b33a8dd745831e8044
- SHA256 e9f6dc3f1bd84642326784c7eb700125b548aa9522ad35eaf36903fbb1b5650e
- MD5 640c7c7efae54cc8db95b07151c1e70d
- SHA1 f5b6b37f8940a558cd0c4a5bc5bd8a668a4e61aa
- SHA512 694273fec690b2751a36b964679d3df58a4a66689bb507db20a0beef743f983b36a46589d6642eef1e625478d523186d84436028e23c833a601908d9cade73a9
- SSDEEP 6144:OXF8n/X2S6WUvk9pMT2/JBTe/h3/DdEG2nAOhn73i4:O6/76Tk3JBTmqAOk4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
165650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
rust_dave_sideload.pdb
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
kernel32
VirtualAlloc
GetModuleHandleA
GetProcAddress
CloseHandle
GetNativeSystemInfo
VirtualQuery
VirtualFree
VirtualProtect
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
HeapSize
FreeEnvironmentStringsW
GetLastError
SetThreadStackGuarantee
GetCurrentThread
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
Sleep
QueryPerformanceCounter
GetCurrentProcess
RtlCaptureContext
ReleaseMutex
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetStringTypeW
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointerEx
SetStdHandle
GetConsoleOutputCP
WriteFile
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetStdHandle
GetCurrentProcessId
SetHandleInformation
TerminateProcess
HeapFree
LCMapStringW
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
lstrlenW
CreateMutexA
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
ReadFile
GetModuleHandleExW
GetConsoleMode
GetFileType
LoadLibraryExW
FreeLibrary
TlsFree
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
CreateThread
GetFullPathNameW
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwind
RaiseException
InterlockedFlushSList
DecodePointer
ws2_32
listen
WSAStartup
getaddrinfo
WSASocketW
WSAGetLastError
closesocket
freeaddrinfo
bind
WSACleanup
ntdll
RtlNtStatusToDosError
NtReadFile
NtWriteFile
DllMain
g2mchat_winmain
g2mcomm_winmain
g2mfeedback_winmain
g2mhost_winmain
g2minstaller_winmain
g2minsthigh_winmain
g2mlauncher_winmain
g2mmatchmaking_winmain
g2mmaterials_winmain
g2mpolling_winmain
g2mqanda_winmain
g2mrecorder_winmain
g2msessioncontrol_winmain
g2mstart_winmain
g2mtesting_winmain
g2mtranscoder_winmain
g2mui_winmain
g2muninstall_winmain
g2mvideoconference_winmain
g2mview_winmain
Name
.text
Size
219KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
80KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=29395,
count=138, id=261, version=29395,
count=20, id=260, version=29395,
count=20, id=259, version=33731,
count=16, id=260, version=33731,
count=31, id=261, version=33731,
count=183, id=1, productName=Unmarked objects,
count=3, id=260, version=33812,
count=34, productName=Unmarked objects (old),
count=1, id=256, version=33812,
count=1, id=258, version=33812,
runvm.bat
- SHA256 ac2103023d146e62c3b708384ae0ed044d17258901272068ef93c15c9f5aa06e
- MD5 1ab4dc21dcb24f5b7345ce5c0b794b82
- SHA1 18f722ad31ee9d81181f8ca2cef60a70b03bb030
- SHA512 83f1d566b8f5b7875811762433cf7c2722225c789a3b917b2c4184a442d9d6af9c6fe703ce354d223824cfe8ed86e6e7780ec02008c093298fbcd3c08840dbdd
- MD5 SHA1 SHA512
vm.exe
- IMPHASH 6eb9cccf95968b8becec4c870f1101db
- SHA256 796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5
- MD5 f1b14f71252de9ac763dbfbfbfc8c2dc
- SHA1 dcc2dcb26c1649887f1d5ae557a000b5fe34bb98
- SHA512 636a32fb8a88a542783aa57fe047b6bca47b2bd23b41b3902671c4e9036c6dbb97576be27fd2395a988653e6b63714277873e077519b4a06cdc5f63d3c4224e0
- SSDEEP 768:YRQnUhG5bZDOTpkdD82YbQkRFokFWIILPUh:FWObZDOTpk5T6zqAh
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a9:67:63:96:99:c5:5b:7e:88:69:58:46:cb:9b:f7:d1:bb:bf:20:aa
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Citrix Online,OU=Operations+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Citrix Online,L=Fort Lauderdale,ST=Florida,C=US
Chains
Nov 14, 2012
Subject
CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US
Serial Number
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 1, 2012 - Dec 31, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Citrix Online,OU=Operations+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Citrix Online,L=Fort Lauderdale,ST=Florida,C=US
Serial Number
5c:5f:2b:a5:c9:99:4b:e5:ef:25:4f:fe:51:12:88:e1
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 30, 2012 - May 1, 2014
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb
g2m
g2mcomm_winmain
kernel32
GetModuleHandleW
GetCommandLineW
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetStartupInfoW
ExitProcess
user32
MessageBoxA
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,