AvastSvcZEg.zip
- SHA256 47521a28f2aec3de8db28f63a88f3af567f7e40228acc5924673f23cd039199f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AvastSvcZEg.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target AvastSvcZEg.zip
- Size 154KB
- Sample240925-mkfahazgrn
- SHA256 47521a28f2aec3de8db28f63a88f3af567f7e40228acc5924673f23cd039199f
- MD5 4672c97ef72cfa9845126c6c19a0303d
- SHA1 a64ca5018acb426de38f2b20ff9be956d6c35600
- SHA512 7943fe72e1f16ea034f781abe92b415118987ce87c1f74ae98cf4fcccd976c1622f935d2b211ef9c9a827d18af4c8214a738a254f63aa61de44bf707e7a0a433
- SSDEEP 3072:jLGN6+o/5GJB8YoaxwbybSNqnjdNArfqesO89pVBvDjvKWU7bK6GWQ:/G/2ooPHc2yesR9xDTKWU7prQ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AvastSvcZEg/wsc.dll
File Explorer
-
AvastSvcZEg.zip.zip 154KB
-
AvastSvcZEg/AvastAuth.dat160KB
-
AvastSvcZEg/AvastSvc.exe.exe 60KB
-
AvastSvcZEg/wsc.dll.dll 52KB
-
checksums.txt173B
AvastSvcZEg/AvastAuth.dat
- SHA256 8ec409c1537e3030405bc8f8353d2605d1e88f1b245554383682f3aa8b5100ec
- MD5 53830fe278811363f93e0906d8b5ce69
- SHA1 b133578af848e10500cc8b943483ed71e86a713a
- SHA512 c87497b49d2924be200053495074e16d82fdc875ecdcd231e185479901020c176c2a478c52eea55a9908fe3605ed3d5b2037fa4c83248d4d2bfea45f9f03dc37
- SSDEEP 3072:4NZDIHsDYhxMxRpyfGZpUOJR6UfzhgAN6f8HQJCKJUn/:4NZQsskdEGvH4IzhgnUH+dU/
- MD5 SHA1 SHA512 SSDEEP
AvastSvcZEg/AvastSvc.exe
- IMPHASH f1cc6c4c6182edcc39d0ba2695016c63
- SHA256 85ca20eeec3400c68a62639a01928a5dab824d2eadf589e5cbfe5a2bc41d9654
- MD5 a72036f635cecf0dcb1e9c6f49a8fa5b
- SHA1 049813b955db1dd90952657ae2bd34250153563e
- SHA512 e3582e0969361d272c2469ce139ec809b9b0ac98fbc5eb5bb287442aed4c6ba69ed8175b68970751c93730cfaf07b75c3bc5e4e24aeda8f984b24f33bb8e3da2
- SSDEEP 768:Q/WQ3/TymxfsHYPry0bgYh3LKgMoCDGFh9D:Q+QvT7xUHYPDbgYVLWofD
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
13:49:1d:37:81:1f:37:89:11:c6:78:41:56:47:bd:0e:0f:fc:90:87:79:ad:e8:e4:03:43:b8:25:a1:15:50:e1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ
Chains
Sep 23, 2024
PE Signature issue
Digest
55:6b:7c:09:f8:8f:1b:e0:bf:1c:75:a6:e4:ab:fd:31:0f:4c:76:f8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ
Chains
Mar 28, 2017
Subject
CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ
Serial Number
07:c7:0f:7c:ab:14:5b:c1:ed:38:5f:be:69:fa:31:30
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 6, 2016 - Oct 4, 2019
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ
Serial Number
04:a4:28:af:3c:af:38:44:74:6a:c6:3e:2e:09:fa:a1
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 29, 2014 - Jun 2, 2017
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
d:\Workspace\workspace\ProductionClients-ForRelease\AVBranding\avast\CONFIG\Release\label_exp\WinClient\BUILDS\Release\x86\wsc_proxy.pdb
kernel32
GetLastError
LoadLibraryW
GetProcAddress
ExitProcess
FreeLibrary
GetCommandLineW
Name
.text
Size
512B
Virtual Size
90B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
742B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=1, productName=Unmarked objects,
count=1, id=265, version=24213,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3 build 24213, version=24213,
AvastSvcZEg/wsc.dll
- IMPHASH 0dc36807f89a0531d92146a6d8975f5b
- SHA256 6491c646397025bf02709f1bd3025f1622abdc89b550ac38ce6fac938353b954
- MD5 831252e7fa9bd6fa174715647ebce516
- SHA1 bf8c5bf141f0db53000805f2629e6e031d137ceb
- SHA512 0be6e898dcb75b32358bb8c2214e7b9453034ecfbe71d092df75b186a28f97ae7d5737f010b9d9e781c6b4cf3da19ee4a7cf5002604d23c527c55a3f7a0dba04
- SSDEEP 768:ctRTzgT291lvLotXKUoImwKvuZ+UHo4QIkfbZoN:ctRHgTWPcpmwKf4X2oN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10093
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
ReadFile
CreateFileA
GetProcAddress
GetModuleHandleA
LocalAlloc
lstrcatA
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
SetEndOfFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
_run@4
dobqkrlajbcoaqwwjykrxlrcbfvlpejjyyqudh
sayxvqtqsuaudrrxqqybuuyfbacf
wparqjklycmxaosipdoyvibmbvfxmtlujdmxkcid
Name
.text
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=1, productName=Unmarked objects,
count=3, id=19, version=8034,
count=22, id=14, version=7299,
count=77, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=4, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
checksums.txt
- SHA256 0f6020ff1bef2454c0dac2335941c948508719325da58f5b8c353ec3eb607d2a
- MD5 8523131ead4e01b864a2d7100b77fe0d
- SHA1 ebbab609101603681aeb7a2e3a8f23858d9e4219
- SHA512 5c346eae309af6b95970da3f8ff1598afa5ca5013635e800425b46d23917e78b4f520ff1c84b43289dbac026222f5f33682762171875bc91cef8ea5cbbbce383
- MD5 SHA1 SHA512