Solarum.zip
- SHA256 f1a8f0ee98712829e22a975ec78df67f3b38037580228016e2d77b15bb625086
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NetFx20SP1_x86.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
1800 seconds
Behavioral task
behavioral2
Sample
NetFx20SP1_x86.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
1800 seconds
Behavioral task
behavioral3
Sample
Solarum.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
1800 seconds
Behavioral task
behavioral4
Sample
Solarum.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
1800 seconds
General
- Target Solarum.zip
- Size 23.6MB
- Sample241019-jakkpathjf
- SHA256 f1a8f0ee98712829e22a975ec78df67f3b38037580228016e2d77b15bb625086
- MD5 e423d7ca7603f1121d645a8140fdb4b7
- SHA1 067f3cb0d99276736dfcc8959924be3b0563ae39
- SHA512 43c2538ea6d8d80e164ed925c2315ee12f3eff02b2b519887f721ebcbd1dabb04e69426415a32ace02698a9012b3cba565ca43827bc5f9da3a4cc25648e99ef4
- SSDEEP 393216:nlujo2X2jOzKRCP5bDbtFxCe2075LQ7n6k63MTXuHjjpUy4PoMHiu/wcdI4wNkP/:AsJjxCRDbt6apYn6kT7uDn4NJIQq9TGr
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Solarum.exe
File Explorer
-
Solarum.zip.zip 23.6MB
-
NetFx20SP1_x86.exe.exe 23.6MB
-
READ - ME.txt2KB
-
Solarum.exe.exe 134KB
NetFx20SP1_x86.exe
- IMPHASH 092eb6daba2f17cbda102fd1a32acd00
- SHA256 c36c3a1d074de32d53f371c665243196a7608652a2fc6be9520312d5ce560871
- MD5 c61111d7d62306b997ce7dd04898b1ca
- SHA1 eef5a36924cdf0c02598ccf96aa4f60887a49840
- SHA512 85f93266ed9b11a0f20ef5c0f6725cb61ccd3a2fc296ba9f8a73a1d6b5866a70b73ff2ce262b1bbf1b2314277f951b0f2594e1d4c84375b016f81ce09ec82a14
- SSDEEP 393216:6Rnm/ljDNqtS1hZhz9McAwDlVaVucM37sgoW2vBFT03bScvwcbzofBMj8wHhu:n6chZhyyL2ucMIfW+U33tP4CfHhu
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e4:1c:33:c1:7b:4c:cb:ad:01:06:61:b7:cb:fc:92:c9:8e:3c:50:e1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 8, 2007
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0f:78:4d:00:00:00:00:00:03
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 23, 2007 - Feb 23, 2009
Subject
CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:14:2c:a7:00:00:00:00:00:06
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 12, 2007 - Jun 13, 2012
Subject
CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:14:2c:a7:00:00:00:00:00:06
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 12, 2007 - Jun 13, 2012
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Minor OS version
2
Major OS version
5
Entry point
22898
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
kernel32
GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
SetEvent
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
GetVersionExA
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
CreateFileA
FindNextFileA
FindFirstFileA
CopyFileA
SetFileAttributesA
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceA
QueryDosDeviceA
GetCurrentDirectoryA
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetExitCodeProcess
CreateProcessA
ExpandEnvironmentStringsA
GetFileSize
CreateThread
CreateEventA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
CloseHandle
DeviceIoControl
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
SetErrorMode
GetTickCount
CreateDirectoryA
GetLastError
RemoveDirectoryA
MoveFileExA
SetFilePointer
FindClose
ReadFile
msvcrt
strchr
_strnicmp
_stricmp
strrchr
_strlwr
strncpy
strstr
_snprintf
sprintf
advapi32
AllocateAndInitializeSid
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
OpenProcessToken
user32
ShowWindow
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
LoadStringA
EndDialog
SetParent
MessageBoxA
ntdll
NtShutdownSystem
NtAdjustPrivilegesToken
NtClose
NtOpenProcessToken
comctl32
ord17
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
23.6MB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=15, id=93, version=2179,
count=107, id=1, productName=Unmarked objects,
count=20, id=95, version=2190,
count=1, id=94, version=2179,
count=1, id=90, version=2179,
READ - ME.txt
- SHA256 b76975bfb571443d775369325af132ee9b1ec8e3f78790de830508f6a74111e1
- MD5 7bbcacb3d534ab6156287d0944393736
- SHA1 537b918e503b930e962cd907eda9c9d9271dd379
- SHA512 a4ad8e0d4a575319dacc7f636d9b13bfde99ddb1a6220c2af06850002d98035edb88bb9f6e628d1e62bc78c784bc7c410910c8ff827b37f3637fc4cb398ba2d4
- MD5 SHA1 SHA512
Solarum.exe
- IMPHASH b88d3bf474aebc68d610c7699bbdcd5e
- SHA256 3d327b924f04c21f00685a23b5e573f8190ce8ca87246f4f690eff3800802748
- MD5 ea48892be8be23cb98f161976048162a
- SHA1 1e1b432f3ad8dd49d559245c031d426eeb07e052
- SHA512 40079a125525d5e93ac7aaf0757ba82dcd09137e4c62b98b49eda67e1dc7bbdcb43b702ecaa8150fb061423aa94025ba313afb540b3421ce34320bdb660f6747
- SSDEEP 3072:kfEXRgwrwj/F/wUtQqsvXWiXp8NhSlO3Ag0FuYJ/i+Q1ZG35:kfuY/F/P4FD03AOJj1M35
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
29527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\craft\source\repos\ConsoleApplication7\Release\ConsoleApplication7.pdb
msimg32
AlphaBlend
gdi32
GetDeviceCaps
BitBlt
CombineRgn
CreateEllipticRgn
CreateSolidBrush
DeleteObject
Ellipse
SelectClipRgn
DeleteDC
PlgBlt
StretchBlt
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap
kernel32
GetStartupInfoW
WriteConsoleW
WriteFile
CreateFileW
GetVersionExW
Sleep
TerminateThread
LoadLibraryA
CloseHandle
GetNativeSystemInfo
CreateThread
GetProcAddress
GetModuleHandleW
GetTickCount
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetStringTypeW
SetStdHandle
GetFileType
GetProcessHeap
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
GetLastError
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
GetACP
HeapFree
HeapAlloc
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
ReleaseDC
InvalidateRect
SystemParametersInfoW
GetDesktopWindow
GetWindowRect
GetDC
MessageBoxW
GetSystemMetrics
RedrawWindow
winmm
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
Name
.text
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=241, version=40116,
count=123, id=243, version=40116,
count=27, id=242, version=40116,
count=18, id=259, version=24237,
count=40, id=261, version=24237,
count=19, id=260, version=24237,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=122, id=1, productName=Unmarked objects,
count=1, id=265, version=24247,
count=1, id=255, version=24247,
count=1, id=258, version=24247,