KRISTIN's+2023+Organizer+ExtensionPDF[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
KRISTIN's+2023+Organizer+ExtensionPDF.zip
Size 41.3MB
Sample240814-gvbgeasflk
SHA256 4b0034a2e86bf558c75772bbeb8a538f1b3f6574227b5dbf8374eaa4046637c7
MD5 5c967cda0ba79bb41406b8c503817657
SHA1 97f1da7e60cee2e21e819c3f84f56dbba81ac522
SHA512 5efd2b88d5c771f23b7624da56aa7daaed301ce8bad236ac6108006ddf01049cd6bf18089917b688d397e9bfdc8c5abca30cd7ea83edbc86a67eeb6cdfaabb06
SSDEEP 786432:RNtA6KVqCBx1Ow1JAHRq/86q5KgkIVMRC1iJV9ieKfz8VTg694tb4/rdycVw3NcP:vtA64x1OwHTqh3M4sJV9iug6ub4AcVck
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/msimg32.dll

File Explorer

KRISTIN's+2023+Organizer+ExtensionPDF.zip

.zip 41.3MB
1099.e

.pdf 40.8MB
TAXORGANIZERpdf.exe

.exe 1.7MB
msimg32.dll

.dll 2.0MB

KRISTIN's+2023+Organizer+ExtensionPDF.zip

SHA256 4b0034a2e86bf558c75772bbeb8a538f1b3f6574227b5dbf8374eaa4046637c7
MD5 5c967cda0ba79bb41406b8c503817657
SHA1 97f1da7e60cee2e21e819c3f84f56dbba81ac522
SHA512 5efd2b88d5c771f23b7624da56aa7daaed301ce8bad236ac6108006ddf01049cd6bf18089917b688d397e9bfdc8c5abca30cd7ea83edbc86a67eeb6cdfaabb06
SSDEEP 786432:RNtA6KVqCBx1Ow1JAHRq/86q5KgkIVMRC1iJV9ieKfz8VTg694tb4/rdycVw3NcP:vtA64x1OwHTqh3M4sJV9iug6ub4AcVck
MD5 SHA1 SHA512 SSDEEP

TAXORGANIZERpdf.exe

IMPHASH 0b689c0405188147290da806ecca7d60
SHA256 a7dbbad8a1cd038e5ab5b3c6b1b312774d808e4b0a2254e8039036972ac8881a
MD5 30307b319b2451b6bf61d3e6b232f1da
SHA1 6a512848872be1325761e7ca110e0a1ee91cb0ef
SHA512 7833ecb30a75324af6852e3583a609a653652f3cda9037ace7a1098ce7e52ed4b994c5ff1a0a0b4db748a01b06e8d4b8a10a50ebb9c0d4fbc8aa12dd1168f0b7
SSDEEP 24576:17AMY27PG+4VWz3zYxQ2IQKbvavAyoVVxPuOcabAC9fH6lJUkwJYaTTgKmfa8+:Nwj+4VWnoqSkHNckbfH6lJ2XgKmf+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

51:fd:4b:0e:34:95:e7:ad:47:56:7a:a4:ab:00:b4:3c:b8:8f:cd:01

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Armjisoft DRM Systems,O=Armjisoft DRM Systems,POSTALCODE=59200,STREET=Jalan 112H. Off Jalan Kerinchi+STREET=3A-8-2\, Pantai Panorama,L=Kuala Lumpur,ST=Kuala Lumpur,C=MY

Chains

Apr 25, 2013

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Armjisoft DRM Systems,O=Armjisoft DRM Systems,POSTALCODE=59200,STREET=Jalan 112H. Off Jalan Kerinchi+STREET=3A-8-2\, Pantai Panorama,L=Kuala Lumpur,ST=Kuala Lumpur,C=MY

Serial Number

f1:6e:1e:e0:c0:70:b5:29:ef:b2:69:b6:61:74:0a:d3

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 22, 2012 - May 22, 2013

Minor OS version

Major OS version

Entry point

1934620

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

o��-��e��|��O,��r:��}�� 9�)�%�Ʀ>�ʒ��b�@�@y�oiM��I b{5x^P�zq�1��t�i<�p��p�<�HQD�D��黈z��y2E��R��#6��5[�y�p�܂�4��6p�>��}��R.-��k "��,��&5Z�:&��T�<e�v��sD̖0Q�Q�O�_JU��ۨWҍ�G��q��)� �n��Aλxxi�K�^{�q�`j�fkS�y��+$��Ig/��Ǿtxx�)��N��-2�5ܖI�lMB�E��`Ph��=j�>y��eNZ�R�)�� G��i�l��l�X�^��;��f�j'0��l0��V>��ɡ�>$�5n��x �db��8ot� �E��!��A��\��C��(�2�[�8O�jSR6�OF�U�5x��C]�l7+��Ѱ�k�F.8w��PO��ˇ�<q�� l��ʮ��ޢ��Qw#+��Ų\��|��~ixX��4Ij/��XY.`�4�7��3��!��K�թ{��Ec5kN�y�Şb =v��v��g��dy�R�w��1��<E^hc��啲��<��Xb�Qs��m{RI��^�d��)�j>��`��Ռ��+R�)� ,6M�DE1��z�d�X�&\]6��T~_rb��?S�L�0N�E�E��r�K�<��٣��m�"�%{Dx�撙w�o��$�sa{X�po��!i�~��Df�O-=�Zp�)Fz�� `�ɑ~�֟��M!��I��Hq,L�w �11�̎�vؓ��e��j�џC�":��bF4(]��;�eF��$_'TG`% c>��o �o8R��Laˆ��ҝ!�'�w2>�_P��g��Q!�p 3�Y%??@N@�5_�aٝ��Te<�6�F�c��I&/�W��P2�zw��k8X��o �B�]��Rg�.�h�ąC��b޳ih�;U��/� &t�М�F�C��3��ޯT��8�C4��`i�cjU��O�&��(L�� O��s��A_��-�}P��m��H��e�7V��-r�9r!ɀ*|��Ϲ��ED�F��}��"��S)��0<M��#J:Ќ��J'�I�]��n�9��t�m��l�#w�X��$��[̳��0�._lC�J��7�#SdE��B�JL|�e�3�#� ʞ+[Z�\f��\��s� ̛��QDd�iʓ�W�9�T[� $ �YE`�� E� �0�.k&'o�y��Հ�ϳ��J��;v'a��6M��5]�߷g"5�Y��R�ZJ��~%�ه �ޯ�-E��e(��(��i��wQ��1�VŲhy��m��ӽʳ��̗Iv�}��V�m%g Kg�U}:��嚃��D��l�~~i1e�-�ϟ��u{1D{4��I�f��A��o�1��e$��\�X��lo>Au�I� �p��ՊP{H��z*��D,]D�o.��ɒC��7��^��JRFBu��ד�U�V]O�u�m��O]T�ߘ��5�+n᧓栞��F��M8m짲&��HD��g|�g��F!��X8@��Drg�m�Q�7K0$��2��MV�O� @A�K�*A��Rj�� g��ߊQo[��*��wU�l�;��)��q*�/Ey�R�(S��G�]��nZ�l=u�c��DS��(M��h��Y��E�H\��j�fi8�&� �).��E�ǡ��}�Zi��c�ֿ�u��! ��4�y�a�~�a�;��Pb��W��9�#��fy= WI�^��~0��SVu��Hm��-�\�la�7@��bq��J>I<��2h�_��S��4��~�ғ��/�J6}pl ��?�:��[�K1�p4JL�.1r`�W�g��S+�{I<�ʮ��Ma+�E��,+ǫ�US��}:�id��q��"<?�V��;s$vM ��zR�b6�bѼ��x_o.3`YJ��um�8|��t1C�w��F�U9:��B�x��TY/wpݴ��k)c�\�"�wt|yVCI��!n52L�<� +�,�U��4��gP�=��H�W��5�I�5%Ԭs�h!�%��~;��b�xɎ�,1��ۊ��E�Q�T=B��|WD<x\H��eh�qˈ+�˪�AC��e�u�ɰf3�?6�Y>rێ��1��2)��-c�fA��}!��C)�c^�d0��?�J"E��(��N�`B��9��o��흖��g��.�� '��%��x�z�5��0��?��f+��6�}�cV�B�d>��o�˳"?&�u�>e9��E `\�b��7|(J;��*�(q��B�Q��:��NG��y�bg7�K�i��wD�1R��H]g.};��ch�j�9D� ;B��.�.]�c��ș�hY"��2�� ϊ�X�4�x�q6�D �f�bo[1�t��5�VI�%��M��9�sN�R)�Զ{�s��y�G8��tR@8��5��:��y�0eC�k�xz�@5�Bfw��o�d;�� 5�Q��b�[j��r1��{oܲ�b\'C#��K�d�t a��Δ��}<\ ��R��l08�T7��!��t�¿�"@��t35�V�?P�� !O ��7�7�v�5��},El��@��1��ʹӐ-��c9��1�Ќ�x�c�_�텾��;�Ǘ�h|�\��te�w�� G�eW �%�ƛ��õ��̰V�׺��1&Ӹ�� X��"W��S�1J� ��O1��n|��x��Gp

Name

.text

Size

Virtual Size

442KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

CODE

Size

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DATA

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

287KB

Virtual Size

287KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

msimg32.dll

IMPHASH 7b5d177b063b76d3393869008338136a
SHA256 b670e59f539f07cfa6e43d69a9792f1fa38cf6dbdd92bca0db08511727e9308d
MD5 0053dea750b34089a1de8d10d18a9528
SHA1 e47bae9334a3cbeb1491756bb117e75882507bb6
SHA512 cc1c2c8181a9604b93cafe7c255a1002454e90fa8c9bf5eb07be5868e331412895314c1e9ba970f8abf0f338aeb14b4211dbd18653e0e880dc9518a35da68c28
SSDEEP 49152:Mp1wTHyQhBCMsvEq0eBiDw0uJDHufr4/6B7uvRKtIe3/D92K6xZG5f+WFFynVsuf:01wTHF5svP7YDw0kwk2q
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

676727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msdia140.pdb

kernel32

SetLastError FindResourceExW LoadResource LockResource SizeofResource MultiByteToWideChar LoadLibraryExW GetProcAddress LocalAlloc LocalFree GetModuleFileNameW GetLastError GetSystemInfo InitializeCriticalSection DeleteCriticalSection LCMapStringW UnmapViewOfFile CloseHandle EnterCriticalSection LeaveCriticalSection CreateFileW GetFileSize CreateFileMappingW MapViewOfFile GetFileSizeEx RaiseException VirtualProtect VirtualQuery FreeLibrary GetModuleHandleW LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedFlushSList RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer GetFullPathNameW GetFullPathNameA SetStdHandle GetFileType SetFilePointerEx ReadFile GetConsoleMode ReadConsoleW ExitProcess GetModuleHandleExW GetModuleFileNameA WideCharToMultiByte GetACP HeapFree HeapAlloc GetStdHandle GetStringTypeW GetDriveTypeW WriteFile CompareStringW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap FlushFileBuffers GetConsoleCP GetCurrentDirectoryW HeapSize HeapReAlloc WriteConsoleW SetEndOfFile DecodePointer GetFileAttributesW SetFileAttributesW VirtualAlloc VirtualFree DeleteFileW DeviceIoControl ExpandEnvironmentStringsW MapViewOfFileEx

KRISTIN's+2023+Organizer+ExtensionPDF.zip

1099.e

TAXORGANIZERpdf.exe

PE Signature issue

msvbvm60

msimg32

gdi32

setupapi

cfgmgr32

user32

kernel32

advapi32

oleaut32

generic

msimg32.dll

kernel32

generic