ArainsToolser.zip
- SHA256 d2727538c887f2f523a637d6385d68b125d60935b4084512fb3e1eba47e70c76
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
arpReport.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
arpReport.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
arphadump.dll
Resource
win7-20240729-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
arphadump.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target ArainsToolser.zip
- Size 3.0MB
- Sample240911-bysbfaxarf
- SHA256 d2727538c887f2f523a637d6385d68b125d60935b4084512fb3e1eba47e70c76
- MD5 279ddeb89a3a6f10b07c4e345a18ff4c
- SHA1 4f10c7009f680d0f7254c1beed40de1d2de7c292
- SHA512 66160aa10de569f1c9d6524a83531531c1ca36b00fc3c92e415d99439e7ff57d592f2f67469fba9f7557a4481195cf60ecbf878eaa0aac4a231eb7da8982dbbb
- SSDEEP 49152:PczpoHHC9CkKfUBvDD+JpqU4Fz7kos/jPaG2B0FGI5RrBY79yXYma:Pc9DCDyDDmz4ZkD/jJ2dSva
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/arphadump.dll
File Explorer
-
ArainsToolser.zip.zip 3.0MB
-
DIFxAPI.bpl133KB
-
NvSmart.hlp3KB
-
NvSmart.x64.hlp2KB
-
arpReport.exe.exe 189KB
-
arphadump.dll.dll 7.2MB
DIFxAPI.bpl
- SHA256 86f32ad5c7048cd156d345bc86d4afc73a7be036a5b11aa08ac5b037249ba73e
- MD5 6d7a48328af8ac53d0331bca03f6e322
- SHA1 41b14093804e44dc1865a595d1a8e63c918c0a29
- SHA512 207c525e14e18eb147f92bcc65186131e24168ff877c09eae3bd234c37401776a483bf56f105060c02c88d37935e23df8e759f4979dc7cdc71bad08bab6c3715
- SSDEEP 3072:4f7VIYY7jDLy6v0o4YjUwSEE6bVZyIy4ig3X:4t+DG6vaYjSEZ7ye
- MD5 SHA1 SHA512 SSDEEP
NvSmart.hlp
- SHA256 a0a82d18a498ae44015e90c2c049566c8a9b135959c7e3b122cf3e73b7330913
- MD5 619380e8e2d144d8acc7cf487c86de58
- SHA1 59fa527c0c544a647ba8662daee3b09edb7c88ed
- SHA512 ca2be21f95edc3c6afd08c2607f496c2bee88acf012627a0dfb174df22fe58ed8333a4804bdae48bef23b5c7963250aa57deaaffad30c2a5594ffe9e2f8b7e7e
- MD5 SHA1 SHA512
NvSmart.x64.hlp
- SHA256 371c46a4e330904a1e7a001e2e3e30c05eade3ee268c753b19a80fff46ef8078
- MD5 f118d379ae72e4e310767eb3c08336ae
- SHA1 0c4073da84a6d303a2dd3d3f5215a18ddd95b78b
- SHA512 fc32b5883f1dd2c0551e2a0c18fdef72f2249d8da2315506dd63c13174a7f347f414a2182016ac93ff8bbe2a49e7c671cedf9308e96a926d0e976e9f8436a9ef
- MD5 SHA1 SHA512
arpReport.exe
- IMPHASH 9206bd4a402561582018ceda38bf9057
- SHA256 6840e6e2a2b4555db025c331b41d426387e8d6397fd5917fad29d3893fb1886f
- MD5 e9d05f7176aab86c6754ba89cb06d768
- SHA1 f0e80278eab18ed61dcb473fb42419186fcc8b35
- SHA512 100b1020ac2d67b10d5ff7f7b3423b0706fa0250c90dad9d0155064e52ab6bb2226e8cd9be4ea5e8eba91b91d5f399e82ec166fef0a9fef3cccc35963113fda1
- SSDEEP 3072:SJg3FNLpWK6weGrE8tU3xvz0tcK4hYanD9EvQiorztXkF6ODVgCl4LDVXcCSfHR9:SJgVV8K6VGrE8y3CtcKn6yv8zRkDVK5w
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Digest
9c:d8:c5:af:8f:c5:36:06:18:6b:04:bb:50:07:ba:aa:6f:57:31:89:23:75:2c:80:aa:eb:b4:08:ff:bc:fa:60
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,O=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,L=杭州市,ST=浙江省,C=CN
Chains
May 29, 2023
CN=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,O=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,L=杭州市,ST=浙江省,C=CN
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
2a:24:b6:ca:64:f0:f0:a8:36:05:e8:ee:a4:a6:f6:b7:a4:78:4b:fe
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,O=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,L=杭州市,ST=浙江省,C=CN
Chains
Sep 6, 2024
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,O=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,L=杭州市,ST=浙江省,C=CN
Serial Number
02:fd:d8:26:61:a7:0c:76:59:ca:e2:24:bb:57:92:45
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Aug 21, 2024
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,O=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,L=杭州市,ST=浙江省,C=CN
Serial Number
02:fd:d8:26:61:a7:0c:76:59:ca:e2:24:bb:57:92:45
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Aug 21, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
5
Entry point
48583
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release\arphaCrashReport.exe.pdb
arphadump
SetWindowLocalDump
GetArphaCrashReport
GetArphaUtils
shlwapi
PathFileExistsW
PathStripPathW
PathRemoveFileSpecW
kernel32
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
FindResourceExW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
HeapFree
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
LocalFree
lstrcmpiW
GetPrivateProfileStringW
CreateFileW
GetFileAttributesExW
GetFileSize
ReadFile
CloseHandle
CreateProcessW
HeapReAlloc
HeapAlloc
GetProcAddress
HeapDestroy
GetLastError
RaiseException
DecodePointer
LCMapStringW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FlushFileBuffers
SetFilePointerEx
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
WriteConsoleW
IsDebuggerPresent
gdi32
CreateFontW
GetStockObject
advapi32
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
shell32
ExtractIconExW
ShellExecuteW
CommandLineToArgvW
ole32
CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoTaskMemRealloc
oleaut32
VarUI4FromStr
user32
IsWindowVisible
ShowWindow
PostThreadMessageW
PostMessageW
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
GetWindowLongW
MapWindowPoints
GetWindowRect
GetClientRect
SetDlgItemTextW
GetDlgItem
EndDialog
SetWindowPos
SendMessageW
SetWindowLongW
CharNextW
CreateDialogParamW
DestroyWindow
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
UnregisterClassW
CheckDlgButton
IsDlgButtonChecked
GetActiveWindow
SetTimer
KillTimer
GetWindowThreadProcessId
LoadIconW
IsDialogMessageW
DialogBoxParamW
EnableWindow
SetWindowTextW
UpdateWindow
IsWindow
comctl32
InitCommonControlsEx
Name
.text
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26213,
count=143, id=261, version=26213,
count=19, id=260, version=26706,
count=18, id=259, version=26706,
count=51, id=261, version=26706,
count=19, id=260, version=26213,
count=18, id=257, version=26213,
count=3, id=257, version=27043,
count=169, id=1, productName=Unmarked objects,
count=7, id=261, version=27043,
count=1, id=255, version=27043,
count=1, id=151,
count=1, id=258, version=27043,
arphadump.dll
- IMPHASH 1f932265b088694482b9ef6db31a2539
- SHA256 9e10d98024db6f6748433918288232cc1e55bea916146729be40dc0e53615393
- MD5 e4ac1288b36eb34ec356012716573a5c
- SHA1 dfaf779547b3989d72f75a91dbba20a3a15d4b96
- SHA512 5f6921a62bee16a695215ead02fa10f6ae7ec844c9826a063824487519e03b0c674f6802273f13cb23e1daca2f7e9b9b723359d2b9aa9183821ec1234a334463
- SSDEEP 98304:WfGAF3IZQRiTozYnHctd8/YTqOHyjt7ygsOMW6:4uRoznfq1NsM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
13508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\luck\Desktop\FAST-AES\RoboformAES\Release\Roboform.pdb
kernel32
WriteFile
VirtualFree
CloseHandle
ReadFile
VirtualAlloc
GetFileSize
CreateFileW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CreateThread
VirtualProtect
lstrcpyW
GetModuleFileNameW
OutputDebugStringW
GetModuleHandleA
DisableThreadLibraryCalls
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
GetCurrentThreadId
DecodePointer
GetCommandLineA
EncodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
GetProcAddress
IsProcessorFeaturePresent
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryW
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetArphaApp
GetArphaCrashDump
GetArphaCrashReport
GetArphaJamDump
GetArphaService
GetArphaUtils
SetWindowLocalDump
Name
.text
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7.1MB
Virtual Size
7.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=158, productName=VS2010 build 30319, version=30319,
count=70, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=84, id=1, productName=Unmarked objects,
count=33, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,