05ebe45dab4501184d8e7b0fdc079525f7731089c4dc5948c2e9ae00b9a14969.zip
- SHA256 05ebe45dab4501184d8e7b0fdc079525f7731089c4dc5948c2e9ae00b9a14969
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cnmpaui.dll
Resource
win10v2004-20260129-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
cnmpaui.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
cnmpaui.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 05ebe45dab4501184d8e7b0fdc079525f7731089c4dc5948c2e9ae00b9a14969.zip
- Size 1.1MB
- Sample260407-ncwsysd16n
- SHA256 05ebe45dab4501184d8e7b0fdc079525f7731089c4dc5948c2e9ae00b9a14969
- MD5 a8e94d8c561278569275a13dea56271e
- SHA1 f6bb7ed9a967d7dec3a0fbd5df83111b4ec2402d
- SHA512 fee9fc477a20c4b13ef667571cc1897386dae67fa45e610095c025c3743da8cc01d0d6a346a71deb643595cc57868e76ea7edc5bb72c58cbc0a8d566c6093bba
- SSDEEP 24576:WkkDSHNG/zrMh0c2PyC926Z/nVj8kFukC3lW:n90/z4ucs92E/nZ8glC3lW
- TLSH T1063533CF8551F316A66903C29DA98EBD1807A6F7B0FEDAE99361C13C3A099470351DDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cnmpaui.dll
File Explorer
-
05ebe45dab4501184d8e7b0fdc079525f7731089c4dc5948c2e9ae00b9a14969.zip.zip 1.1MB
-
cnmpaui.dll.dll 692KB
-
cnmpaui.exe.exe 351KB
-
cnmplog.dat622KB
cnmpaui.dll
- IMPHASH 28fee38a60df98249558c9815ae03dd3
- SHA256 b809ad77bd1df9acdd35378bc0defac5eb30941344c5eefd431ba0ae7a254e99
- MD5 0b8d371727c53237f8ac6918c410a6ea
- SHA1 b926da0f91feb7f0b3e7cda873c8c4f8f43bbcc1
- SHA512 7da9a25eb599316d7fac140aa7da747cf1ef53bd88cab5b6703ba58f05da7c7f891f6399a87cdd51939baeda9df44c97194bfef2d2bfda3ae0020d2264f533d5
- SSDEEP 12288:5ZgZvxbJ4VV7fkzXD65kh3covvLRnBfc70TYJa97fXra6j:EZvxbJM7fC6/g6QTqWL5
- TLSH T1C5E49D02F6C1D075D9CF1036021EF33E9AB86D254B60D9D7D390BDA86D763D12A38AE9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
343410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetLastError
SetEnvironmentVariableW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentProcessId
GetCurrentThreadId
CloseHandle
GetStdHandle
WaitForSingleObject
TerminateProcess
lstrlenW
ExpandEnvironmentStringsW
CreateFileW
ReadFile
WriteFile
FindNextFileW
FindClose
GetSystemInfo
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
GetCurrentProcess
VirtualAlloc
FreeLibrary
RaiseException
InitializeCriticalSection
DeleteCriticalSection
TryEnterCriticalSection
CreateSemaphoreA
ReleaseSemaphore
ResumeThread
GetExitCodeThread
Sleep
SwitchToThread
GetCurrentThread
SuspendThread
GetThreadContext
FreeLibraryAndExitThread
GetModuleHandleExW
TerminateThread
QueryPerformanceCounter
QueryPerformanceFrequency
OpenThread
VerSetConditionMask
VerifyVersionInfoW
GetConsoleOutputCP
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
IsDebuggerPresent
GlobalMemoryStatusEx
CreateEventW
SetEvent
RtlCaptureContext
GetEnvironmentVariableA
SetEndOfFile
HeapSize
GetStringTypeW
WriteConsoleW
GetModuleFileNameW
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleA
LocalFree
FormatMessageW
GetLastError
LockFileEx
VirtualFree
FlushFileBuffers
GetProcessHeap
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCPInfo
DecodePointer
HeapReAlloc
LCMapStringW
CompareStringW
ReadConsoleW
HeapFree
HeapAlloc
GetConsoleMode
SetFilePointerEx
GetFileSizeEx
ExitThread
CreateThread
ExitProcess
GetFileType
SetStdHandle
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwind
InterlockedFlushSList
EncodePointer
advapi32
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegOpenKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegFlushKey
RegCloseKey
ws2_32
recvfrom
recv
sendto
send
getsockname
getpeername
shutdown
accept
listen
connect
bind
getsockopt
ioctlsocket
closesocket
setsockopt
inet_ntoa
inet_addr
gethostbyaddr
htonl
gethostbyname
ntohl
getservbyport
getservbyname
ntohs
getprotobynumber
getprotobyname
WSACleanup
WSAStartup
WSAGetLastError
WSAIoctl
socket
MaintenanceAppStart
Name
.text
Size
460KB
Virtual Size
459KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
35KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.minfo
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=30795,
count=192, id=261, version=30795,
count=31, id=260, version=30795,
count=22, id=259, version=33428,
count=17, id=260, version=33428,
count=34, id=261, version=33428,
count=7, id=253, version=33428,
count=9, id=257, version=30795,
count=194, id=1, productName=Unmarked objects,
count=163, productName=Unmarked objects (old),
count=1, id=256, version=33521,
count=1, id=258, version=33521,
cnmpaui.exe
- IMPHASH 1a8face209c2457255f6ff7cf56dbf80
- SHA256 4ed76fa68ef9e1a7705a849d47b3d9dcdf969e332bd5bcb68138579c288a16d3
- MD5 0538e73fc195c3b4441721d4c60d0b96
- SHA1 baa569318144905563b469a5a006ad54eb616a02
- SHA512 61ea88618b317be4123d5ae9abf77c13e20f68510df014d00aaaa762933189e7f90af6d77f1df7e06b1e92690458027fea0b6e1e1f61d43c615a8bf8960da9ff
- SSDEEP 6144:Icf1ilncapZSD4CPpdOHFCJdCCKCjdHvvpphA7vvI1k:Lf+capZO4uaEJECKc3phAU1k
- TLSH T1C4747C1279808432C2B738704679F1B21DBEBC315D645A9E23EC2D7A5FB45907B29B2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d9:e0:ca:d0:6d:39:9b:f9:bf:b3:9b:f1:56:31:32:0a:1b:ce:a4:d7:e3:2d:e1:52:25:2b:d2:5b:3a:21:e6:a4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Canon Inc.,OU=Inkjet System Development Center,O=Canon Inc.,L=Kawasaki-shi,ST=Kanagawa,C=JP
Chains
Sep 21, 2017
CN=Canon Inc.,OU=Inkjet System Development Center,O=Canon Inc.,L=Kawasaki-shi,ST=Kanagawa,C=JP
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
76:e9:9a:bd:3f:ef:78:e7:6b:e2:62:af:b9:43:71:32:61:f3:d6:50
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Canon Inc.,OU=Inkjet System Development Center,O=Canon Inc.,L=Kawasaki-shi,ST=Kanagawa,C=JP
Chains
Sep 21, 2017
CN=Canon Inc.,OU=Inkjet System Development Center,O=Canon Inc.,L=Kawasaki-shi,ST=Kanagawa,C=JP
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
CN=Canon Inc.,OU=Inkjet System Development Center,O=Canon Inc.,L=Kawasaki-shi,ST=Kanagawa,C=JP
Serial Number
20:a9:47:94:7e:70:33:91:c3:00:8b:62:66:06:fa:8f
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 30, 2015 - Apr 18, 2018
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=Canon Inc.,OU=Inkjet System Development Center,O=Canon Inc.,L=Kawasaki-shi,ST=Kanagawa,C=JP
Serial Number
6b:64:8e:af:46:04:ee:3c:f3:aa:24:4b:02:86:f1:61
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 7, 2015 - Apr 18, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 2, 2017 - Apr 1, 2028
Minor OS version
1
Major OS version
5
Entry point
6759
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
G:\v320\Beta5\src\mnt\cnmmntexe\mnt\obj\Release\x86\cnmpaui.pdb
kernel32
GetCommandLineW
CloseHandle
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetProcAddress
LoadLibraryExW
LoadLibraryW
GlobalAlloc
GlobalFree
CreateFileW
DecodePointer
EncodePointer
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetConsoleCtrlHandler
GetProcessHeap
GetStringTypeW
GetFileType
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
WriteFile
GetModuleFileNameW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetCurrentThread
OutputDebugStringA
OutputDebugStringW
WaitForSingleObjectEx
CreateThread
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
RaiseException
winspool.drv
OpenPrinterW
ClosePrinter
user32
LoadImageW
DestroyIcon
UpdateWindow
ShowWindow
DestroyWindow
IsWindow
CreateWindowExW
RegisterClassExW
UnregisterClassW
PostQuitMessage
DefWindowProcW
SendMessageW
DispatchMessageW
GetMessageW
Name
.text
Size
234KB
Virtual Size
234KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
364B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=120, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=24123,
count=29, id=261, version=24123,
count=17, id=260, version=24123,
count=7, id=239, version=40116,
count=106, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
cnmplog.dat
- SHA256 c3e99e4bab018657ac13db6cdca892c3bcd62b3cc1e45ec470311c148b687127
- MD5 8519fa671c1381e33b20a7709e27ecb8
- SHA1 ec32f41cbdb479b33e471039318e2a4de6557dbe
- SHA512 95e48bcc70fde0525eb4b1f026a0931faf3d6f77928b85ab6bd83a14ade74894ac84a50f08a561271e71356a1e6996b391409c8132a797f8d898406750782517
- SSDEEP 12288:YSZ9ZgxlgtaU/nV9arkU/Q8M4+KgbdEknCQjm3Rv8q:YC926Z/nVj8kFukC3lB
- TLSH T15AD423CF8112F21B91A012C089558F7E080BA6FBE4F996E6A392913F7E03D9B1341DDD
- MD5 SHA1 SHA512 SSDEEP TLSH