kbsn4.zip
- SHA256 89f5c43392faa03ea2b0e6e6dffe4bb86a1e93002518586aa1d8acb0301da25c
Static task
static1
Behavioral task
behavioral1
Sample
ASmartCore_[1MB]_[unsign].exe
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
General
- Target kbsn4.zip
- Size 1.5MB
- Sample241010-tagtxatcnc
- SHA256 89f5c43392faa03ea2b0e6e6dffe4bb86a1e93002518586aa1d8acb0301da25c
- MD5 fc6f2d93a197daa080784017c02ea3cc
- SHA1 aa7cb02031e1c6ad5a5bcd7ee494524dea763e44
- SHA512 5a770995f4a66cc724715eb58e3f6a3d66e8093dc60d300260f3b744f7f3dd81cbf5e3152179943424f5e7c77f0df0d31f326472dc38136ffc11dab3a849d251
- SSDEEP 24576:hdE8FjhvOSv1mVpMHfxni09rrgP2GPZza1VqdfFFQfykBiS3MLU4gpq50vV3G/pd:h1ndmVOVTC2GSyiikMN50N3GhEOB
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
kbsn4.zip.zip 1.5MB
-
ASmartCore_[1MB]_[unsign].exe.exe 1.7MB
ASmartCore_[1MB]_[unsign].exe
- SHA256 82b8d47ba0e989c799d8a421795fc34deb219458c9895b029c49819f91e12185
- MD5 f6981fe9f52b07e36927a649989fc2e6
- SHA1 e6e19f681353f907a5450699ad4741d36eb853cb
- SHA512 bc3c819c075940b80fa45806e5831cc4dd56a87f2a1e11b79ec57eca38aa1cce3b400a5a2710425f6110441448e94e0a0f285fe995afae9f5a872cfa805b4c74
- SSDEEP 49152:M9BtF4dQTlYs+pzJCVjdva2tPFjw8oo6Z5D/patsbeF:q6dQTCsGJC+2tPGX7eF
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e6:1c:13:5f:f4:dd:e6:a9:81:91:a2:97:82:cc:10:50:a9:cf:9a:5d
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Ariolic Software Ltd,O=Ariolic Software Ltd,POSTALCODE=69035,STREET=Stalevarov st 7/15,L=Zaporizhia,ST=Zaporizhia,C=UA
Chains
Sep 7, 2014
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 24, 2011 - May 30, 2020
Subject
CN=Ariolic Software Ltd,O=Ariolic Software Ltd,POSTALCODE=69035,STREET=Stalevarov st 7/15,L=Zaporizhia,ST=Zaporizhia,C=UA
Serial Number
14:b7:23:39:0c:e3:c5:d4:1a:7f:66:c3:3f:ee:b0:dd
Issuer
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 17, 2013 - Sep 17, 2014
Minor OS version
1
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
665KB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
101KB
Virtual Size
384KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
7KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
198KB
Virtual Size
828KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
430KB
Virtual Size
432KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
363KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=93, productName=VS2003 (.NET) build 3077, version=3077,
count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=47, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=207, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=171, productName=VS2010 build 30319, version=30319,
count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=975, id=1, productName=Unmarked objects,
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=483, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,