311e4c41ca958a2f68c41e7193386088ed187ac740a988cf12910e5177542020[.]zip

311e4c41ca958a2f68c41e7193386088ed187ac740a988cf12910e5177542020.zip

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 311e4c41ca958a2f68c41e7193386088ed187ac740a988cf12910e5177542020
MD5 c5afd258138a6f032dc56a75be63ed06
SHA1 f29c52892f58c2a645d8f870970aa9bf1de2d3a3
SHA512 c5a7190db5c62415f1f07bb64f2cf120f6527754fcf0aabefc38aaca16228e737187efd7054546de0976b1aeac5848a96d17d19c74ebba2215a22e8aa64e3f8b
SSDEEP 24576:gyBUnuMrYtghpOGvCr0FqjMNmpcEDxpfvxv7mdJG:/UnuMrmYTvCQq4uf5mdI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Password

infected

PE Signature issue

Digest

a3:1f:02:a6:34:2f:60:06:02:3b:37:4f:27:c6:1f:40:6b:3b:11:77:ed:b3:4e:6e:78:90:f3:9d:c5:58:50:35

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Marek Jasiński,O=Marek Jasiński,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c176d6172656b4066726565636f6d6d616e6465722e636f6d

Chains

Dec 31, 2024

CN=Marek Jasiński,O=Marek Jasiński,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c176d6172656b4066726565636f6d6d616e6465722e636f6d

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Serial Number

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 2, 2023 - Oct 30, 2034

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Marek Jasiński,O=Marek Jasiński,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c176d6172656b4066726565636f6d6d616e6465722e636f6d

Serial Number

61:2b:2b:92:bf:06:e4:a4:15:cc:96:9c:45:8a:be:34

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 19, 2023 - Oct 18, 2026

Minor OS version

0

Major OS version

5

Entry point

14467

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

.data

SHA256 637a3943c555de3601588a8398252a905d18c17f9d49f750b812daa630abac68
MD5 014871d9a00f0e0c8c2a7cd25606c453
SHA1 92d7e0d8d66861f702d867dac616b7d02bca94ec
SHA512 3f1e945759614a0e0ee05d8cc7c9d3a9f0b2954f64c173dd8f755d6b422c0b2f1f7a5c3af8aa54f3c6909de65c125e048dd8d17ee55da3989c4b2c807d83874c
MD5 SHA1 SHA512

.rdata

SHA256 b38b34dfbb61b5fc0659b9861f09dfdaaa743cb97bf0134e7bab66a75ddc940e
MD5 07990aaa54c3bc638bb87a87f3fb13e3
SHA1 05985b7f60a664d2595e9406ae3b208c97597bbc
SHA512 0017dd49d85c6aa9e8351c7da60f1150cb241022664151f0d2182a7a344f46286eb9f131f75a5f1adcef57a1362689a3c40a37547acc262aba92b742c13b65ad
SSDEEP 192:wiR1IorPNhxjQFOdiq343py7JRWVS7yWymPn:9RiaPblQFdq343pwrWVaymPn
MD5 SHA1 SHA512 SSDEEP

.reloc

SHA256 f542301cd3185cd98ae230748aa7de12e2b4924c460da717c3acc75ed2387b21
MD5 d570aa9ee45a54034dc14238fede1727
SHA1 0061a9c53930c3eaf07e5654b7b5e81576440845
SHA512 51a3b1af99e4d3198d58b1eb42af4fb4284871d6ab0a380fa71dd5f3d7693150e0347d90048ae7d23b384111dfde14d464e39f65ea11e5b28d40499870adf167
MD5 SHA1 SHA512

.rsrc/DIALOG/105

SHA256 fecdb955f8d7f1c219ff8167f90b64f3cb52e53337494577ff73c0ac1dafcd96
MD5 3409f314895161597f3c395cc5f65525
SHA1 1a99d016d65e567f24449d9362afb6ac44006d0b
SHA512 f3e7394fa49325a7ea46728b77a5e819e18d63049d54c6adf36d08619709484f8bbd20206416d3c1440bd70632d99d9a45f3488482353f90aa21aa6ee3915427
MD5 SHA1 SHA512

.rsrc/DIALOG/106

SHA256 69897c784f1491eb3024b0d52c2897196a2e245974497fda1915db5fefcf8729
MD5 2d12c45dc2c029044aaff357141cb900
SHA1 083db861ab3c7db23c6257878296e73a89a74b8b
SHA512 a50dcf605a914f0a6f94b3f815be159c2b729d005a25d6cc9120c4d34445cae2d0b20df3dbdc7672f316010c6a47079265548a1ed5a523896963b1a3ddf98a17
MD5 SHA1 SHA512

.rsrc/DIALOG/111

SHA256 85025c8556952f6a651c2468c8a0d58853b0ba482be9ad5cd3060f216540dfc0
MD5 6be4e1387d369cf86e68eacbdd0e81dd
SHA1 351970fe2681b9b35b5d59ad052011ed96a96e17
SHA512 b81b287de73282cc5a7337559fbce5af01d1a440f04ee97c6a8e1de0c787ef38936c951b802014b841fc517fe7f2b916266dc8c35cd5de1ad0c630dc2218fa81
MD5 SHA1 SHA512

.rsrc/GROUP_ICON/103

SHA256 957c82c3036099a746e6cec009aaf5d66058cde80389145cf6080bfad6af4781
MD5 75fd91e5bd07f54f011e64f6760dddc7
SHA1 9a0d7325e84263f13f8e86a681eb91b9f4786c3d
SHA512 f051c151d25fcf348007e01a230de1504115ba09d0ef56ecddd9d278ae42b7f35753f20e14c9e547435fcf750ecf0135f06c89ee98c2a9e4610c5bc9c1b54c44
MD5 SHA1 SHA512

.rsrc/ICON/1

SHA256 08cd1eb558c5e22413d1e069da43f82e516d70279c0ffc50152ba3d96b84d04f
MD5 621f8e9b45a00566dc923b433a33141d
SHA1 defe8ed6364f005cd8282ab3333be64ad9aaa535
SHA512 99cbe78c565755f5aaa3d00f2384dd0b0e914cdc560396b2c55f34ea43fa22ddc849430eb84924195449b145bce51030a9268f5d3bf2fb16a6ece7256f5f61f7
MD5 SHA1 SHA512

Password

infected

.rsrc/ICON/2

SHA256 cbcc8eefb7c694823804490c4d642ac7a489b045d2d799b4a19355309bfbb887
MD5 96879213ea6c2aee30e3e20684ffa475
SHA1 bca29e928cb03833db9c0b7f2a9b148d50c7f7fa
SHA512 aa72b199ece70da0d3dc11355149f2a6a92f84d72a13c2e2a3fdbb052be8ba6bd7410207fb772baa21011a7258424dd8b7fe717a70e934c002bc83fe8058084c
MD5 SHA1 SHA512

Password

infected

.rsrc/ICON/3.ico

SHA256 edbb8beb47706983393624a62a82c34ae902e89ca3ba1bb76c38c94aaa0610a8
MD5 98fb186a484242bb94359c02756f665f
SHA1 14136c6c45174ce91fa3561f900500a645e6299b
SHA512 3b5cd6be722401125af426e47e9fb05769b305ed2a45c40bd8d1f54ed654c6c7e426480b19289ad72d7ea752f248349574b08e85d8d4e216a20a07d42b762b84
SSDEEP 3:dlollPll2vglSvDNoltlP7AlWyvX:nFrN4XDA3vX
MD5 SHA1 SHA512 SSDEEP

.rsrc/ICON/4.ico

SHA256 9d3ce67a55c8c9654de1c81dd7ea394cec5284f935d15c084eb25b75b16f4899
MD5 c012b3494bcf569c93897a44ef5c8a97
SHA1 bb057ed491765e3f5c86b5bda71c69b363313414
SHA512 d5e3fe9a0df3f465c2ce4fd9ccd9cde01c9ab61021a722c100951d51bc65b89a8e7374cbc9ba09824b5c75ce70a2950871fd896a946f7a6ce0549d51ec60533a
SSDEEP 3:/l5llfl/t+lmltpUG8hll/ll/ZaIg:ClSDUG8xXAd
MD5 SHA1 SHA512 SSDEEP

.rsrc/ICON/5.ico

SHA256 a5f8f331a43b108f4fbe9505719f4f9ecaf8902dc8c24f16a8e9653e3635c0f2
MD5 08ed1700e45473290fa8f097482fa3e9
SHA1 6b2c9e0a9ce681952600e6bf93704b9043a4fafb
SHA512 6d149f1dd940f71b66c894afecfbe85b55e730d5aeccb876cd327bf17bbaa02b87bad05060ce2433d54c2d80015ad84c9357990337a33248d2b13cf9a028c125
MD5 SHA1 SHA512

.rsrc/MANIFEST/1

SHA256 2bf05590410fb6b30494a3251789f0d8a4b9da7f3e87fe89b64cace1bc0a02cd
MD5 98532ccf2df2c019bd9791a767c99973
SHA1 8a1cb5e5cf470e6b3ab544bf8009132d87d2326b
SHA512 2f3ae5393b95c33c17702d5d358c6545457112d96e2a3a8d7a2fd82bbaff6a82b29787d95b3c6f4dc69cc23373c8e129057f80b1e4ca072d3f4f1752067d664a
MD5 SHA1 SHA512

.text

SHA256 6cbf0a221c26d69af8cab6a9925b0b331082df7f79d671fafe3f4942145c76a3
MD5 00499a6f70259150109c809d6aa0e6ed
SHA1 3f4c995439cec283f1f51d71acb1f25bef740b63
SHA512 bad533ac5b9872c345212e7d70e23ab02dfa73b42882f76b45448d0a238afd1773e60ad755102a6d7b978af30acd78b0283b7f7f45c2cea9eacf869ea787a87d
SSDEEP 768:ZSuEBr5TxZ3ILakH+MQTbTf1YK5dEde6w4tKmc3K1RHpuiCYy:BErPZ3IBZcbTfu1HlrJFCP
MD5 SHA1 SHA512 SSDEEP

CERTIFICATE

SHA256 d6508cd5c0361d7522912aa315a01b72760af7276b459f93c7dda04a6428425a
MD5 6fe993ed2d8b98e8fff650d650cd99d7
SHA1 dc23ac2cadd7b3e8247c4204d8d5fbafc4fc07d1
SHA512 83b3e2c1ca4fff8f7154e61b1a6744eb0e6ebd5d18598a70b2f01eba668c45278d4298f2da2a589802f243c33f5e2d340053315f7e2f24f2febdda5c99e3b19a
SSDEEP 192:r2T3+4551q5CMqr+PBo21ZtDYNDxqHPTSofousUwzH2RO6F311Ny8jv0jzeEp:mu455w5k2mNDsSofousbHSOaPNy8cR
MD5 SHA1 SHA512 SSDEEP

[0]

SHA256 8f4fff35166f08142b23bf90e5c36f72c3a730b549d172768c2fa855a338122e
MD5 f4f0c5282559707670a306c46097ffcc
SHA1 3417351819d02450b527af5b3dbba95c52f911e5
SHA512 ebda56045c88ad3b87a896e06cf3747d411a28e4270554de5ad25a28343a4b3f54008dc4458e624097ea157208e2944d67c64770346047a202e0d978adf88175
MD5 SHA1 SHA512

[1]

SHA256 30b6e7841be9f8b802d35d02de89e101577888740aaba23cb2ec40866667651f
MD5 9930deb3a5a16e4497acfdb51087f35a
SHA1 00d907b425a948ccb984702ca073e7944b6711e9
SHA512 3a9519e3d8dcfad53755f5568332a7dff85d5a781c4f41ec59db28b9ead2b52f2f2ebace0395ad7b36954d0eb29d7c5be6f1a4a2cc993c5e516fe250bb19fb79
SSDEEP 24576:pUnuMrYtghpOGvCr0FqjMNmpcEDxpfvxv7mdJz:pUnuMrmYTvCQq4uf5md5
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

311e4c41ca958a2f68c41e7193386088ed187ac740a988cf12910e5177542020.zip

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

.data

.rdata

.reloc

.rsrc/DIALOG/105

.rsrc/DIALOG/106

.rsrc/DIALOG/111

.rsrc/GROUP_ICON/103

.rsrc/ICON/1

.rsrc/ICON/2

.rsrc/ICON/3.ico

.rsrc/ICON/4.ico

.rsrc/ICON/5.ico

.rsrc/MANIFEST/1

.text

CERTIFICATE

[0]

[1]