19112060681[.]zip

Resubmissions

21/09/2024, 03:36

240921-d56thstarc 7

21/09/2024, 02:16

240921-cp52lszhle 1

21/09/2024, 01:31

240921-bxg43sygkq 1

Sharing

Copy URL Twitter E-mail

General

Target

19112060681.zip
Size

25.4MB
MD5

c25c481ff04f4c3c083c62191aa64d06
SHA1

1d3420eaf989b1168d9bc81ddb882c94be8c391f
SHA256

661f8f79b64d2464f978546143fb23bda9dbc87aa7fc2dc91005989b20bc308f
SHA512

c42aff33f7a3ba52229c87bedfa72f7a73620f7e84d74763a18335dd5bf848ee90ce7fd9f1c25960cd3cd5c7007ba4f0db07ba04eccbadd160366e4ae0fdf5c0
SSDEEP

786432:9weBvJ7CyikinZBq4TmXYOd3Mkt1FaPwk:KeVJ7Enrl6d80Fcwk

Score

1^/10

Malware Config

Signatures

Files

19112060681.zip
.zip

Password: infected
4af738bb1845f9b9ac9effd78e2a9c629106bf0a52cffb1b60ae74dbc51544ec
.exe windows:6 windows x64 arch:x64

Password: infected

de00d4a225d7b01a41e50b399ac46028

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:3c:43:39:96:5b:1b:08:19:89:c7:00
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

20/06/2024, 09:42

Not After

21/06/2025, 09:42

Subject

SERIALNUMBER=1247700038530,CN=LLC DALTREYD,O=LLC DALTREYD,STREET=Nizhnyaya Maslovka street\, 19 room 1n,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

91:be:e4:2b:89:27:c7:97:95:0e:18:45:4e:b4:01:be:9f:26:c7:e2:b8:7a:a6:79:49:de:5d:9b:d3:a3:0d:d4
Signer

Actual PE Digest

91:be:e4:2b:89:27:c7:97:95:0e:18:45:4e:b4:01:be:9f:26:c7:e2:b8:7a:a6:79:49:de:5d:9b:d3:a3:0d:d4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCreateKeyExW

bcrypt

BCryptCreateHash

crypt32

CertVerifyTimeValidity

iphlpapi

GetAdaptersAddresses

kernel32

HeapFree

ncrypt

NCryptOpenStorageProvider

ole32

CoUninitialize

oleaut32

SafeArrayGetVartype

user32

LoadStringW

ws2_32

send

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-math-l1-1-0

nan

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_cexit

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

DotNetRuntimeDebugHeader

Sections

.text
Size: - Virtual size: 961KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: - Virtual size: 19.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

hydrated
Size: - Virtual size: 7.9MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 32.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 552KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.1Ie
Size: - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ca'
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.D%'
Size: 26.8MB - Virtual size: 26.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

de00d4a225d7b01a41e50b399ac46028

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

52:3c:43:39:96:5b:1b:08:19:89:c7:00Certificate

Extended Key Usages

Key Usages

91:be:e4:2b:89:27:c7:97:95:0e:18:45:4e:b4:01:be:9f:26:c7:e2:b8:7a:a6:79:49:de:5d:9b:d3:a3:0d:d4Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

crypt32

iphlpapi

kernel32

ncrypt

ole32

oleaut32

user32

ws2_32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: - Virtual size: 961KB

.managed Size: - Virtual size: 19.6MB

hydrated Size: - Virtual size: 7.9MB

.rdata Size: - Virtual size: 32.2MB

.data Size: - Virtual size: 552KB

.pdata Size: - Virtual size: 1.4MB

.1Ie Size: - Virtual size: 5.7MB

.ca' Size: 1024B - Virtual size: 608B

.D%' Size: 26.8MB - Virtual size: 26.8MB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 512B - Virtual size: 296B

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

52:3c:43:39:96:5b:1b:08:19:89:c7:00
Certificate

91:be:e4:2b:89:27:c7:97:95:0e:18:45:4e:b4:01:be:9f:26:c7:e2:b8:7a:a6:79:49:de:5d:9b:d3:a3:0d:d4
Signer

.text
Size: - Virtual size: 961KB

.managed
Size: - Virtual size: 19.6MB

hydrated
Size: - Virtual size: 7.9MB

.rdata
Size: - Virtual size: 32.2MB

.data
Size: - Virtual size: 552KB

.pdata
Size: - Virtual size: 1.4MB

.1Ie
Size: - Virtual size: 5.7MB

.ca'
Size: 1024B - Virtual size: 608B

.D%'
Size: 26.8MB - Virtual size: 26.8MB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 512B - Virtual size: 296B