opus[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

opus.zip
Size

129KB
MD5

773f5c994d33ce15427e26ab728d7b38
SHA1

0d44a2de6acf2c21743b256ff659f3497a4e6a8e
SHA256

63f92ee80e43893c4dc3ebd7b932cb2f01be9794222593a0612553612b67da8d
SHA512

84b20220950df95603d040d59849d26d0cf96f7aeb005c0054094d9c0a25b093fae12caef612affbf2762ac34c03dc3bcaf933820c5a9c335d6148e7bdea5bc3
SSDEEP

3072:zhmQRzGH0PLfmzx+vqus2cUt/KGZulCy4c/CO0nnnaM9zg:zhmlUPLfex+Sus2c4u8c/CLnHzg

Score

1^/10

Malware Config

Signatures

Files

opus.zip
.zip
README.txt
opus.dll
.dll windows:5 windows x86 arch:x86

030c4e55a9d5af668f3114234d875bfb

Code Sign

26:41:2e:2d:a0:ed:f1:61:5f:de:74:e6:aa:ea:ad:ba
Certificate

Issuer

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

27/12/2012, 22:08

Not After

27/12/2013, 22:08

Subject

CN=Open Source Developer\, Mikkel Krautz,O=Mumble - Open Source Developer,C=DK,1.2.840.113549.1.9.1=#0c106d696b6b656c406b726175747a2e646b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:00:20
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

11/06/2002, 10:46

Not After

11/06/2027, 10:46

Subject

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

04:7a:53
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:53

Not After

03/03/2024, 12:53

Subject

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:7a:55
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:58

Not After

03/03/2024, 12:58

Subject

CN=Certum Time-Stamping Authority,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

24:0b:1f:5e:d3:68:17:3f:e4:54:db:d5:b3:f0:22:6a:f7:43:d9:4c
Signer

Actual PE Digest

24:0b:1f:5e:d3:68:17:3f:e4:54:db:d5:b3:f0:22:6a:f7:43:d9:4c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\dev\jenkins\workspace\Mumble Windows x86\release\opus.pdb

Imports

msvcr100

_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
malloc
free
memset
memcpy
floor
_CIpow
memmove

kernel32

InterlockedExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
IsProcessorFeaturePresent
DecodePointer
EncodePointer

Exports

Exports

opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_encode
opus_encode_float
opus_encoder_create
opus_encoder_ctl
opus_encoder_destroy
opus_encoder_get_size
opus_encoder_init
opus_get_version_string
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_samples_per_frame
opus_packet_parse
opus_repacketizer_cat
opus_repacketizer_create
opus_repacketizer_destroy
opus_repacketizer_get_nb_frames
opus_repacketizer_get_size
opus_repacketizer_init
opus_repacketizer_out
opus_repacketizer_out_range
opus_strerror

Sections

.text
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

030c4e55a9d5af668f3114234d875bfb

Code Sign

26:41:2e:2d:a0:ed:f1:61:5f:de:74:e6:aa:ea:ad:baCertificate

Extended Key Usages

Key Usages

01:00:20Certificate

04:7a:53Certificate

Key Usages

04:7a:55Certificate

Extended Key Usages

24:0b:1f:5e:d3:68:17:3f:e4:54:db:d5:b3:f0:22:6a:f7:43:d9:4cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr100

kernel32

Exports

Exports

Sections

.text Size: 184KB - Virtual size: 184KB

.rdata Size: 18KB - Virtual size: 18KB

.data Size: 512B - Virtual size: 908B

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 3KB - Virtual size: 2KB

26:41:2e:2d:a0:ed:f1:61:5f:de:74:e6:aa:ea:ad:ba
Certificate

01:00:20
Certificate

04:7a:53
Certificate

04:7a:55
Certificate

24:0b:1f:5e:d3:68:17:3f:e4:54:db:d5:b3:f0:22:6a:f7:43:d9:4c
Signer

.text
Size: 184KB - Virtual size: 184KB

.rdata
Size: 18KB - Virtual size: 18KB

.data
Size: 512B - Virtual size: 908B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 3KB - Virtual size: 2KB