client[.]rar | Triage

Resubmissions

23-08-2024 01:55

240823-ccb8rszamd 3

Sharing

Copy URL

Twitter E-mail

General

Target

client.rar
Size

754KB
MD5

f442ea50b26c1018cbf66ad01530b69a
SHA1

ae2ba42b797dbdb857eb1d0a93456fd0bc5bfaad
SHA256

304a7b1bdd1fc589fe88a345a1c2e2360206b7ef8fece50ac9a86d0d105c8c20
SHA512

44848d1b5ae0e0b3ac42b87599a9c5a5de67d267a8440e3dca85a17083ee55908ef9394f16b5273064f3985f04dc1d561afaf68d0ebdcb7862ecfcade5988610
SSDEEP

12288:AE05Vfe/OgqMUH1QtMq9QgOivjLNgzBuIPsWT57XFPVUmPZEC9XAhEfw56E7:AH2HqfH1Qd6gO93sAVPe0KN56E7

Score

1^/10

Malware Config

Signatures

Files

client.rar
.rar
client/UltraVNC.ini
client/main.bat
client/winvnc.exe
.exe windows:6 windows x86 arch:x86

e3202ccfbc2c29f2d1de3ad37f2488ee

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2031 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:30:2f:6c:9f:56:b5:a7:b0:0d:14:85:10:a5:a5:9e
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28-10-2019 00:00

Not After

01-11-2022 12:00

Subject

CN=uvnc bvba,O=uvnc bvba,L=Antwerpen,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:b2:04:a7:f1:e0:09:78:fe:2b:04:e6:1a:cd:51:46:75:7e:f0:44
Signer

Actual PE Digest

50:b2:04:a7:f1:e0:09:78:fe:2b:04:e6:1a:cd:51:46:75:7e:f0:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\rudi\Desktop\git_ultravnc\winvnc\Release\winvnc.pdb

Imports

ws2_32

gethostbyname
inet_ntoa
select
WSAGetLastError
setsockopt
WSACleanup
__WSAFDIsSet
accept
bind
WSAIoctl
closesocket
gethostname
shutdown
listen
WSAStartup
getpeername
inet_addr
getsockname
send
socket
connect
recv
getsockopt
htonl
htons

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
ExpandEnvironmentStringsForUserA

kernel32

Process32First
WriteFile
OutputDebugStringA
WaitForMultipleObjects
WaitForSingleObject
CreateFileW
GetSystemDirectoryW
CreateToolhelp32Snapshot
lstrcatW
Process32Next
LoadLibraryW
GetCurrentProcessId
CreateEventA
WaitNamedPipeW
GetExitCodeProcess
GetEnvironmentVariableA
SetCurrentDirectoryA
SetFileAttributesA
ResumeThread
ResetEvent
CompareFileTime
CreateFileA
GetFileSize
GetFileTime
GetStdHandle
WriteConsoleA
FreeConsole
FormatMessageA
AllocConsole
GetExitCodeThread
MoveFileA
GetDriveTypeA
SetFileTime
SetErrorMode
SetFilePointer
SetEndOfFile
GetFileAttributesA
MoveFileExA
FileTimeToSystemTime
GetLogicalDriveStringsA
SystemTimeToFileTime
CreateDirectoryA
GetSystemTime
FlushFileBuffers
TerminateProcess
VirtualAllocEx
ReadProcessMemory
SetThreadExecutionState
VirtualFreeEx
TerminateThread
SizeofResource
FindResourceA
LockResource
LoadResource
CreateMutexA
ReleaseMutex
GlobalGetAtomNameA
GlobalDeleteAtom
VerSetConditionMask
GlobalAddAtomA
SetLastError
GetVolumeInformationA
FreeLibraryAndExitThread
ExitThread
GetFullPathNameW
GetCurrentDirectoryW
GetCurrentDirectoryA
SetEnvironmentVariableW
SetEnvironmentVariableA
GetCPInfo
SetStdHandle
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
GetModuleHandleExW
ExitProcess
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
LoadLibraryExW
EncodePointer
RtlUnwind
OutputDebugStringW
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateSemaphoreA
TlsFree
TlsGetValue
TlsAlloc
GetCurrentThread
DuplicateHandle
SetThreadPriority
ReleaseSemaphore
TlsSetValue
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SwitchToThread
GetFileType
lstrcatA
lstrcmpiA
lstrcpynA
DosDateTimeToFileTime
GetLocalTime
FileTimeToLocalFileTime
SetVolumeLabelA
LocalFileTimeToFileTime
GetVersion
GetLocaleInfoA
GetFullPathNameA
lstrcpyA
ReadFile
SetProcessShutdownParameters
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
CreateFileMappingA
WritePrivateProfileSectionA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStructA
WritePrivateProfileStringA
WritePrivateProfileStructA
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
WinExec
GetComputerNameA
GetProcessHeap
HeapAlloc
GetSystemInfo
GetSystemDirectoryA
lstrlenA
HeapFree
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
FreeLibrary
DeleteFileA
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetProcessTimes
GetSystemTimeAsFileTime
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
GetCurrentProcess
EnterCriticalSection
GetVersionExA
SetEvent
GetLastError
OpenProcess
OpenEventA
CreateThread
CloseHandle
VerifyVersionInfoW
Sleep
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetCurrentThreadId
GetModuleFileNameA
GetTickCount
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
GlobalSize
MultiByteToWideChar
EnumSystemLocalesW
GetStringTypeW
WriteConsoleW
HeapReAlloc
GetUserDefaultLCID
CreateDirectoryW
DeleteFileW
GetFileAttributesExW
SetFileAttributesW
MoveFileExW
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
RemoveDirectoryW
HeapSize
GetACP
GetModuleHandleW

user32

CheckDlgButton
SetDlgItemInt
LoadMenuA
GetMenuItemID
TrackPopupMenu
GetSubMenu
SetMenuDefaultItem
DestroyMenu
RemoveMenu
EnableMenuItem
EnableWindow
VkKeyScanA
GetAsyncKeyState
MapVirtualKeyA
ToAscii
SendInput
DestroyWindow
SetClipboardViewer
GetClipboardOwner
WaitMessage
PostThreadMessageA
ChangeClipboardChain
SendNotifyMessageA
PeekMessageA
IsWindowVisible
FillRect
GetIconInfo
GetClassNameA
WindowFromPoint
RegisterWindowMessageA
DrawTextA
FindWindowExA
OpenDesktopA
EnumDesktopWindows
SetRect
DrawIconEx
DestroyIcon
GetKeyboardState
PtInRect
SetActiveWindow
MessageBeep
FlashWindow
EnumDisplaySettingsExA
EnumDisplayDevicesA
ChangeDisplaySettingsExA
GetKeyState
keybd_event
EnumDisplaySettingsA
GetWindowRect
LoadStringA
ScreenToClient
IntersectRect
IsDlgButtonChecked
GetTopWindow
GetWindow
GetProcessWindowStation
GetDlgItemInt
GetScrollInfo
DialogBoxParamA
GetDlgItemTextA
SetWindowTextA
MoveWindow
SetFocus
SendDlgItemMessageA
SetDlgItemTextA
GetClientRect
GetDlgItem
SetForegroundWindow
InvalidateRect
GetCursorPos
ExitWindowsEx
GetWindowThreadProcessId
wsprintfA
SystemParametersInfoA
MessageBoxA
GetForegroundWindow
GetDesktopWindow
PostMessageA
SendMessageA
mouse_event
FindWindowA
GetMessageA
LoadImageA
DispatchMessageA
GetUserObjectInformationA
LoadCursorA
SetWindowPos
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
ShowWindow
CloseDesktop
SetTimer
SetWindowLongA
GetWindowLongA
AdjustWindowRect
DefWindowProcA
IsRectEmpty
CreateWindowExA
OpenInputDesktop
TranslateMessage
LoadIconA
KillTimer
PostQuitMessage
RegisterClassExA
GetDC
ReleaseDC
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
RegisterClipboardFormatA
OemToCharA
CharToOemA
wvsprintfA
EndDialog

gdi32

GetBitmapBits
SetDIBColorTable
GdiFlush
SetTextColor
SelectPalette
CreatePalette
SetBkColor
CreateFontIndirectA
GetObjectA
ExtEscape
GetSystemPaletteEntries
SetRectRgn
OffsetRgn
DeleteObject
DeleteDC
GetPixel
GetDeviceCaps
GetDIBits
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap
BitBlt
CreateDCA
CreateSolidBrush
SetBkMode
GetClipBox
GetStockObject
StretchBlt
PatBlt
GetRgnBox
CombineRgn
PtInRegion
GetRegionData
RealizePalette
CreateRectRgn

advapi32

GetSecurityDescriptorLength
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
IsValidSid
IsValidSecurityDescriptor
GetKernelObjectSecurity
SetKernelObjectSecurity
IsValidAcl
GetUserNameA
LookupAccountSidA
SetSecurityInfo
RegCreateKeyA
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
CreateServiceA
StartServiceCtrlDispatcherA
QueryServiceStatus
RegDeleteKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
DeleteService
AdjustTokenPrivileges
SetTokenInformation
LookupPrivilegeValueA
DuplicateTokenEx
RevertToSelf
EqualSid
AllocateAndInitializeSid
ImpersonateLoggedOnUser
FreeSid
GetTokenInformation
EnumServicesStatusA
CloseServiceHandle
QueryServiceConfigA
OpenSCManagerA
OpenServiceA
CreateProcessAsUserA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
OpenProcessToken
RegOpenKeyExA
RegDeleteValueA

shell32

Shell_NotifyIconA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHFileOperationA
SHGetMalloc
ShellExecuteA
ShellExecuteExA

ole32

CoUninitialize
CoCreateInstance
CoInitialize

imm32

ImmGetDefaultIMEWnd

Exports

Exports

adler32
adler32_combine
adler32_z
compress
compress2
compressBound
crc32
crc32_combine
crc32_final
crc32_init
crc32_update
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
inflate
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
uncompress
uncompress2
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 416KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 511KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 763KB - Virtual size: 762KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

e3202ccfbc2c29f2d1de3ad37f2488ee

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77Certificate

Key Usages

01:30:2f:6c:9f:56:b5:a7:b0:0d:14:85:10:a5:a5:9eCertificate

Extended Key Usages

Key Usages

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

50:b2:04:a7:f1:e0:09:78:fe:2b:04:e6:1a:cd:51:46:75:7e:f0:44Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

version

userenv

kernel32

user32

gdi32

advapi32

shell32

ole32

imm32

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 416KB - Virtual size: 416KB

.data Size: 7KB - Virtual size: 511KB

.rsrc Size: 763KB - Virtual size: 762KB

.reloc Size: 48KB - Virtual size: 48KB

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

01:30:2f:6c:9f:56:b5:a7:b0:0d:14:85:10:a5:a5:9e
Certificate

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

50:b2:04:a7:f1:e0:09:78:fe:2b:04:e6:1a:cd:51:46:75:7e:f0:44
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 416KB - Virtual size: 416KB

.data
Size: 7KB - Virtual size: 511KB

.rsrc
Size: 763KB - Virtual size: 762KB

.reloc
Size: 48KB - Virtual size: 48KB