3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.zip
- SHA256 edb436332b3488a3aa3f16891a9204bafe3f9f2b7818e2ddc0200707c63e3eaf
Password
infected
Behavioral task
behavioral1
Sample
3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.zip
- Size 239KB
- Sample260430-grfa7aey7k
- SHA256 edb436332b3488a3aa3f16891a9204bafe3f9f2b7818e2ddc0200707c63e3eaf
- MD5 274dcad14fc5390fe3fda223a860fcc4
- SHA1 9a10693d26e9b6ce17c64c1821c07316a8a3b635
- SHA512 857022c8592abf226c387847e13770ac3c7fc9520c50de2b1b1debbde2d2e97e194727f684cb53a4aa9b20e05dcb8c4c2b0530aed681f9389ae91da5db01c46f
- SSDEEP 6144:kr0vj3d0/Gn92/74NVUti8Z8jAAPqZnSutyMvdKBCEbakpI3VgM:A0vRwGn94cYaA3nrVKk2a2M
- TLSH T19E3423359BC5ED804AD0C14196BC636E4FAEB05B77864016EDA3C5CBB0C267A7F528F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Revoked Certificate in Chain 1 IoCs
One or more certificates in the signing chain have been revoked, indicating potential compromise.
resource unpack001/3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.exe
File Explorer
-
3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.zip.zip 239KB
-
3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.exe.exe 397KB
3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.exe
- IMPHASH d826b15c5030046a95578a7afce08abb
- SHA256 3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4
- MD5 5af409fe584bed2f8b847bb9d2eca34f
- SHA1 b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3
- SHA512 f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc
- SSDEEP 6144:g4LwKpY6JE5pdSv2RNUJsTGiQNZD0I7oIrrhynRiw1amXQ0YKG0RIb890BEaGTd:gEbEy2RKiQNJ0CrARRg0Y4RK89v1p
- TLSH T1FE84BF84FF8374F7FC23097155C6F3AA8332E8588632CE8BDA48DA57D5A7643A5148C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infected
PE Signature issue
Digest
e5:6f:54:03:ca:96:1f:c2:e8:ef:ea:c2:7b:85:b0:1e:c8:eb:fb:35
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=0000337220,CN=ARMAUER SP Z O O,O=ARMAUER SP Z O O,L=Krakow,C=PL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302504c
Chains
Oct 2, 2020
SERIALNUMBER=0000337220,CN=ARMAUER SP Z O O,O=ARMAUER SP Z O O,L=Krakow,C=PL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302504c
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
SERIALNUMBER=0000337220,CN=ARMAUER SP Z O O,O=ARMAUER SP Z O O,L=Krakow,C=PL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302504c
Serial Number
0a:c9:5b:5e:ff:52:c9:0a:70:13:62:e6:45:87:55:e2
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Oct 2, 2020
Timespan
Oct 2, 2020 - Oct 4, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
4
Entry point
4740
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetStockObject
SelectObject
StretchDIBits
kernel32
AddAtomA
CloseHandle
CreateMutexA
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
FindAtomA
FindClose
FindFirstFileA
FormatMessageA
GetAtomNameA
GetCommandLineA
GetCurrentThreadId
GetLastError
GetLocalTime
GetLogicalDrives
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
LocalFree
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseMutex
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
_close
_filelength
_open
_read
_write
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_iob
_onexit
_setmode
_stat
abort
atexit
calloc
fclose
fgets
fopen
fputc
fputs
fread
free
fseek
ftell
fwrite
malloc
memchr
realloc
rewind
signal
strcmp
strerror
vfprintf
user32
BeginPaint
CreateWindowExA
DefWindowProcA
DispatchMessageA
EndPaint
GetDC
GetDesktopWindow
GetKeyState
GetMessageA
GetSystemMetrics
GetWindowRect
LoadCursorA
LoadIconA
MessageBoxA
MoveWindow
PostQuitMessage
RegisterClassA
ReleaseDC
SetActiveWindow
SetWindowPos
ShowWindow
TranslateMessage
UpdateWindow
wsprintfA
ntdll
sprintf
strncpy
vsprintf
strrchr
strcpy
strtoul
strcat
memmove
ZwOpenSymbolicLinkObject
CSBhvSWCvFRvfCfAoJdoFuAUmK
Name
.text
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
236B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
84B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
207KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
416B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
1024B
Virtual Size
1004B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/35
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/51
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/63
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/77
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/89
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/102
Size
512B
Virtual Size
427B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/113
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/124
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ