Antivirus Fix(1).zip
- SHA256 806be4c0c7c6c84dbbc80357f70d623f3f01511b11786dc11a7cfeb5dd709f0e
Password
1
Overview
overview
7Static
static
7Antivirus Fix(1).zip
windows7-x64
1Antivirus Fix(1).zip
windows10-2004-x64
1Antivirus ...gs.vbs
windows7-x64
3Antivirus ...gs.vbs
windows10-2004-x64
1Antivirus ...Me.txt
windows7-x64
1Antivirus ...Me.txt
windows10-2004-x64
1Antivirus ...ol.exe
windows7-x64
7Antivirus ...ol.exe
windows10-2004-x64
7out.exe
windows7-x64
out.exe
windows10-2004-x64
Antivirus ...ol.ini
windows7-x64
1Antivirus ...ol.ini
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Antivirus Fix(1).zip
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Antivirus Fix(1).zip
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Antivirus Fix/Defender_Settings.vbs
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Antivirus Fix/Defender_Settings.vbs
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
Antivirus Fix/ReadMe.txt
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Antivirus Fix/ReadMe.txt
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Antivirus Fix/dControl.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
Antivirus Fix/dControl.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral9
Sample
out.exe
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
out.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Antivirus Fix/dControl.ini
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Antivirus Fix/dControl.ini
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Antivirus Fix(1).zip
- Size 447KB
- Sample240903-dvvcqsxbng
- SHA256 806be4c0c7c6c84dbbc80357f70d623f3f01511b11786dc11a7cfeb5dd709f0e
- MD5 246badd1ad835307cb7e9ee34fe71b91
- SHA1 5ac034bd84ce3ead0a79f0f76f2d3ec376150d4f
- SHA512 c2cc30f5b342cf4e1f00e5285fda4a5c369b5afb1220de1cfe8206c5a7f86964f3062409fc13f8bc63db885d00d94dc124084341d74c95a55747f8ca5560279a
- SSDEEP 12288:saTVlTTS9ly5/HkK3U9YkQ2wrjNqn1vJCiPIRURD6iE/gwnI1p:sa60HkACYqj11P9RGfe
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Antivirus Fix/dControl.exe upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx
File Explorer
-
Antivirus Fix(1).zip.zip 447KB
-
Antivirus Fix/Defender_Settings.vbs.vbs 313B
-
Antivirus Fix/ReadMe.txt2KB
-
Antivirus Fix/dControl.exe.exe 447KB
-
out.upx.exe 653KB
-
Antivirus Fix/dControl.ini85KB
Antivirus Fix/Defender_Settings.vbs
- SHA256 af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9
- MD5 b0bf0a477bcca312021177572311e666
- SHA1 ea77332d7779938ae8e92ad35d6dea4f4be37a92
- SHA512 09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8
- MD5 SHA1 SHA512
Antivirus Fix/ReadMe.txt
- SHA256 d3b0219253a58ccb394559751299bd16dba1120e02cb11571c3b6a085b1027f8
- MD5 8dbe87a9bf6342c4e2ea406fa86e76bb
- SHA1 35fe083b3f5793fe1b803d091262e4dee2cd0c4d
- SHA512 3fca076f1c6fe286bef4d211fad2643e2c2e426d75e665c1a1c8dd241689fbd3911544b90f65e0b2ab25ce0ff63fc5520684ff7c1c2fb71be9cda6359a8b1c8e
- MD5 SHA1 SHA512
Antivirus Fix/dControl.exe
- SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
- MD5 58008524a6473bdf86c1040a9a9e39c3
- SHA1 cb704d2e8df80fd3500a5b817966dc262d80ddb8
- SHA512 8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
- SSDEEP 6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
- MD5 SHA1 SHA512 SSDEEP
Password
1
PE Signature issue
Digest
13:f6:ef:3f:06:29:49:56:6c:21:59:e0:0c:ac:6f:83:24:95:fa:e4
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Sordum Software
Chains
Aug 22, 2024
Subject
CN=Sordum Software
Serial Number
69:98:6c:80:0a:7c:5b:8e:47:86:45:a0:3e:86:d5:40
Issuer
CN=Sordum Software
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 11, 2021 - Jul 31, 2030
Subject
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 31, 2021 - Sep 17, 2029
Subject
CN=Certum Timestamp 2021,O=Asseco Data Systems S.A.,C=PL
Serial Number
f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Issuer
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 19, 2021 - May 18, 2032
Subject
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 19, 2021 - May 18, 2036
Minor OS version
0
Major OS version
5
Entry point
775760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
492KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
262KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
57KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 481e03978ca339ce697252895efe89b09fefd3098ad247d24eeb6cca9969f553
- MD5 6970ea0b6597dcd5b4f5f19f28e958a8
- SHA1 a0130bb7ac03ec4799c90781ca93fd1392c6d54c
- SHA512 bc95cbe9a050e3d3b713745ef399bf2817d38f8e019f6edffdd2bf755badbde766e434e39a7f32356125bba0692b694c18da8dd0762aac0c9430d45acb215e01
- SSDEEP 12288:nkxDoouVA2nxKkhEvdRgQriDJOIlW+yBGQowlNCWS:RRmJkioQrilOIc+yMx
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
514KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Antivirus Fix/dControl.ini
- SHA256 8e9a84da243905685ca77b6ef71841e610b88b7963d4de59f6dcbdd1621ecacd
- MD5 05450ff06366ae22654b63a6e27d1624
- SHA1 11453c370f41287fb6339e509bb9d3c91842b379
- SHA512 ee0a9605b566aa89c8c9b260e1d9c15aecbd6cddc2df47fe24ef2cafbe8923b3e025bd5cd3d34499292589a3c094dd796ab4560c8099bad2051a54928c37b4b2
- SSDEEP 768:i/G+NmPfjsxaxdk2akexodULxEQq1wIgC+AEbSr6:1+NyjsxkKdkJdULgbWSO
- MD5 SHA1 SHA512 SSDEEP