grub2win.zip
- SHA256 91030e3071815acc22df5b32d3c4016c73fde9079fe1de4d4df006b3a13b8316
Behavioral task
behavioral1
Sample
grub2win.zip
Resource
win7-20240704-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
grub2win.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
G2WInstall.exe
Resource
win7-20240708-en
windows7-x64
27 signatures
150 seconds
Behavioral task
behavioral4
Sample
G2WInstall.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral5
Sample
out.exe
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
out.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target grub2win.zip
- Size 1.5MB
- Sample240802-2gqdmatbjm
- SHA256 91030e3071815acc22df5b32d3c4016c73fde9079fe1de4d4df006b3a13b8316
- MD5 2942d6a06f644c1022657b06b4ce1dda
- SHA1 9bf533b8a4c11fb66b279efb23710652f54c765e
- SHA512 0da62c397a4ed396d83043fb34b164c779b504808e9eccfdf0229bf5f95a32923644cc0cc173cdc739021b20b8aef0a7e4c7bd1a84354a99aabd4f13ef510605
- SSDEEP 24576:QX5VEf8HScRX6Wo4jVd8TvqNqVJxYoVl4nwzFE7+MOua8kKZ6SEc2RLNNWh838Rn:QXvQ8rrwTNvPySFE7+5uzPISEnfmS86g
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/G2WInstall.exe upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx
File Explorer
-
grub2win.zip.zip 1.5MB
-
G2WInstall.exe.exe 1.5MB
-
out.upx.exe 2.0MB
G2WInstall.exe
- SHA256 882f45617f97daf5cf043c80c55f163d459f17f1cf1b54500a89049a53017ffd
- MD5 0f56558f732250c89091efb6fb8fec39
- SHA1 89088ca60f12bec36eb44a85fdd98f2a403d0a76
- SHA512 15bad4035e08d68a56844ee4e5cf8d9d6a07f80347403b8b3d375c2383adf05d0a8668addf5ade5dc3a9034a2e96747c63779e05a011cca716401e6c5a1fa706
- SSDEEP 24576:1f+iN57Gtene3wBjbw/oVnxYodjKPsfFYP4AOuma42ZeAoQ2RZzp4h8pQvw4A1/X:xLXKtene3wBjxv5M4FYP4VuXpAAozjs+
- MD5 SHA1 SHA512 SSDEEP
Digest
ca:7d:d4:2e:7b:87:62:24:2c:a0:ef:dc:1f:ec:90:9c:48:59:38:af
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=David Pickens,O=David Pickens,ST=New Jersey,C=US
Chains
Aug 1, 2024
CN=David Pickens,O=David Pickens,ST=New Jersey,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=David Pickens,O=David Pickens,ST=New Jersey,C=US
Serial Number
90:0f:e0:ca:fb:0c:78:5b:32:d8:33:d4:07:91:5c:b6
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 29, 2021 - Dec 28, 2024
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Minor OS version
1
Major OS version
5
Entry point
2103376
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
371KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 0585f6091f6e757faed8694f2282eab2699c7b181c2e09e8d60b865482f1b561
- MD5 a961d4eeb80448b4f7dd3f245244c297
- SHA1 0d7ac89e0b15593a96e6c0a715ee5061d52c6396
- SHA512 ee82b22aa168a045e43c404f3cc5c00ddd82ca95925e7aa3b437aba9fedd145022e6a20f571677ddcb2ceea4cb7559d8b8780d47a3a775fa80a63f69e3e788fa
- SSDEEP 49152:6PVt/LZeJbInIkjxv5M4FYP4VuXpAAozjsEQ4l/a:oTYbInIkjh5MJQVoAAkjddS
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132343
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,