USB_Raptor_01988_%28Fig%29[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

USB_Raptor_01988_%28Fig%29.zip
Size

13.2MB
MD5

2be8592ccc344f3b5f0325215e8b2f7d
SHA1

6a428ded3869231726023c0e90e33404bd0c25ea
SHA256

9df173d5f745c9cf2a767ba7a19da6c4b5cb5b9d86b13eba0ae324c254608c44
SHA512

269c729910fc29d7ac6c03124a83cedb3a68037183db93eff0754c91c9d791493b35c83d19e7153e74a11f46a732d538f82a93466793c9d8305a85b7f5e33895
SSDEEP

393216:3kEKirdSJXuOCIvB4oe+0JRyRUKOD54/UmD6zsf61Ermw:+3Go+J4RgDwgzzErV

Score

3^/10

pdf link

Malware Config

Signatures

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/USB_Raptor_01988_(Fig)/Raptors Nest - LAN Status Utility/RaptorsNest.exe
unpack001/USB_Raptor_01988_(Fig)/USB Raptor - LCD Smartie Plugin/usbrptr.dll
unpack001/USB_Raptor_01988_(Fig)/USB Raptor Screen Saver (Engage USB Raptor)/USB Raptor Screen Saver.scr
unpack001/USB_Raptor_01988_(Fig)/data/Reg.data

Files

USB_Raptor_01988_%28Fig%29.zip
.zip

Password: infected
USB_Raptor_01988_(Fig)/Help Files/Example Custom Logos.zip
.zip

Password: infected
customimages/bouncing-footer-logo.png
.png

Password: infected
customimages/bouncing-logo.png
.png

Password: infected
customimages/unlock-logo.png
.png

Password: infected
customimages/vertical-logo.png
.png

Password: infected
USB_Raptor_01988_(Fig)/Help Files/USB Raptor Custom Logos v1.0.pdf
.pdf

Password: infected
USB_Raptor_01988_(Fig)/Help Files/USB Raptor Documentation v1.11.pdf
.pdf

Password: infected
USB_Raptor_01988_(Fig)/Help Files/USB Raptor FAQ.pdf
.pdf
Password: infected
- http://n.ve
USB_Raptor_01988_(Fig)/Raptors Nest - LAN Status Utility/RaptorsNest.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Dropbox\Dropbox\.Common\Development\VB14\USB Raptor\USB RaptorsNest\RaptorsNest\obj\Debug\RaptorsNest.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
USB_Raptor_01988_(Fig)/Raptors Nest - LAN Status Utility/Readme.txt
USB_Raptor_01988_(Fig)/USB Raptor - LCD Smartie Plugin/About usbrptr.dll (functions).txt
USB_Raptor_01988_(Fig)/USB Raptor - LCD Smartie Plugin/Info.txt
USB_Raptor_01988_(Fig)/USB Raptor - LCD Smartie Plugin/usbrptr.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Dropbox\Dropbox\.Common\Development\VB14\LCD_Smartie_Plugins\usb_raptor_plugin\usbraptorplugin\usbrptr\obj\Debug\usbrptr.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
USB_Raptor_01988_(Fig)/USB Raptor Screen Saver (Engage USB Raptor)/USB Raptor Screen Saver How To.txt
USB_Raptor_01988_(Fig)/USB Raptor Screen Saver (Engage USB Raptor)/USB Raptor Screen Saver.scr
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Dropbox\Development\VB14\USB Raptor\USB Raptor - Starter (Screen Saver)\ss\obj\Debug\USB Raptor Screen Saver.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 287KB - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
USB_Raptor_01988_(Fig)/USB Raptor.exe
.exe windows:4 windows x64 arch:x64

Code Sign

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

26/03/2019, 17:44

Not After

22/03/2034, 17:44

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:4f:4b:a2:5c:15:e3:bb:08:87:e8:b9:d1:ee:2b:ff
Certificate

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

04/04/2024, 13:37

Not After

04/04/2025, 13:37

Subject

SERIALNUMBER=1078191-6,CN=Advantium Consulting Inc.,O=Advantium Consulting Inc.,L=Oakville,ST=Ontario,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7
Certificate

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

19/02/2024, 16:18

Not After

16/02/2034, 16:18

Subject

CN=SSL.com Timestamping Unit 2024 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

13/11/2019, 18:50

Not After

12/11/2034, 18:50

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:b9:89:0d:79:19:e0:30:3d:61:db:e6:dc:b6:25:38:b5:89:e1:b5:bc:85:2e:cb:18:3c:87:db:29:f8:1c:ce
Signer

Actual PE Digest

3c:b9:89:0d:79:19:e0:30:3d:61:db:e6:dc:b6:25:38:b5:89:e1:b5:bc:85:2e:cb:18:3c:87:db:29:f8:1c:ce

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\source\repos\Sentinel\Sentinel\Sentinel\obj\x64\Release\USB Raptor.pdb

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
USB_Raptor_01988_(Fig)/USB Raptor.exe.manifest
USB_Raptor_01988_(Fig)/Version History.txt
USB_Raptor_01988_(Fig)/data/Reg.data
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\Nextcloud_New\Development\VB14\USB Raptor\Raptor\Raptor\Raptor\obj\Debug\USB Raptor.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 12.1MB - Virtual size: 12.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
USB_Raptor_01988_(Fig)/data/Reg.dll
.vbs
USB_Raptor_01988_(Fig)/more_settings.ini

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Password: infected

Password: infected

Password: infected

Password: infected

Password: infected

Password: infected

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rsrc Size: 112KB - Virtual size: 111KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 11KB - Virtual size: 11KB

.rsrc Size: 1024B - Virtual size: 972B

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 287KB - Virtual size: 287KB

.rsrc Size: 128KB - Virtual size: 127KB

.reloc Size: 512B - Virtual size: 12B

Code Sign

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04Certificate

Extended Key Usages

Key Usages

2e:4f:4b:a2:5c:15:e3:bb:08:87:e8:b9:d1:ee:2b:ffCertificate

Extended Key Usages

Key Usages

5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7Certificate

Extended Key Usages

Key Usages

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56Certificate

Extended Key Usages

Key Usages

3c:b9:89:0d:79:19:e0:30:3d:61:db:e6:dc:b6:25:38:b5:89:e1:b5:bc:85:2e:cb:18:3c:87:db:29:f8:1c:ceSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Sections

.text Size: 5KB - Virtual size: 4KB

.rsrc Size: 171KB - Virtual size: 171KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 12.1MB - Virtual size: 12.1MB

.rsrc Size: 171KB - Virtual size: 170KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 2.5MB - Virtual size: 2.5MB

.rsrc
Size: 112KB - Virtual size: 111KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 1024B - Virtual size: 972B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 287KB - Virtual size: 287KB

.rsrc
Size: 128KB - Virtual size: 127KB

.reloc
Size: 512B - Virtual size: 12B

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

2e:4f:4b:a2:5c:15:e3:bb:08:87:e8:b9:d1:ee:2b:ff
Certificate

5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7
Certificate

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

3c:b9:89:0d:79:19:e0:30:3d:61:db:e6:dc:b6:25:38:b5:89:e1:b5:bc:85:2e:cb:18:3c:87:db:29:f8:1c:ce
Signer

.text
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 171KB - Virtual size: 171KB

.text
Size: 12.1MB - Virtual size: 12.1MB

.rsrc
Size: 171KB - Virtual size: 170KB

.reloc
Size: 512B - Virtual size: 12B