observer | MeetUS-main[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

MeetUS-main.zip
Size

3.7MB
MD5

619988aeef5fac2571f4682bc8141296
SHA1

0c3c15d239810511c0f0b9fc5baaaaa74dae760d
SHA256

ebea0eac27e2e912b1d7143acf8d8b48bee4ebdfa4924a9f85d7516d5b405f34
SHA512

530e7a56dacd65f6ecf7ee7a0253d36629da01639b52b0d6916ab94b1b9dedcabbe43bcb293c9d74aebcb0c19d595e89b2cdd85874b775adac9e0fcd7c668042
SSDEEP

98304:X68ozMQIUEGOjFlreaNkcrckNk5LZh6rcXEyhH0L4cp:X6LzpIUK7DNkcrcQwXxULxp

Score

10^/10

observer

Malware Config

Extracted

Family

observer

http://91.103.252.17:8912

Signatures

Observer family
observer

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MeetUS-main/5e4bd44e47f14.exe
unpack001/MeetUS-main/guard.exe

Files

MeetUS-main.zip
.zip
MeetUS-main/5e4bd44e47f14.exe
.exe windows:6 windows x86 arch:x86

34fc5754badd722e29654c8e5ce4f927

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
GetConsoleWindow
LoadLibraryA
WideCharToMultiByte
CopyFileExW
ReadFile
GetFileSizeEx
HeapFree
CreateFileW
CloseHandle
LoadLibraryW
HeapAlloc
GetProcessHeap
ExpandEnvironmentStringsW
DeleteFileW
GetFileSize
CopyFileW
FindFirstFileExW
FindNextFileW
FindClose
GetFileAttributesW
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetUserDefaultLangID
MultiByteToWideChar
GetNativeSystemInfo
GlobalMemoryStatusEx
GetLastError
CreateProcessW
GetUserDefaultUILanguage
GetLocaleInfoW
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
CompareStringEx
GetCPInfo
GetSystemTimeAsFileTime
GetModuleHandleW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
GetFileType
SetFilePointerEx
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
WriteConsoleW

Sections

.text
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MeetUS-main/ChromeSetup.exe
.exe windows:6 windows x64 arch:x64

d52fe9cc2c19043b6e8a1ebec00b92bc

Code Sign

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:16:f1:4f:ba:9c:87:ab:97:ad:25:86:1e:e7:a9:dc
Certificate

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

27/09/2024, 07:50

Not After

27/09/2025, 07:50

Subject

SERIALNUMBER=91330185MA280YDY16,CN=Hangzhou Rongyi Network Technology Co.\, Ltd.,O=Hangzhou Rongyi Network Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:28:ab:ee:12:92:06:dc:cf:73:3f:86:a1:7e:4e:6f:7d:82:47:56:d6:80:b4:f8:71:c4:5a:89:88:3a:9c:aa
Signer

Actual PE Digest

1e:28:ab:ee:12:92:06:dc:cf:73:3f:86:a1:7e:4e:6f:7d:82:47:56:d6:80:b4:f8:71:c4:5a:89:88:3a:9c:aa

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

download_and_run.pdb

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

FlsSetValue
FlsFree
FreeConsole
FlsGetValue
GetConsoleOutputCP
HeapSize
LCMapStringW
FlsAlloc
GetCurrentProcess
DuplicateHandle
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetHandleInformation
GetCommandLineA
GetModuleHandleExW
RtlPcToFileHeader
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CloseHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
CreateIoCompletionPort
EncodePointer
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
WriteFile
SetFileCompletionNotificationModes
RtlUnwindEx
Sleep
GetModuleHandleA
GetProcAddress
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
QueryPerformanceCounter
GetSystemInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetSystemTimeAsFileTime
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointerEx
GetCurrentThreadId
GetStdHandle
GetCurrentProcessId
WriteFileEx
SleepEx
TerminateProcess
QueryPerformanceFrequency
HeapFree
CompareStringW
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetFinalPathNameByHandleW
InitializeCriticalSectionAndSpinCount
CreateMutexA
GetConsoleMode
GetFileType
LoadLibraryA
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
SetEnvironmentVariableW
ExitProcess
CreateNamedPipeW
ReadFileEx
GetFullPathNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
GetTempPathW
WaitForSingleObjectEx

secur32

DecryptMessage
EncryptMessage
DeleteSecurityContext
ApplyControlToken
InitializeSecurityContextW
FreeCredentialsHandle
AcquireCredentialsHandleA
FreeContextBuffer
AcceptSecurityContext
QueryContextAttributesW

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ws2_32

WSASend
send
recv
shutdown
setsockopt
ioctlsocket
connect
bind
WSASocketW
getsockname
getpeername
freeaddrinfo
getsockopt
getaddrinfo
WSAGetLastError
WSAStartup
WSAIoctl
closesocket
WSACleanup

crypt32

CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertDuplicateCertificateContext
CertDuplicateStore
CertDuplicateCertificateChain
CertFreeCertificateChain
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore

ntdll

RtlNtStatusToDosError
NtCreateFile
NtDeviceIoControlFile
NtCancelIoFileEx
NtWriteFile

user32

MessageBoxW

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 671KB - Virtual size: 671KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MeetUS-main/PluginRequiments.exe
.exe windows:6 windows x64 arch:x64

d52fe9cc2c19043b6e8a1ebec00b92bc

Code Sign

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:16:f1:4f:ba:9c:87:ab:97:ad:25:86:1e:e7:a9:dc
Certificate

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

27/09/2024, 07:50

Not After

27/09/2025, 07:50

Subject

SERIALNUMBER=91330185MA280YDY16,CN=Hangzhou Rongyi Network Technology Co.\, Ltd.,O=Hangzhou Rongyi Network Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:3a:17:6c:4b:e9:14:8c:32:3f:34:aa:53:3e:53:86:df:38:e0:94:51:94:08:16:5d:0a:3a:4c:ce:55:fc:ab
Signer

Actual PE Digest

50:3a:17:6c:4b:e9:14:8c:32:3f:34:aa:53:3e:53:86:df:38:e0:94:51:94:08:16:5d:0a:3a:4c:ce:55:fc:ab

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

download_and_run.pdb

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

FlsSetValue
FlsFree
FreeConsole
FlsGetValue
GetConsoleOutputCP
HeapSize
LCMapStringW
FlsAlloc
GetCurrentProcess
DuplicateHandle
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetHandleInformation
GetCommandLineA
GetModuleHandleExW
RtlPcToFileHeader
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CloseHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
CreateIoCompletionPort
EncodePointer
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
WriteFile
SetFileCompletionNotificationModes
RtlUnwindEx
Sleep
GetModuleHandleA
GetProcAddress
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
QueryPerformanceCounter
GetSystemInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetSystemTimeAsFileTime
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointerEx
GetCurrentThreadId
GetStdHandle
GetCurrentProcessId
WriteFileEx
SleepEx
TerminateProcess
QueryPerformanceFrequency
HeapFree
CompareStringW
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetFinalPathNameByHandleW
InitializeCriticalSectionAndSpinCount
CreateMutexA
GetConsoleMode
GetFileType
LoadLibraryA
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
SetEnvironmentVariableW
ExitProcess
CreateNamedPipeW
ReadFileEx
GetFullPathNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
GetTempPathW
WaitForSingleObjectEx

secur32

DecryptMessage
EncryptMessage
DeleteSecurityContext
ApplyControlToken
InitializeSecurityContextW
FreeCredentialsHandle
AcquireCredentialsHandleA
FreeContextBuffer
AcceptSecurityContext
QueryContextAttributesW

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ws2_32

WSASend
send
recv
shutdown
setsockopt
ioctlsocket
connect
bind
WSASocketW
getsockname
getpeername
freeaddrinfo
getsockopt
getaddrinfo
WSAGetLastError
WSAStartup
WSAIoctl
closesocket
WSACleanup

crypt32

CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertDuplicateCertificateContext
CertDuplicateStore
CertDuplicateCertificateChain
CertFreeCertificateChain
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore

ntdll

RtlNtStatusToDosError
NtCreateFile
NtDeviceIoControlFile
NtCancelIoFileEx
NtWriteFile

user32

MessageBoxW

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 671KB - Virtual size: 670KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MeetUS-main/PluginRequirements.exe
.exe windows:6 windows x64 arch:x64

5f4c3626a7bfff3e94f2d0a39810ea6e

Code Sign

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:16:f1:4f:ba:9c:87:ab:97:ad:25:86:1e:e7:a9:dc
Certificate

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

27/09/2024, 07:50

Not After

27/09/2025, 07:50

Subject

SERIALNUMBER=91330185MA280YDY16,CN=Hangzhou Rongyi Network Technology Co.\, Ltd.,O=Hangzhou Rongyi Network Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN,1.3.6.1.4.1.311.60.2.1.1=#130848616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a5:f0:4f:9a:ee:7e:04:88:16:7c:75:15:08:a7:d3:6a:b1:b2:cf:e5:1b:9f:37:36:16:fe:9d:63:c9:d4:05:c2
Signer

Actual PE Digest

a5:f0:4f:9a:ee:7e:04:88:16:7c:75:15:08:a7:d3:6a:b1:b2:cf:e5:1b:9f:37:36:16:fe:9d:63:c9:d4:05:c2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

download_and_run.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressSingle
WakeByAddressAll

kernel32

GetConsoleOutputCP
HeapSize
LCMapStringW
CompareStringW
CloseHandle
FreeConsole
GetCurrentProcess
DuplicateHandle
SetHandleInformation
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
ReadFile
GetOverlappedResult
WriteFile
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
GetProcAddress
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
QueryPerformanceCounter
GetSystemInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointerEx
GetStdHandle
GetCurrentProcessId
WriteFileEx
SleepEx
GetExitCodeProcess
TerminateProcess
QueryPerformanceFrequency
HeapFree
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetFinalPathNameByHandleW
CreateEventW
CancelIo
GetConsoleMode
GetFileType
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
SetEnvironmentVariableW
ExitProcess
CreateNamedPipeW
ReadFileEx
WaitForMultipleObjects
GetFullPathNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
GetTempPathW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetSystemTimeAsFileTime
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
InitializeSListHead
IsDebuggerPresent
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
RtlPcToFileHeader
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
EncodePointer
RtlUnwindEx
GetCurrentThreadId

user32

MessageBoxW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

secur32

AcceptSecurityContext
DecryptMessage
DeleteSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleA
ApplyControlToken
InitializeSecurityContextW
EncryptMessage
FreeContextBuffer
QueryContextAttributesW

ws2_32

WSASend
send
recv
shutdown
getsockopt
ioctlsocket
connect
bind
WSASocketW
setsockopt
WSAIoctl
closesocket
WSAGetLastError
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
getsockname
getpeername

crypt32

CertEnumCertificatesInStore
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertDuplicateCertificateContext
CertDuplicateStore
CertDuplicateCertificateChain
CertFreeCertificateChain
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore

ntdll

NtCreateFile
NtCancelIoFileEx
NtDeviceIoControlFile
RtlNtStatusToDosError
NtReadFile
NtWriteFile

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 675KB - Virtual size: 675KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MeetUS-main/guard.exe
.exe windows:6 windows x64 arch:x64

d52fe9cc2c19043b6e8a1ebec00b92bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

download_and_run.pdb

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

FlsSetValue
FlsFree
FreeConsole
FlsGetValue
GetConsoleOutputCP
HeapSize
LCMapStringW
FlsAlloc
GetCurrentProcess
DuplicateHandle
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetHandleInformation
GetCommandLineA
GetModuleHandleExW
RtlPcToFileHeader
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CloseHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
CreateIoCompletionPort
EncodePointer
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
WriteFile
SetFileCompletionNotificationModes
RtlUnwindEx
Sleep
GetModuleHandleA
GetProcAddress
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
QueryPerformanceCounter
GetSystemInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetSystemTimeAsFileTime
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointerEx
GetCurrentThreadId
GetStdHandle
GetCurrentProcessId
WriteFileEx
SleepEx
TerminateProcess
QueryPerformanceFrequency
HeapFree
CompareStringW
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetFinalPathNameByHandleW
InitializeCriticalSectionAndSpinCount
CreateMutexA
GetConsoleMode
GetFileType
LoadLibraryA
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
SetEnvironmentVariableW
ExitProcess
CreateNamedPipeW
ReadFileEx
GetFullPathNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
GetTempPathW
WaitForSingleObjectEx

secur32

DecryptMessage
EncryptMessage
DeleteSecurityContext
ApplyControlToken
InitializeSecurityContextW
FreeCredentialsHandle
AcquireCredentialsHandleA
FreeContextBuffer
AcceptSecurityContext
QueryContextAttributesW

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ws2_32

WSASend
send
recv
shutdown
setsockopt
ioctlsocket
connect
bind
WSASocketW
getsockname
getpeername
freeaddrinfo
getsockopt
getaddrinfo
WSAGetLastError
WSAStartup
WSAIoctl
closesocket
WSACleanup

crypt32

CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertDuplicateCertificateContext
CertDuplicateStore
CertDuplicateCertificateChain
CertFreeCertificateChain
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore

ntdll

RtlNtStatusToDosError
NtCreateFile
NtDeviceIoControlFile
NtCancelIoFileEx
NtWriteFile

user32

MessageBoxW

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 671KB - Virtual size: 670KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

34fc5754badd722e29654c8e5ce4f927

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 203KB - Virtual size: 202KB

.rdata Size: 60KB - Virtual size: 60KB

.data Size: 4KB - Virtual size: 13KB

.reloc Size: 9KB - Virtual size: 9KB

d52fe9cc2c19043b6e8a1ebec00b92bc

Code Sign

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89Certificate

Extended Key Usages

Key Usages

16:16:f1:4f:ba:9c:87:ab:97:ad:25:86:1e:e7:a9:dcCertificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

1e:28:ab:ee:12:92:06:dc:cf:73:3f:86:a1:7e:4e:6f:7d:82:47:56:d6:80:b4:f8:71:c4:5a:89:88:3a:9c:aaSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

secur32

advapi32

ws2_32

crypt32

ntdll

user32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 671KB - Virtual size: 671KB

.data Size: 14KB - Virtual size: 19KB

.pdata Size: 36KB - Virtual size: 35KB

.reloc Size: 19KB - Virtual size: 18KB

d52fe9cc2c19043b6e8a1ebec00b92bc

Code Sign

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89Certificate

Extended Key Usages

Key Usages

16:16:f1:4f:ba:9c:87:ab:97:ad:25:86:1e:e7:a9:dcCertificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

50:3a:17:6c:4b:e9:14:8c:32:3f:34:aa:53:3e:53:86:df:38:e0:94:51:94:08:16:5d:0a:3a:4c:ce:55:fc:abSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

secur32

advapi32

ws2_32

.text
Size: 203KB - Virtual size: 202KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 4KB - Virtual size: 13KB

.reloc
Size: 9KB - Virtual size: 9KB

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

16:16:f1:4f:ba:9c:87:ab:97:ad:25:86:1e:e7:a9:dc
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

1e:28:ab:ee:12:92:06:dc:cf:73:3f:86:a1:7e:4e:6f:7d:82:47:56:d6:80:b4:f8:71:c4:5a:89:88:3a:9c:aa
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 671KB - Virtual size: 671KB

.data
Size: 14KB - Virtual size: 19KB

.pdata
Size: 36KB - Virtual size: 35KB

.reloc
Size: 19KB - Virtual size: 18KB

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

16:16:f1:4f:ba:9c:87:ab:97:ad:25:86:1e:e7:a9:dc
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

50:3a:17:6c:4b:e9:14:8c:32:3f:34:aa:53:3e:53:86:df:38:e0:94:51:94:08:16:5d:0a:3a:4c:ce:55:fc:ab
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 671KB - Virtual size: 670KB

.data
Size: 14KB - Virtual size: 19KB

.pdata
Size: 36KB - Virtual size: 35KB

.reloc
Size: 19KB - Virtual size: 18KB

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

16:16:f1:4f:ba:9c:87:ab:97:ad:25:86:1e:e7:a9:dc
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

a5:f0:4f:9a:ee:7e:04:88:16:7c:75:15:08:a7:d3:6a:b1:b2:cf:e5:1b:9f:37:36:16:fe:9d:63:c9:d4:05:c2
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 675KB - Virtual size: 675KB

.data
Size: 14KB - Virtual size: 19KB

.pdata
Size: 36KB - Virtual size: 36KB

.reloc
Size: 19KB - Virtual size: 18KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 671KB - Virtual size: 670KB

.data
Size: 14KB - Virtual size: 19KB

.pdata
Size: 36KB - Virtual size: 35KB

.reloc
Size: 19KB - Virtual size: 18KB