MDE_File_Sample_b1a64a013a18f1eefa6b58e65be4322255b8d735[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

MDE_File_Sample_b1a64a013a18f1eefa6b58e65be4322255b8d735.zip
Size

599KB
MD5

7d1f3dde76c18c1bd8bac3c8ceb1afc2
SHA1

d029f23c1b38e8d189d20500aeff7bd588057a95
SHA256

5d335b1fb4b6552b3e6feda3e1590c0f6ba7f85e9c774dcfa04bf1b952993b7d
SHA512

b2bb0d5162cc5e5b682eaae44ad9f3272ea42c91ee6599df5449175c5f5743e0277da8f78dd01a174905fce22fb0f6b129870fa49d48f1bdc18a19736d1c9d71
SSDEEP

12288:PCj2h5zEZceJBBaEXYep+EpkqZ9a1jZhkB25xijWs:PphlGlJ2D2+EB9aJZlwjWs

Score

1^/10

Malware Config

Signatures

Files

MDE_File_Sample_b1a64a013a18f1eefa6b58e65be4322255b8d735.zip
.zip

Password: infected
WECPSetup.exe
.exe windows:1 windows x86 arch:x86

Password: infected

Code Sign

04:7a:53
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03-03-2009 12:53

Not After

03-03-2024 12:53

Subject

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

39:a4:16:f8:ff:a5:e4:8b:14:7a:db:e0:62:e6:3c:90
Certificate

Issuer

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

14-11-2013 10:54

Not After

14-11-2014 10:54

Subject

CN=Open Source Developer,OU=Software Publishing,O=Open Source Developer,C=PL,1.2.840.113549.1.9.1=#0c1461646d696e406d65646961636f6465632e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f9:79:11:09:34:f3:11:3b:c7:2c:6a:dd:14:80:21:a2:78:97:a6:b0
Signer

Actual PE Digest

f9:79:11:09:34:f3:11:3b:c7:2c:6a:dd:14:80:21:a2:78:97:a6:b0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Code Sign

04:7a:53Certificate

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

39:a4:16:f8:ff:a5:e4:8b:14:7a:db:e0:62:e6:3c:90Certificate

Extended Key Usages

Key Usages

f9:79:11:09:34:f3:11:3b:c7:2c:6a:dd:14:80:21:a2:78:97:a6:b0Signer

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 36KB - Virtual size: 35KB

DATA Size: 1024B - Virtual size: 584B

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 2KB

.rsrc Size: 38KB - Virtual size: 37KB

04:7a:53
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

39:a4:16:f8:ff:a5:e4:8b:14:7a:db:e0:62:e6:3c:90
Certificate

f9:79:11:09:34:f3:11:3b:c7:2c:6a:dd:14:80:21:a2:78:97:a6:b0
Signer

CODE
Size: 36KB - Virtual size: 35KB

DATA
Size: 1024B - Virtual size: 584B

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 38KB - Virtual size: 37KB