jupyter | Chapter 2[.]zip

resource	yara_rule
static1/unpack001/Challenge_1.dll	family_jupyter

resource	yara_rule
static1/unpack001/8888888.png	cryptone

resource
unpack001/8888888.png

resource
unpack001/Challenge_1.dll
unpack001/Challenge_2.bin
unpack001/filetype.exe
unpack001/md5-1.exe
unpack001/md5-2.exe
unpack008/ssdeep-2.14.1/fuzzy.dll
unpack008/ssdeep-2.14.1/ssdeep.exe

Chapter 2.zip

SHA256 d07bdefcabeb6ef9fd8066d5fd79777225bc0725aef6e737f16c643ae9662559
MD5 0f4a961ef5bfaaff6f1bfbcc55edad56
SHA1 8c601b0717fcf6b5275de0e29630d72821782397
SHA512 9da755d95d9cf6fd22927dcb2e683f8135f973beffd8c428b98a43eb6ac2ea2360de7f337ab1267900c7d4433d48baf52ffa1a5ebf22eb95b33b35f9658281f8
SSDEEP 98304:Glt3iHt3Bk5T0SU5cp6QyC9FlxWKLDXF5vCeGxzCO3jXoltnsWU:Gj3cBqT0rcpDyC2Kn3vCeK2O2tPU
TLSH
T12C1633F58161FAE4F2042EF54066C28BA5C77872FFEA5D368A8145EB4C84F7F9B80590
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

8888888.png

IMPHASH 68d91b46eb0976c4f7c6b9ba2c81af54
SHA256 a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4
MD5 136b9c85525ba66276b8c9f6b7014b0b
SHA1 0cf5ba13d14c28c60586c7f4b9679925fa4d4172
SHA512 0c02b116029a7d4f4c44988dc6220ed4050c94cab6e57f4aeb29d8edd0b8b59e74c89d6bd62e6e828826f44ebfb478280051ca289ea712c52d5fd113541e2590
SSDEEP 6144:JanAo3boaSrTBRc6nWF84LvSkgNSjEtIovH6DgJG3uhRtSUgnSt9BYbC38g/T4J:JaAKoRrTBHWC4LINSjA/EMGU/SHomaI
TLSH
T14045C04073B05C0AF1F98FB4D8B656AA4430BE41BA34DD1B919068CEFDF529295F87A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

CryptOne packer

Detects CryptOne packer defined in NCC blogpost.

cryptone packer
Codesign digest Mismatch

File was altered after it was signed.

Password

infected

PE Signature issue

Digest

ee:d7:2a:b1:7c:a1:f9:c4:1d:45:e6:1c:64:d7:72:3a:aa:aa:87:2f

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

10576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError Sleep LoadLibraryA GetProcAddress GetModuleHandleW IsValidLocale GetOverlappedResult CommConfigDialogW lstrcmpiA WriteConsoleOutputA DeleteTimerQueueTimer SetHandleCount GetSystemTimeAsFileTime GlobalGetAtomNameW EnumSystemCodePagesA GetNamedPipeHandleStateA CompareStringW GetProcessAffinityMask ReadConsoleOutputCharacterW SetMessageWaitingIndicator GetProfileIntA Process32FirstW GetPrivateProfileSectionA FlushConsoleInputBuffer GetVersion GetModuleHandleA MultiByteToWideChar GetVersionExW CreateFileW WriteFile GetEnvironmentVariableW GetSystemTime GetCurrentProcessId FindNextFileW FindClose GetSystemTimeAdjustment QueryPerformanceCounter FindFirstFileW GlobalMemoryStatus GetCurrentThreadId GetLogicalDriveStringsW QueryPerformanceFrequency CloseHandle CreateProcessW WaitForSingleObject CreateFileMappingA MapViewOfFile UnmapViewOfFile ExpandEnvironmentStringsA GetStdHandle GetFileType WaitForMultipleObjects PeekNamedPipe ReadFile GetTickCount GetVersionExA SleepEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection FormatMessageA SetLastError FormatMessageW LocalFree OutputDebugStringW FreeLibrary LoadLibraryW GetCurrentThread SuspendThread MulDiv MoveFileExW GetModuleFileNameW SetErrorMode WideCharToMultiByte InterlockedIncrement InterlockedDecrement CreateMutexW ReleaseMutex CreateSemaphoreW ReleaseSemaphore TlsSetValue ExitProcess SetThreadPriority ResumeThread TlsGetValue TlsFree TlsAlloc FindResourceW GetCPInfo IsValidCodePage TerminateProcess SizeofResource LockResource LoadResource GetFileAttributesW GetTempPathW GetFileTime GetFileSize GetTempFileNameW CopyFileW SetCurrentDirectoryW GetACP GetUserDefaultLCID GetLocaleInfoW SetThreadLocale RaiseException SetEvent CreateThread IsBadReadPtr IsBadStringPtrA ExpandEnvironmentStringsW GetCommandLineW FreeConsole ReadConsoleOutputCharacterA GetConsoleScreenBufferInfo WriteConsoleA WriteConsoleW FillConsoleOutputCharacterW SetConsoleCursorPosition GlobalUnlock GlobalAlloc GlobalSize GlobalLock HeapSize GetProcessHeap GlobalFree InterlockedExchange EncodePointer DecodePointer HeapFree HeapAlloc HeapReAlloc GetCommandLineA HeapSetInformation GetStartupInfoW RtlUnwind ExitThread FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle SetFilePointer GetDriveTypeA FindFirstFileExA GetTimeZoneInformation CreateFileA SetConsoleCtrlHandler ReadConsoleInputA SetConsoleMode GetConsoleMode GetTimeFormatW GetDateFormatW DeleteFileW GetConsoleCP FlushFileBuffers SetStdHandle InitializeCriticalSectionAndSpinCount MoveFileW RemoveDirectoryW CreateDirectoryW GetFullPathNameW LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate IsProcessorFeaturePresent FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetFullPathNameA GetExitCodeProcess SetEndOfFile GetStringTypeW SetEnvironmentVariableA SetEnvironmentVariableW GetDriveTypeW GetLocaleInfoA EnumSystemLocalesA GetModuleFileNameA GetCurrentProcess GetCurrentDirectoryW GetSystemDirectoryW lstrlenW SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetFileAttributesW LocalAlloc lstrcmpW WriteProcessMemory WritePrivateProfileStringW VirtualProtect VirtualFree VirtualAlloc TerminateThread SystemTimeToFileTime HeapDestroy GlobalHandle GetSystemInfo GetPrivateProfileStringW GetLocalTime GetComputerNameW InterlockedExchangeAdd InterlockedCompareExchange FlushInstructionCache CreateFileMappingW GetUserDefaultUILanguage

user32

CreatePopupMenu CloseClipboard AnyPopup CreateMenu CountClipboardFormats EndMenu LoadCursorFromFileW GetWindowDC GetWindowTextLengthW IsCharLowerW LoadCursorFromFileA LoadIconW MessageBoxW GetScrollInfo SetScrollInfo EnableScrollBar ScrollWindow GetParent WindowFromPoint SetParent RedrawWindow ScreenToClient ClientToScreen IsWindowVisible IsWindowEnabled GetMessageTime GetActiveWindow GetWindow ChildWindowFromPointEx UnhookWindowsHookEx CallNextHookEx TrackPopupMenu CallWindowProcW IsDialogMessageW InvalidateRect FillRect IsWindow SetWindowTextW GetSysColor GetClientRect SetFocus ReleaseCapture SetCursorPos UpdateWindow MoveWindow DeferWindowPos GetWindowRect GetUpdateRgn MapWindowPoints BeginDeferWindowPos EndDeferWindowPos SystemParametersInfoW GetMenuItemInfoW GetMenuItemCount SetWindowsHookExW RegisterHotKey UnregisterHotKey PtInRect InflateRect SetMenu CreateIconIndirect BringWindowToTop IsIconic SetForegroundWindow IsZoomed FlashWindow CreateDialogIndirectParamW GetWindowPlacement DrawMenuBar EnableMenuItem GetSystemMenu CreateDialogParamW GetDlgItem SetWindowRgn LoadImageW MessageBeep GetClassNameW GetWindowTextW DestroyCursor BeginPaint EndPaint ChangeDisplaySettingsW EnumDisplaySettingsW GetDoubleClickTime DrawFrameControl OffsetRect DrawIconEx SetCapture DrawTextW CopyRect DrawStateW SetRectEmpty DrawFocusRect GetMenuState GetSysColorBrush CheckMenuItem CheckMenuRadioItem ShowWindow SetRect DrawEdge GetClipboardFormatNameW RegisterClipboardFormatW DestroyMenu GetSubMenu InsertMenuW InsertMenuItemW RemoveMenu ModifyMenuW AppendMenuW HideCaret keybd_event FindWindowExW DestroyAcceleratorTable CreateAcceleratorTableW TranslateAcceleratorW UnionRect IsRectEmpty ValidateRgn ChildWindowFromPoint IsClipboardFormatAvailable GetDialogBaseUnits wsprintfW ShowCursor AdjustWindowRectEx DdeCreateStringHandleW DdeClientTransaction DdeDisconnect DdeInitializeW DdeGetLastError DdeCreateDataHandle DdeGetData DdeFreeDataHandle DdeQueryStringW DdeUninitialize DdeFreeStringHandle LoadCursorW SetCursor MsgWaitForMultipleObjects GetMessageW DispatchMessageW SetTimer KillTimer PeekMessageW DestroyWindow DefWindowProcW UnregisterClassW RegisterClassW PostMessageW CreateWindowExW PostThreadMessageW ValidateRect SetWindowPos GetFocus EnableWindow SetWindowLongW GetWindowLongW GetAsyncKeyState SetActiveWindow VkKeyScanW MapVirtualKeyW TranslateMessage PostQuitMessage GetMessagePos GetIconInfo LoadBitmapW GetKeyState DestroyIcon DdePostAdvise MessageBoxA GetDesktopWindow GetProcessWindowStation GetUserObjectInformationW GetCapture GetCursorPos SendMessageA FindWindowA GetSystemMetrics ReleaseDC GetDC RegisterWindowMessageW SendMessageTimeoutW SendMessageW FindWindowW DdeConnect SetMenuItemInfoW DdeNameService

gdi32

GetBkColor DeleteObject GetTextColor AbortPath CreateMetaFileA GetFontLanguageInfo GetBkMode CreateMetaFileW CancelDC GetEnhMetaFileA GetGraphicsMode GetLayout RealizePalette CreateCompatibleDC GetObjectType CreateHalftonePalette CreatePatternBrush GetStockObject SaveDC DeleteDC GetSystemPaletteUse GetDCPenColor GetEnhMetaFileW BeginPath WidenPath GetStretchBltMode CloseMetaFile EndPath FillPath GdiGetBatchLimit PathToRegion SwapBuffers AddFontResourceW FlattenPath AddFontResourceA GetPixelFormat GetTextCharset GdiFlush AbortDoc GetTextAlign GetMapMode EndPage DeleteColorSpace EndDoc DeleteMetaFile CreateSolidBrush UpdateColors UnrealizeObject GetPolyFillMode DeleteEnhMetaFile GetTextCharacterExtra CloseEnhMetaFile CloseFigure GetDCBrushColor GetColorSpace GetROP2 SetMetaRgn StrokePath QueryFontAssocStatus SetDIBColorTable GdiEntry8 FontIsLinked EngCreateSemaphore OffsetViewportOrgEx SetTextColor GdiGetSpoolFileHandle GetEnhMetaFilePixelFormat EngStretchBltROP GdiEndPageEMF OffsetRgn EngLockSurface SetLayoutWidth GdiPlayScript Rectangle XLATEOBJ_hGetColorTransform FONTOBJ_pvTrueTypeFontFile GetCharWidthA GdiSwapBuffers SetWorldTransform GetPixel GdiCleanCacheDC ExtCreatePen GetWorldTransform ResetDCW STROBJ_bEnumPositionsOnly GetTextExtentPointI GdiEntry14 CreateEllipticRgn EngCheckAbort CreateBitmapIndirect CreateICA SetBitmapBits GdiQueryFonts GetSystemPaletteEntries CreateICW SetTextAlign CreateRectRgnIndirect GetTextExtentExPointW GetPaletteEntries GetNearestPaletteIndex CreatePalette CreatePen CreateHatchBrush EnumFontFamiliesExW Polyline SetROP2 SetViewportOrgEx SetPixel PolyBezier SetWindowOrgEx PlayEnhMetaFile SetAbortProc StartDocW StartPage CreateDCW GetEnhMetaFileHeader CreateEnhMetaFileW GetClipBox CreateFontIndirectW SetBkMode StretchBlt MoveToEx SetWindowExtEx SetViewportExtEx SetMapMode SelectClipRgn SetStretchBltMode ExtSelectClipRgn ExtFloodFill Arc Pie Polygon LineTo GetRegionData ExtCreateRegion SetBkColor CreateBitmap GetObjectW ExcludeClipRect SetBrushOrgEx CreateRectRgn SelectPalette GetTextMetricsW GetOutlineTextMetricsW GetCharABCWidthsW CombineRgn RectInRegion PtInRegion EqualRgn GetRgnBox GetDIBColorTable CreateDIBitmap GetDIBits CreateDIBSection GetTextExtentPoint32W StretchDIBits ExtTextOutW MaskBlt Ellipse RoundRect PolyPolygon SetPolyFillMode GetDeviceCaps BitBlt SelectObject CreateCompatibleBitmap

comdlg32

PageSetupDlgW PrintDlgW ChooseFontW GetSaveFileNameW GetOpenFileNameW CommDlgExtendedError

advapi32

GetUserNameA RegOpenKeyA RegQueryValueExA FreeSid RegOpenKeyExW RegCloseKey RegEnumValueW RegSetValueExW RegCreateKeyExW RegQueryValueExW RegDeleteValueW RegEnumKeyW RegDeleteKeyW GetUserNameW DeregisterEventSource ReportEventA RegisterEventSourceA

shell32

SHFileOperation SHGetDesktopFolder SHFileOperationW SHPathPrepareForWriteW SHBrowseForFolderA WOWShellExecute FindExecutableW SHFormatDrive ShellAboutW SHLoadNonloadedIconOverlayIdentifiers ExtractIconW SHGetFileInfoW DragFinish SHGetMalloc DragQueryFileW ExtractIconExW ShellExecuteExW SHGetPathFromIDListW DragAcceptFiles DragQueryPoint SHGetSpecialFolderLocation

ole32

OleGetClipboard OleFlushClipboard OleIsCurrentClipboard OleSetClipboard CoLockObjectExternal RegisterDragDrop RevokeDragDrop CoTaskMemAlloc ReleaseStgMedium OleInitialize OleUninitialize CoCreateInstance CoCreateGuid OleLockRunning OleRun OleSetContainedObject

shlwapi

StrChrIA

comctl32

ImageList_GetImageCount ImageList_GetIconSize ImageList_Create ImageList_Add ImageList_ReplaceIcon ImageList_Replace ImageList_Remove ImageList_Draw ImageList_SetBkColor ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragMove ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_Destroy

Challenge_1.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b6d7e579a24efc09c2dba13ca90622790866e017a3311c1809c5041e91b7a930
MD5 ed629af9a127724d64185a26d00ae62d
SHA1 3204c4352e4765ecf64b9bfa1b5e31c06b9577cc
SHA512 ac989c584c067425ae2e67111b869239c0548baf085edcd9edb017056cfa3edb208d5fc5431ebb351c190fd4c9adffb673eaf5fc994d7833efcec6ff3511c55f
SSDEEP 3072:C5OLkQW8JS0k0wcBalDIs3hlAp5+hQQE89X3Qo+PgaE3:CsWnGYlAp5+hR9sYaE
TLSH
T1C104411D29EB00D2CDED6EF68100693E9A30B802D7465F5C1EC54DEB2AA7D3AC9DD50B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Jupyter Backdoor/Client payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

179918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Challenge_2.bin

IMPHASH 9ecee117164e0b870a53dd187cdd7174
SHA256 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
MD5 db349b97c37d22f5ea1d1841e3c89eb4
SHA1 e889544aff85ffaf8b0d0da705105dee7c97fe26
SHA512 d6c60b8f22f89cbd1262c0aa7ae240577a82002fb149e9127d4edf775a25abcda4e585b6113e79ab4a24bb65f4280532529c2f06f7ffe4d5db45c0caf74fea38
SSDEEP 98304:wDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3R:wDqPe1Cxcxk3ZAEUadzR8yc4gB
TLSH
T1B70633A8962DA1BCF0050DB044928557EBFB3C57B7BA5A2FCF4045660D43B6F9BC0E61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

39446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject InterlockedIncrement GetCurrentThreadId GetCurrentThread ReadFile GetFileSize CreateFileA MoveFileExA SizeofResource TerminateThread LoadResource FindResourceA GetProcAddress GetModuleHandleW ExitProcess GetModuleFileNameA LocalFree LocalAlloc CloseHandle InterlockedDecrement EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GlobalAlloc GlobalFree QueryPerformanceFrequency QueryPerformanceCounter GetTickCount LockResource Sleep GetStartupInfoA GetModuleHandleA

advapi32

StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA ChangeServiceConfig2A SetServiceStatus OpenSCManagerA CreateServiceA CloseServiceHandle StartServiceA CryptGenRandom CryptAcquireContextA OpenServiceA

ws2_32

closesocket recv send htonl ntohl WSAStartup inet_ntoa ioctlsocket select htons socket connect inet_addr

msvcp60

??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ

iphlpapi

GetAdaptersInfo GetPerAdapterInfo

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle

msvcrt

__set_app_type _stricmp __p__fmode __p__commode _except_handler3 __setusermatherr _initterm __getmainargs _acmdln _adjust_fdiv _controlfp exit _XcptFilter _exit _onexit __dllonexit free ??2@YAPAXI@Z _ftol sprintf _endthreadex strncpy rand _beginthreadex __CxxFrameHandler srand time __p___argc

filetype.exe

IMPHASH 0c4f4ffc91ae78ca0c16ffa93c240b69
SHA256 0283ee684729fc204a985e358eea93ae4010894a0a662ffd1267e1e78e9de624
MD5 1f2eab66674cd1820fcd06a20b0a7ab8
SHA1 0dc9e1b02e72b3f2630e47e715568cfceea9ab35
SHA512 066936f34d655ce6d6023dc08182e0d69686528460e003d885b1be0f386021ce8c607f16eb964ad8d3ff56e5a6dce65916abbd93b59c0ba83520574f6849c112
SSDEEP 768:XPy45aRacSB9ivfCw7LjfYV4spkvlS63ul:XBEaHBsfCOLjfmNkvl+l
TLSH
T1AC138E267CE3C077C89546F406694B0AAB3F611143F595835B9C68ADEF632D06E3F34A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

9935

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\src\vc\filetype\Release\filetype.pdb

filetypes.dat

SHA256 eb246e4d501c7a8ecb23d0fe66bfab9df5cee451f77ff02bc49038d90dfc8f91
MD5 1aeeebe89173869055f1a1b946976d35
SHA1 ee7ed3b4af21ac692dcef6ce4e3f2296feabafd9
SHA512 926d07bb53073d6fcc7cc0abc0c75b242f49a06b61a0148e54f9bd88f13d8e162345140677bb8f50e214c3d13ed40ddb1d6fcd47f1551b27865c833890211d48
SSDEEP 96:/hMFNCNTTOaCkKaCkkZda2cF3dBFsAEB1LWaVfuHYI2:/uFNyTghXabbjEb6aVfup2
TLSH
T17C9150F466294784E3E141502B773D7A4809B2AE3FD70AD4217CC75C26BC30C98C2AEE
MD5 SHA1 SHA512 SSDEEP TLSH

md5-1.exe

IMPHASH 23285270545de4353386c2c1c9ed45a4
SHA256 e16a3e7bea60ab2aa1e49e31199791648c58b14d1691935f25f3bd4e94f2f34b
MD5 665ff1dd581f97b33af9b7fb9f695912
SHA1 ec762b486a048e1ec88a04e07f107499cfac2c92
SHA512 63ff81533b5089672e83ea740b77739bbd0594f3a6f98df30a6983f724d4bd4132db468457bb6368e629ed4083018e3860ddbdeed1708b45c425060fd4596b4f
SSDEEP 24:eWpTD7ncAWq4Uz75TN4+8t1XDsc1+/qxB/qVsHBoGGmHBoG8:5TD7+mJNt8HXDsqrguBoMBoj
TLSH
T188E1214B5B054D32D44E2B358897264BFADB1B7017F34160E744A80F3B72A95A73DF14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

md5-2.exe

IMPHASH 23285270545de4353386c2c1c9ed45a4
SHA256 84af18cfd067df107b790edde3dbd23a0379f8fbbd1913ab0cea74c4378f4569
MD5 665ff1dd581f97b33af9b7fb9f695912
SHA1 89755b503f7f45aa28ef5567c679bb9d0de20309
SHA512 63e4f2f8a2dc1c835e44e54635dca68b4fb6321327a1e2bbacecbb31ba625957f0429bce58dfa303ea99aa18afd20a2eedcba1d3189f3963a46599287f381637
SSDEEP 24:el9IJDrn9AWqQUz75TN4+8IDXDscR+/qxB/qVsHBoGGmHBoG8:sKJDrTOJNt8OXDs2rguBoMBoj
TLSH
T18AE1214B6A094D31D44E1B3589972A4AE9D71AB017F34160F744A80F2A73A95E73DF18
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ssdeep.zip

SHA256 4606478242049ac039862348ea69cbecdebe2a699b50b7af934abeae0c690353
MD5 dead3af11da6ef3ab8fbc52d6e6bd701
SHA1 80197f7b51b89f25f8bd2855baf3cf4141e1d886
SHA512 7ef0019ec2f6c74a2922c59a6d9a619649118cf06cb4b89071a0abd3d090376709187c4e3602dff57b6e50f8906506d015b8f17fb9f43614b5b03571dfcf985e
SSDEEP 6144:bnN5b7OAwSI+LAxCeBz+w/15k5k5SAaHcmOlxYausATv48oV78sXU3S:bjnOAu+6Cej/36k5SAGcmEOaNATv4NwK
TLSH
T1A06423118573B499AB6DF737D03EA3C5F6ABA2D7DE5642132A8EA09C85063510F0C7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

ssdeep-2.14.1/API.TXT

SHA256 b62d42fc15c67e93222c2a9dc677d3ee497019e3988aeb58a3dc3c84051eb3bb
MD5 0ad3ecee5d792f41b121733097d6b512
SHA1 a88808fdc01ac038a89568775019c5d6cbae55fc
SHA512 20700dff7ad0461d889a08f10cfc51d1cfce1e488191492e8fdabd2a6fb706b9b769a0bc4aa00872462672176a6a1c1176125db8b1faf2b2b1246f6f3b455660
TLSH
T13B61869DAE476B22C22226E25E0E449AF324501DB3EF1640FC6D4A5C5713A29B3E7CCC
MD5 SHA1 SHA512 TLSH

ssdeep-2.14.1/FILEFORMAT.TXT

SHA256 fca4cc8cac2c76801ba179c5e8802aa66318689db5b4389ba4416d439bacb074
MD5 fe06ff651ba3519241c33f1694c5c78e
SHA1 5e1f9e2e2b5aa4361188216e57826a9b509c42f3
SHA512 249f283561eedbd63e430ccc1bc91682d938caf8ce90f4be9023666227b1b80939d19048c9f49522cc51e02eef863b0fcc013b3e76f22307ec2cba3c54d627bf
TLSH
T17211BD8B4F8B57B321566596FF5D3AC1F328816DC5B28F4070DE9219730092877EAADC
MD5 SHA1 SHA512 TLSH

ssdeep-2.14.1/NEWS.TXT

SHA256 c82fdf60164efa5fc918dc85155c552f7953e69798fe828b2d7a3d5580c3f8da
MD5 3717b845019428b15884f06c8c32311a
SHA1 475803e3813d6b8c8eedc2e8f1e072b8c3a3f206
SHA512 40cc1a05c9eca93902c4a16a15f6c6a50331ba05be2ee26db28f7b5e912a00f56ee53bc4680458a86edb67cd48725571d9d4e25029ca13db4f6c53325023bb13
SSDEEP 96:tigMOZeNZZar+LFb6bov6BVZNOB8R1mtB7xRZzg6utomL/Li9Y4YXdluFRZ:t/MOQZar+LFbcov69oB8TO7hzPu5L22+
TLSH
T12EC1359D2407343326B30293379436AAEF3951AECBB3496C7CBC8B1C6759559A3660FC
MD5 SHA1 SHA512 SSDEEP TLSH

ssdeep-2.14.1/README.TXT

SHA256 04ef6a5db061cb7612f8dfb6bee9ffe09be0930309bdab0bcee89d0d1910ac5f
MD5 6dfb8f98d7da14026a77ba327488a401
SHA1 cfe04627c123d4a43e26284201c64ecd0838a7cc
SHA512 231c0a545a29383c94d2f49fbf3b3cf6fc596e64dd9d604bfb3a5e67b80dcde4f8313b8778e12a474123e86361a71319b92a56226ab182b05357a2ef76e1b645
SSDEEP 96:KgEdNAUSZBz7jyx271xua4TqI30nkJfPKynLbKIlmFP7ERUTmAqnnmWA4luj9:1zvCIvZXI3JKynLWdFPQRUTmbmeIj9
TLSH
T1CBD194BA2E8C17750A7202D2574A07C9FB12856F22DB6105798C43AC3F369BC63F68F5
MD5 SHA1 SHA512 SSDEEP TLSH

ssdeep-2.14.1/fuzzy.def

SHA256 1cf512af92ae432d5fb1db0a957b5743b6aacc0727075c2e7ce5690c6475689c
MD5 83c030ea14217c379223fea502dc2b73
SHA1 4804a7f486d21578d44328a3e7afbd82bbb85e02
SHA512 da5079be89949a222a50613ed2692c2d20a36fa7dcf4d5208d03d09d031c8f0154dfc83750af83c3db05325e8dd5b93bdb9567e0b96ee25f65e33b935d03c103
TLSH
T10DE0E21518941DD7D97098EEA9FD0018C142023B82AF6511FE807F046F3B10E67A20EC
MD5 SHA1 SHA512 TLSH

ssdeep-2.14.1/fuzzy.dll

IMPHASH 43a1d595bcb72e6a893f825c17fdae4f
SHA256 6139ec4ef02d56da92afdf5b124d206e73b418ffdb2cc1a0ad6224827a7baf58
MD5 b98efa830dc2089287ca527675913004
SHA1 3a2295f7a2f7feb3a0b061190284b21e2dcbca6e
SHA512 96bb0d7a360008c833567d441db2b329632ca032bf4b17c7d79a38c59e4ed25e449577adf9f3ed4d7cb85521bb26c765dc5f682bf26d02314cd6b53f4b1b667d
SSDEEP 384:7EX6kKD8aq3ZGrl4HjmpimeWW38gVm98ivFIEEaiyDHF2O0HKq3ln5DH:wVl3eOmpimkFZithbBb0qSb
TLSH
T1F9C229CFBE878DE6F40B30B4A167E5BF4EB9240784194A78C7B4C8D8E976644A705237
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

948B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

377B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

700B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ssdeep-2.14.1/fuzzy.h

SHA256 9a6169db5a6685c0b4b28e8698b325c6a6b94d21abaf8427ba4347c9e2f12308
MD5 87e534429fa361b6605ebdb93783bc0e
SHA1 e568322335633f2085337b297119939b09560541
SHA512 bc6f91b83bffce373b6f2829cc8fd3c8b3631bdda21df1735ce9740a48174ef0e88718f9015e72e6c238b49e951a9217f3e0faf9e892ac7bcb973b4bebea46a2
SSDEEP 96:chmzM/QSapEV37QmcTRG3FQz+lPlf+gINL0Z9gThZlnJ5lRZf9SpG9QIDQQATdJs:cww/QSNkmcI4KZAZdpIGQIUQevpS0lYR
TLSH
T17A0275A52C4C6637E53026D1861D41F9E315A25C774B6690F89C8E283E17A2E43FFEEC
MD5 SHA1 SHA512 SSDEEP TLSH

ssdeep-2.14.1/sample.c

SHA256 821616c940e9a2e5b670f6dc6eefb3bb6631e396ddfb59df0b15f09c246bb37f
MD5 2991927b5b025fb0f44b33b9080993ef
SHA1 f55c998f9bc9beefd7214698d1b240310553541e
SHA512 8a6a7823f259bdc518ea6c134e218962509401e970db7db0d6bd598b3cc7d5aac54d74ddfc277e8f781eb35395a54974e1260809d57544b84a82eec84984f0fd
TLSH
T1207187941C8699238233D5249F0A580CE70EB60773FFBE80F40C25989F71945D1AEEDC
MD5 SHA1 SHA512 TLSH

ssdeep-2.14.1/ssdeep.exe

IMPHASH b14ca8226b285fec8342b432a8456f90
SHA256 6333bfd19c7d6ef5768a19bf8188d07ca5769313faba1836c1043ce2e11079f3
MD5 5fe8e35203fc26b013e32749f241df89
SHA1 48eefc1cac645cfdbbcb18043213ebfc6685bce6
SHA512 9ab6739dee77f763352b5ba27b332c3199ddf4a08e577a9d28094fab3c2017fd7fad71ad263b16b436fd4fb64fc4d43f7cdd3c0086181d11057e182811eeb9f8
SSDEEP 24576:fWmPxN/Kt592Yxl8hiJygbYn1e0XmRTkxr15mODK7hfPexmKm6EQch7sX:uu/C2WJygbC1tiODKiOrQch
TLSH
T10E053865EA4385F1DD5705F1050BFBBFAA309F0980218D6FE688DE94FBB3D53242A225
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FindClose FindFirstFileW FindNextFileW GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter RaiseException ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__argv __dllonexit __doserrno __getmainargs __initenv __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _errno _exit _filelengthi64 _fileno _fmode _fstat64 _initterm _iob _lock _lseeki64 _onexit _setjmp3 _snwprintf _strnicmp exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free fsetpos fwprintf fwrite getc getenv getwc isalpha islower isspace isupper iswctype isxdigit localeconv malloc memchr memcmp memcpy memmove memset perror printf putc putchar puts putwc raise realloc setlocale setvbuf signal sprintf sscanf strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm _ultoa _unlock _wcsdup _wcsnicmp _wfopen _wfullpath _wgetcwd _write abort atoi tolower towlower towupper ungetc ungetwc vfprintf vprintf wcscoll wcscpy wcsftime wcslen wcsncmp wcsncpy wcsrchr wcsstr wcsxfrm atol calloc _vsnprintf longjmp _write _strdup _read _fileno _fdopen

shell32

CommandLineToArgvW

user32

MessageBoxW

Name

.text

Size

769KB

Virtual Size

769KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Chapter 2.zip

8888888.png

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

shlwapi

comctl32

generic

Challenge_1.dll

mscoree

dotnet

Challenge_2.bin

kernel32

advapi32

ws2_32

msvcp60

iphlpapi

wininet

msvcrt

generic

filetype.exe

kernel32

generic

filetypes.dat

md5-1.exe

kernel32

msvcrt

generic

md5-2.exe

kernel32

msvcrt

generic

ssdeep.zip

ssdeep-2.14.1/API.TXT

ssdeep-2.14.1/FILEFORMAT.TXT

ssdeep-2.14.1/NEWS.TXT

ssdeep-2.14.1/README.TXT

ssdeep-2.14.1/fuzzy.def

ssdeep-2.14.1/fuzzy.dll

kernel32

msvcrt

user32

generic

ssdeep-2.14.1/fuzzy.h

ssdeep-2.14.1/sample.c

ssdeep-2.14.1/ssdeep.exe

kernel32

msvcrt

shell32

user32

generic