SPAM[.]zip | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

SPAM.zip
Size

16KB
MD5

883ed315bba8c453d18bf6aa07c4b24b
SHA1

42f99db034bd90e416c15f808a24b90c007cb141
SHA256

7153461d240aa0f8c78eb9b906a9d4f1271dadd9d823fa996444cefe531ea952
SHA512

ab2c93f57a79fc6f06acbf56115d8f2771c3734440849e8933239de12fa8407bca6740540aa8625e697a631a4fbfee01ea2a949f13ec1e2635a44788cc801848
SSDEEP

384:BDSsNjzI0WQMYWfY5QGVOihKxz8h58KAcLxAvEDXHbYlPuqU:V35vWQMYV5QG5kw8UxzD3Q2B

Score

1^/10

Malware Config

Signatures

Files

SPAM.zip
.zip
NSM.LIC
bild.exe
.exe windows:5 windows x86 arch:x86

78ed70ebeb178ed1bae5921d2ed514bc

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12-01-2016 00:00

Not After

21-09-2017 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12-01-2016 00:00

Not After

21-09-2017 23:59

Subject

CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

8c:d3:13:12:91:2e:05:3f:3d:34:5e:ff:ef:06:f6:42:62:55:06:e8:4c:68:52:37:8e:09:da:63:f2:62:ce:24
Signer

Actual PE Digest

8c:d3:13:12:91:2e:05:3f:3d:34:5e:ff:ef:06:f6:42:62:55:06:e8:4c:68:52:37:8e:09:da:63:f2:62:ce:24

Digest Algorithm

sha256

PE Digest Matches

true

bf:db:96:a7:0a:24:0a:b6:44:23:e0:15:37:06:69:6b:b7:d3:11:4e
Signer

Actual PE Digest

bf:db:96:a7:0a:24:0a:b6:44:23:e0:15:37:06:69:6b:b7:d3:11:4e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb

Imports

pcicl32

_NSMClient32@8

kernel32

GetCommandLineA
ExitProcess
GetModuleHandleA
GetStartupInfoA

Sections

.text
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 342B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
client32.ini

Sharing

General

Malware Config

Signatures

Files

78ed70ebeb178ed1bae5921d2ed514bc

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

8c:d3:13:12:91:2e:05:3f:3d:34:5e:ff:ef:06:f6:42:62:55:06:e8:4c:68:52:37:8e:09:da:63:f2:62:ce:24Signer

bf:db:96:a7:0a:24:0a:b6:44:23:e0:15:37:06:69:6b:b7:d3:11:4eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

pcicl32

kernel32

Sections

.text Size: 512B - Virtual size: 176B

.rdata Size: 512B - Virtual size: 342B

.rsrc Size: 90KB - Virtual size: 90KB

.reloc Size: 512B - Virtual size: 108B

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

8c:d3:13:12:91:2e:05:3f:3d:34:5e:ff:ef:06:f6:42:62:55:06:e8:4c:68:52:37:8e:09:da:63:f2:62:ce:24
Signer

bf:db:96:a7:0a:24:0a:b6:44:23:e0:15:37:06:69:6b:b7:d3:11:4e
Signer

.text
Size: 512B - Virtual size: 176B

.rdata
Size: 512B - Virtual size: 342B

.rsrc
Size: 90KB - Virtual size: 90KB

.reloc
Size: 512B - Virtual size: 108B