MDE_File_Sample_0ae17e91c0a9f8ad2a9971b14edbaf15ee9352e5[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

MDE_File_Sample_0ae17e91c0a9f8ad2a9971b14edbaf15ee9352e5.zip
Size

3.1MB
MD5

517c55313bc71f24682b3cb47e6e56a9
SHA1

4a1864dad495524caca2c17d27a829c01d3a769c
SHA256

749c12823681e29b8bda292db3681ec6b77f393d13ec209f3e49602d2d1c27b3
SHA512

62b5291777c5074eda0ed0c137b66de9824df45c21da45f78c38662ff81e9858bd63d7e8327d531d595a68226dbf52d7e391d1c288cb987f1a54be7a7b0187f3
SSDEEP

98304:dbz82K3IlSnRVnNGd4s4pzm7+5friqYIzb+:dy0yRVn7zMisyK

Score

1^/10

Malware Config

Signatures

Files

MDE_File_Sample_0ae17e91c0a9f8ad2a9971b14edbaf15ee9352e5.zip
.zip

Password: 123
icarus.exe
.exe windows:6 windows x64 arch:x64

Password: 123

36d07adef72483f55e4e1b594a273b33

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:43:75:69:d0:ef:bc:4e:7d:76:73:cc:4b:6a:dd:c6
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

19/10/2022, 00:00

Not After

18/10/2025, 23:59

Subject

CN=Privax Limited,O=Privax Limited,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ff:f4:ca:9c:16:e9:47:fd:81:bd:7c:83:53:88:bb:c7:59:9e:46:3a:e9:14:5b:3c:9e:84:14:2e:9a:97:d5:65
Signer

Actual PE Digest

ff:f4:ca:9c:16:e9:47:fd:81:bd:7c:83:53:88:bb:c7:59:9e:46:3a:e9:14:5b:3c:9e:84:14:2e:9a:97:d5:65

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdb

Imports

rpcrt4

RpcBindingFree
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
UuidCreate
NdrClientCall3
RpcStringBindingParseW
UuidFromStringW
UuidToStringW
Ndr64AsyncServerCallAll
NdrAsyncServerCall
NdrServerCall2
NdrServerCallAll
Ndr64AsyncClientCall
RpcAsyncCancelCall
RpcAsyncInitializeHandle
RpcAsyncCompleteCall
RpcBindingToStringBindingW
RpcEpUnregister
RpcEpRegisterW
RpcServerUseProtseqEpW
RpcObjectSetType
RpcServerRegisterIf2
RpcServerUnregisterIfEx
RpcImpersonateClient
RpcRevertToSelf
I_RpcBindingInqLocalClientPID
RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqBegin
RpcIfInqId
RpcMgmtEpEltInqDone

winhttp

WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpSetOption
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpSetCredentials
WinHttpReadData
WinHttpWriteData
WinHttpSetStatusCallback
WinHttpQueryOption
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpGetProxyForUrl
WinHttpQueryDataAvailable
WinHttpAddRequestHeaders

shell32

ord165
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteW
SHChangeNotify

ntdll

RtlNtStatusToDosError
NtSetInformationThread
NtClose
RtlDllShutdownInProgress
RtlVirtualUnwind
RtlLookupFunctionEntry
NtSystemDebugControl
VerSetConditionMask
NtOpenKey
NtQueryKey
NtDeleteKey
RtlUnwindEx
RtlCaptureContext
RtlPcToFileHeader
RtlUnwind

kernel32

OutputDebugStringW
DeleteFileW
FindFirstFileW
ReadProcessMemory
CheckRemoteDebuggerPresent
VirtualProtect
FlushInstructionCache
RaiseException
FindClose
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateThread
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
GetTickCount
SetErrorMode
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualQuery
GetNativeSystemInfo
GetSystemTimes
GetProcessTimes
SetLastError
QueryFullProcessImageNameW
GetPriorityClass
OpenThread
GetThreadPriority
K32EnumProcesses
GetThreadTimes
K32GetProcessMemoryInfo
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetProcessHandleCount
GetFileTime
CompareFileTime
ProcessIdToSessionId
UnregisterWaitEx
GetComputerNameW
CreateSemaphoreW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
CreateIoCompletionPort
ResumeThread
TerminateThread
LoadLibraryA
CancelIoEx
GetOverlappedResult
ReadDirectoryChangesW
InitializeCriticalSectionAndSpinCount
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
QueryThreadCycleTime
DeleteProcThreadAttributeList
K32GetProcessImageFileNameW
GetThreadId
CreatePipe
SetHandleInformation
GetProcessShutdownParameters
SetProcessShutdownParameters
WTSGetActiveConsoleSessionId
LocalAlloc
FileTimeToSystemTime
FlushFileBuffers
GetFullPathNameW
OutputDebugStringA
CompareStringW
OpenEventW
GetVersionExW
ExpandEnvironmentStringsW
VirtualAlloc
VirtualFree
GetFileInformationByHandleEx
GetExitCodeThread
SetFileAttributesW
GetFileSize
MoveFileExW
GetVolumeInformationW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetFileAttributesExW
CreateDirectoryW
GetCurrentDirectoryW
FindFirstFileExW
FindNextFileW
QueryDosDeviceW
CreateHardLinkW
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
GetDateFormatW
GetTimeFormatW
GetVersion
SizeofResource
LockResource
LoadResource
FindResourceExW
FindResourceW
HeapSetInformation
CopyFileW
K32GetMappedFileNameW
FindFirstVolumeW
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
GetCurrentProcessId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetSystemDirectoryA
MoveFileExA
GetEnvironmentVariableA
SleepEx
CreateFileA
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
ExpandEnvironmentStringsA
GetVersionExA
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
DeviceIoControl
SetFileTime
GetFinalPathNameByHandleW
SetFileInformationByHandle
RegisterWaitForSingleObject
GlobalFree
LocalFileTimeToFileTime
SystemTimeToFileTime
GetStartupInfoW
UnhandledExceptionFilter
InitializeSListHead
GetCPInfo
CompareStringEx
LCMapStringEx
EncodePointer
GetLocaleInfoEx
AcquireSRWLockShared
ReleaseSRWLockShared
InitOnceComplete
InitOnceBeginInitialize
WaitForSingleObjectEx
IsProcessorFeaturePresent
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
DuplicateHandle
SetEndOfFile
SetFilePointer
HeapDestroy
GetSystemTimeAsFileTime
DecodePointer
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
RemoveDirectoryW
GetDriveTypeW
ReadFile
GetFileSizeEx
GetTimeZoneInformation
DebugBreak
FormatMessageW
GetCurrentThreadId
GetModuleHandleExW
GetModuleFileNameA
GetUserDefaultUILanguage
ResetEvent
LockFileEx
UnlockFileEx
CreateFileW
MoveFileW
GetModuleFileNameW
OpenProcess
Sleep
GetCurrentThread
GetCommandLineW
FreeLibrary
LoadLibraryExW
CreateProcessW
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
GetModuleHandleW
GetWindowsDirectoryW
LocalFree
GetSystemDirectoryW
WaitForMultipleObjects
TerminateProcess
WaitForSingleObject
SetEvent
CreateEventW
GetLastError
GetExitCodeProcess
GetProcessId
CloseHandle
GetCurrentProcess
GetSystemInfo
GetActiveProcessorCount
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
GetTickCount64
MultiByteToWideChar
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
VerifyVersionInfoW
GetFileAttributesW
LoadLibraryW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
FormatMessageA
GetModuleHandleA
InterlockedPushEntrySList
ExitThread
FreeLibraryAndExitThread
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
GetCommandLineA
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetStdHandle
FlsAlloc
FlsGetValue
FlsSetValue
FreeLibraryWhenCallbackReturns
GetStringTypeW
AreFileApisANSI
WriteFile
SetFilePointerEx
WaitForThreadpoolWaitCallbacks
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
IsValidCodePage
GetACP
GetLogicalDriveStringsW
CreateSymbolicLinkW
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetFileInformationByHandle
IsDebuggerPresent
SetDllDirectoryW
lstrcpyW
ExitProcess
LoadLibraryExA

user32

PeekMessageW
IsHungAppWindow
UnregisterClassW
GetGUIThreadInfo
LoadStringW
RegisterWindowMessageW
PostMessageW
SendMessageW
SetWindowLongPtrW
FindWindowExW
EnumWindows
GetWindowLongPtrW
DefWindowProcW
SetWindowTextW
ShutdownBlockReasonCreate
SetTimer
KillTimer
DestroyWindow
SetForegroundWindow
GetClassNameW
wsprintfW
AllowSetForegroundWindow
MessageBoxW
GetSystemMetrics
CharLowerW
GetWindowThreadProcessId
SendMessageCallbackW
ShutdownBlockReasonDestroy
PostQuitMessage
RegisterClassExW
CreateWindowExW
IsWindow
TranslateMessage
GetMessageW
DispatchMessageW
GetClassInfoExW

advapi32

RevertToSelf
ChangeServiceConfig2W
QueryServiceConfig2W
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitiateSystemShutdownExW
RegOpenKeyExW
RegCloseKey
OpenThreadToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetTokenInformation
OpenProcessToken
EqualSid
DuplicateToken
CheckTokenMembership
DuplicateTokenEx
CreateProcessAsUserW
ConvertSidToStringSidW
LookupAccountSidW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
SystemFunction036
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegDeleteKeyExW
RegEnumKeyW
RegQueryMultipleValuesW
RegFlushKey
RegDeleteTreeW
RegNotifyChangeKeyValue
RegQueryInfoKeyW
ConvertSecurityDescriptorToStringSecurityDescriptorW
RegDeleteValueW
RegEnumValueW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
GetEffectiveRightsFromAclW
GetSecurityInfo
RegLoadKeyW
LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy
ConvertStringSidToSidW
FreeSid
CloseServiceHandle
CreateServiceW
ChangeServiceConfigW
QueryServiceStatusEx
StartServiceW
ControlService
QueryServiceStatus
OpenServiceW
OpenSCManagerW
TreeResetNamedSecurityInfoW
AddAce
InitializeAcl
CopySid
GetLengthSid
AllocateAndInitializeSid
TreeSetNamedSecurityInfoW
SetNamedSecurityInfoW
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
ImpersonateSelf
AdjustTokenPrivileges
LookupPrivilegeValueW
GetFileSecurityW

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CoCreateGuid
CLSIDFromString

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

powrprof

CallNtPowerInformation

netapi32

NetUserGetLocalGroups
NetApiBufferFree

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CertAddEncodedCertificateToStore
CryptUnprotectData
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptProtectData
CryptDecodeObjectEx

iphlpapi

GetBestRoute2
GetAdaptersAddresses
FreeMibTable
GetUnicastIpAddressTable
if_indextoname
if_nametoindex

ws2_32

WSAGetLastError
WSAStringToAddressA
select
GetAddrInfoW
FreeAddrInfoW
WSACleanup
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
ntohl
ntohs
WSASetLastError
closesocket
htons
socket
setsockopt
WSAIoctl
__WSAFDIsSet
htonl
bind
connect
WSASocketW
getsockname
WSAAddressToStringA
getsockopt
WSADuplicateSocketW
recvfrom
getservbyname
gethostname
ioctlsocket
recv
WSAStartup
InetNtopW
WSAAddressToStringW

shlwapi

PathIsDirectoryEmptyW
PathFindFileNameW
PathRemoveFileSpecW
PathAppendW
PathMatchSpecW

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstallParamsW
SetupDiGetDeviceInstanceIdW

secur32

QueryContextAttributesW

dnsapi

DnsQuery_W
DnsFree

Exports

Exports

asw_process_storage_allocate_connector
asw_process_storage_deallocate_connector
on_avast_dll_unload
onexit_register_connector_avast_2

Sections

.text
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 569KB - Virtual size: 617KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 123

Password: 123

36d07adef72483f55e4e1b594a273b33

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

09:43:75:69:d0:ef:bc:4e:7d:76:73:cc:4b:6a:dd:c6Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

ff:f4:ca:9c:16:e9:47:fd:81:bd:7c:83:53:88:bb:c7:59:9e:46:3a:e9:14:5b:3c:9e:84:14:2e:9a:97:d5:65Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

winhttp

shell32

ntdll

kernel32

user32

advapi32

ole32

oleaut32

powrprof

netapi32

bcrypt

crypt32

iphlpapi

ws2_32

shlwapi

setupapi

secur32

dnsapi

Exports

Exports

Sections

.text Size: 5.3MB - Virtual size: 5.3MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 569KB - Virtual size: 617KB

.pdata Size: 213KB - Virtual size: 213KB

.didat Size: 512B - Virtual size: 112B

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 44KB - Virtual size: 43KB

.reloc Size: 34KB - Virtual size: 34KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

09:43:75:69:d0:ef:bc:4e:7d:76:73:cc:4b:6a:dd:c6
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

ff:f4:ca:9c:16:e9:47:fd:81:bd:7c:83:53:88:bb:c7:59:9e:46:3a:e9:14:5b:3c:9e:84:14:2e:9a:97:d5:65
Signer

.text
Size: 5.3MB - Virtual size: 5.3MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 569KB - Virtual size: 617KB

.pdata
Size: 213KB - Virtual size: 213KB

.didat
Size: 512B - Virtual size: 112B

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 44KB - Virtual size: 43KB

.reloc
Size: 34KB - Virtual size: 34KB