MDE_File_Sample_31087f38def97fcdb2d8adb49de02ca35592fc7a.zip
- SHA256 9175415dd5ec76d9a2a2e77255b547089ffbfe65b68b8739a0662a624fc8ab27
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win11-20241007-en
windows11-21h2-x64
20 signatures
150 seconds
General
- Target MDE_File_Sample_31087f38def97fcdb2d8adb49de02ca35592fc7a.zip
- Size 445KB
- Sample250120-ry87ystpbw
- SHA256 9175415dd5ec76d9a2a2e77255b547089ffbfe65b68b8739a0662a624fc8ab27
- MD5 bb48a6c2193080b49898163d244e5bc9
- SHA1 a816d1b662ea1c4f88030a7269868b8d9919c50b
- SHA512 3f88d5a2ab7e24fff664b5a64d0b89e786e7dee8c42eb84bc7101202ae64ee93359894470df0622b4cceb98fcc3a5685bb4bdb70527bccf20dc962c45a897feb
- SSDEEP 12288:nQYWPajB4rFpuB9uscFPused1jrDOXeaAWzOtbwy:QYKG9uscFPu1TjrDwAWzORwy
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
MDE_File_Sample_31087f38def97fcdb2d8adb49de02ca35592fc7a.zip.zip 445KB
-
Setup.exe.exe 532KB
Setup.exe
- IMPHASH e00de6e48b9b06aceb12a81e7bf494c9
- SHA256 dd71a42c4795702df910d29a54b57b5e6b6ca80920faa8c25ef404a4cd8dc766
- MD5 4eabfcf845e5631623b2dd86337112d7
- SHA1 31087f38def97fcdb2d8adb49de02ca35592fc7a
- SHA512 7e63306d05793d40899d4e51ee1633583b574ad23bfc59d8ae2c36c4a0c689328d132c2a3ecd51240c185a35d867b9309320de6651f3ae1e7b93376afad4f411
- SSDEEP 12288:UG5knZfFKeTjOydwORmV42Y5RBHtf8WS8sejGxUeRx7/l1L:UG50ZfFKMjRCa0gDS8gee5Z
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Digest
40:2a:80:7e:eb:05:4b:79:1c:40:55:67:76:0a:10:c5:3d:cc:f6:90:7d:0c:58:41:49:a8:93:f6:50:b3:51:15
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=1417258-2,CN=7270356 Canada Inc.,O=7270356 Canada Inc.,L=Saint-Laurent,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
Chains
Jul 29, 2024
SERIALNUMBER=1417258-2,CN=7270356 Canada Inc.,O=7270356 Canada Inc.,L=Saint-Laurent,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US
CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Subject
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
4a:53:8c:28
Issuer
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 7, 2009 - Dec 7, 2030
Subject
CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US
Serial Number
4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Issuer
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
May 7, 2021 - Nov 7, 2030
Subject
CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US
Serial Number
35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Issuer
CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 7, 2021 - Dec 29, 2040
Subject
SERIALNUMBER=1417258-2,CN=7270356 Canada Inc.,O=7270356 Canada Inc.,L=Saint-Laurent,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
Serial Number
25:d0:cb:9d:7b:0d:6c:70:0c:da:e4:3d:24:3a:b1:c6
Issuer
CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 1, 2024 - May 1, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
84180
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
VariantClear
SysAllocString
user32
SendMessageA
SetTimer
DialogBoxParamW
DialogBoxParamA
SetWindowLongA
GetWindowLongA
SetWindowTextW
LoadIconA
LoadStringW
LoadStringA
CharUpperW
CharUpperA
DestroyWindow
EndDialog
PostMessageA
ShowWindow
MessageBoxW
GetDlgItem
KillTimer
SetWindowTextA
shell32
ShellExecuteExA
kernel32
GetCurrentDirectoryA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
GetCurrentProcess
TerminateProcess
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
SetUnhandledExceptionFilter
TlsAlloc
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
WaitForSingleObject
CloseHandle
CreateProcessA
GetCommandLineW
GetVersionExA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetLastError
LoadLibraryA
GetModuleFileNameW
GetModuleFileNameA
LocalFree
FormatMessageW
FormatMessageA
SetFileTime
CreateFileW
SetLastError
SetFileAttributesW
SetFileAttributesA
RemoveDirectoryW
RemoveDirectoryA
CreateDirectoryW
CreateDirectoryA
DeleteFileW
DeleteFileA
GetFullPathNameW
GetFullPathNameA
SetCurrentDirectoryW
SetCurrentDirectoryA
GetCurrentDirectoryW
GetTempPathW
GetTempPathA
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindFirstFileA
FindNextFileW
FindNextFileA
CreateFileA
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetStdHandle
WaitForMultipleObjects
Sleep
VirtualAlloc
VirtualFree
CreateEventA
SetEvent
ResetEvent
InitializeCriticalSection
RtlUnwind
RaiseException
HeapAlloc
HeapFree
HeapReAlloc
CreateThread
TlsSetValue
TlsGetValue
ExitThread
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=25, id=14, version=7299,
count=64, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=95, version=2190,
count=178, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=77, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=7, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,