Office_2024_SK_64Bit.zip
- SHA256 7c6f269402ab0c320b92394b746b7900e78af02f2856d005bfa53977b5367393
Static task
static1
Behavioral task
behavioral1
Sample
package/Click To Run.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
30 signatures
300 seconds
Behavioral task
behavioral2
Sample
package/Click To Run.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral3
Sample
package/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral4
Sample
package/setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
spustit instalaciu.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
General
- Target Office_2024_SK_64Bit.zip
- Size 3.2MB
- Sample260724-a2mppazfnc
- SHA256 7c6f269402ab0c320b92394b746b7900e78af02f2856d005bfa53977b5367393
- MD5 3e159d767d854287d1e4c39bbdfe5ab7
- SHA1 74c456f4c58ae69fad4afd833712797f0412e61e
- SHA512 5751b5f709540df67ff3d5355397d400f8c8b3bfe847b7cd90809cf9b982c3eddf3cfe2e7b70bd6f24a9724801d03a9a798bc21e7bdd1f5bc30188217496df63
- SSDEEP 98304:aBcUkI032Yr0PcnEXcswzz7HV5gQ7C6Kh1o:kcUkl32PIswzz5ZH4o
- TLSH T13CF533A6E5527AD869D05CCB4D3340594BC36B3E3E232CB640C193BEB4E528E2F876D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
Office_2024_SK_64Bit.zip.zip 3.2MB
-
package/Click To Run.bat34B
-
package/configuration.xml185B
-
package/setup.exe.exe 7.4MB
-
spustit instalaciu.bat49B
package/Click To Run.bat
- SHA256 413b8e555d8f42c56d22d6843708f7bfcb0bbedb4f833bf3c89880665925bd14
- MD5 ad3ed1d41f9b51f7f203d56597c05958
- SHA1 724822195edeff84c01f298212dbaebf1b55a0d2
- SHA512 dcb33488d6a8da2ca6ab1307fba58c68e62cd31e592058bf9c6a1621bff20da4b5df49684a7cac058b522619fd8b785446a251ae5656fba7a4d666dfa303f290
- MD5 SHA1 SHA512
package/configuration.xml
- SHA256 a453c55af1850794b89b2d1cb0a31fcb700e095488fbb9a763145a69dfa7cdf1
- MD5 d2523caf3e5b7289eeabba5f9e72b28c
- SHA1 d8655ba80f4686c7a17a0151b512b463ac417c3f
- SHA512 ea31c3356372a83affeb09cd0a22fdaf4679f707f0cbde12cdfb10e367280f2deab60820525fd93fe8880c0e6ecae32d4060187bfc559486cd83c90f9f5870a5
- TLSH T1DFC012D3B686141761324267E2D28A50BC72424389244908F02F716B89B5561634311A
- MD5 SHA1 SHA512 TLSH
package/setup.exe
- IMPHASH 9e71e4eb9e5e4331174aa2b57e2ff185
- SHA256 b03c4cc3c1377ee81b1f94da126e58a30f484d4d935889538fae1c650dd6828b
- MD5 7488d696f9a3d74e093b4c31ef7282c6
- SHA1 777a182ed8ca8377581c91ac3d91b4b4fe233353
- SHA512 a40d074243ec3ced28fc8b4f3e00ccbfb755415540e655e29820b96b2569d530c21f46e3cb7aee24e46de2339207e46c6c4a05f7bd7ce5d85485952b9f881e08
- SSDEEP 196608:NX4RUixxsuKuIGizTftIEgBkXVKJw579eRGzouxdxGXaI6HMaJTtGbFK:qnmuKuE3f9gVG5xxGo
- TLSH T14D767C237AD58077E3B202306E39BB1A4D7DBE7109B1F11F6B86161D0AB09D295F5B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ee:b6:e6:52:a8:5a:50:0d:49:73:e0:e8:19:a2:6c:24:f0:97:78:3b:3f:b8:b2:e1:db:5e:e5:1d:00:31:cb:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 11, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
ee:b6:e6:52:a8:5a:50:0d:49:73:e0:e8:19:a2:6c:24:f0:97:78:3b:3f:b8:b2:e1:db:5e:e5:1d:00:31:cb:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 11, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:56:c9:20:2b:1f:74:32:5d:2d:00:00:00:00:05:56
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f3:c5:0a:43:ae:03:cc:1d:31:00:01:00:00:01:f3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:a4:cb:e3:56:b8:cb:7f:e4:27:00:00:00:00:03:a4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
2
Major OS version
5
Entry point
4159692
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
d:\dbs\el\omr\target\x86\ship\click2run\en-us\SetupODT.pdb
advapi32
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CreateWellKnownSid
CheckTokenMembership
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteTreeW
RegDeleteKeyW
RegGetValueW
RegDeleteValueW
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
RegNotifyChangeKeyValue
RevertToSelf
OpenThreadToken
GetLengthSid
CopySid
InitializeAcl
AddAccessAllowedAce
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
EqualSid
RegEnumValueA
RegDeleteValueA
RegGetValueA
EventWrite
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
CloseServiceHandle
OpenServiceW
QueryServiceStatusEx
QueryServiceConfigW
StartServiceW
ControlService
EnumDependentServicesW
ChangeServiceConfigW
ole32
CoInitialize
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoSetProxyBlanket
CoCreateGuid
StringFromGUID2
CoCreateFreeThreadedMarshaler
IIDFromString
CoInitializeSecurity
CoInitializeEx
CoEnableCallCancellation
CoDisableCallCancellation
CoCancelCall
CoUninitialize
oleaut32
GetErrorInfo
SysFreeString
VariantInit
VariantClear
SetErrorInfo
SysAllocString
SysStringLen
gdi32
CreateFontW
SetBkColor
SetTextColor
DeleteObject
Rectangle
SetDCPenColor
CreatePen
GetTextExtentPoint32W
SelectObject
CreateSolidBrush
SetDCBrushColor
GetTextMetricsW
GetStockObject
GetDeviceCaps
kernel32
RtlUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
EncodePointer
CloseThreadpoolWork
CreateTimerQueueTimer
ExitProcess
GetOEMCP
CloseHandle
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
CompareStringEx
LocalFree
HeapFree
GetProcessHeap
GetCurrentProcess
GetCurrentProcessId
FreeLibrary
CreateThread
GetCurrentThreadId
GetExitCodeThread
SetProcessMitigationPolicy
CreateEventExW
WriteFile
DeleteFileW
WideCharToMultiByte
IsWow64Process
GetModuleHandleExW
ExpandEnvironmentStringsW
GlobalFree
MultiByteToWideChar
InitializeCriticalSectionEx
DeleteCriticalSection
DecodePointer
CreateMutexW
GetNativeSystemInfo
VerSetConditionMask
VerifyVersionInfoW
GetUserDefaultLocaleName
FlsFree
FlsAlloc
AttachConsole
AllocConsole
GetStdHandle
WriteConsoleW
FreeConsole
LocaleNameToLCID
FindClose
UnmapViewOfFile
CreateFileA
GetFileSize
CreateFileMappingW
MapViewOfFile
Sleep
GetStringTypeExW
GetUserDefaultLCID
LoadLibraryA
LCMapStringW
FormatMessageA
RaiseException
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
OpenProcess
GetExitCodeProcess
GetProcessTimes
GetTickCount64
GetSystemTimeAsFileTime
TerminateProcess
GetModuleFileNameA
GetShortPathNameA
K32GetModuleFileNameExW
CreateProcessW
LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
GlobalMemoryStatusEx
GetVersionExW
IsValidCodePage
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetCPInfoExW
GetDiskFreeSpaceExW
CreateFileW
DeviceIoControl
SetErrorMode
GetComputerNameW
MulDiv
FormatMessageW
GetLogicalProcessorInformation
GetSystemDirectoryW
HeapAlloc
CreateEventW
SetEvent
WaitForSingleObject
EnumSystemLocalesW
WaitForSingleObjectEx
WaitForMultipleObjectsEx
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
QueryDepthSList
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
RtlCaptureStackBackTrace
TzSpecificLocalTimeToSystemTime
QueryUnbiasedInterruptTime
OpenEventW
ReleaseMutex
CreateMutexExW
OpenMutexW
GetTempPathW
GetLongPathNameW
GetFinalPathNameByHandleW
TlsAlloc
TlsFree
FlsGetValue
TlsGetValue
FlsSetValue
TlsSetValue
ResetEvent
IsDebuggerPresent
GetFileAttributesExW
FindFirstFileExW
MoveFileExW
FindNextFileW
CreateDirectoryW
SetFileAttributesW
ReadFile
SetFilePointerEx
SetEndOfFile
GetFileSizeEx
FlushFileBuffers
LockFileEx
UnlockFileEx
GetFileInformationByHandleEx
GetCurrentDirectoryW
GetTempFileNameW
CopyFileExW
GetVolumePathNamesForVolumeNameW
SetFileInformationByHandle
WaitForMultipleObjects
K32EnumProcessModulesEx
OpenThread
GetFileType
SetFilePointer
GetOverlappedResult
GetFileAttributesW
GetFileTime
CopyFileW
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalAlloc
LockResource
LCIDToLocaleName
SetFileTime
CancelIoEx
GetProcessAffinityMask
CreateWaitableTimerW
SetWaitableTimerEx
CancelWaitableTimer
GetTickCount
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
QueryFullProcessImageNameW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetThreadIOPendingFlag
GetCurrentThread
GetQueuedCompletionStatus
GetStartupInfoW
CreateMemoryResourceNotification
GetSystemPowerStatus
IsSystemResumeAutomatic
OutputDebugStringW
OpenEventA
CreateEventA
OpenMutexA
CreateMutexA
OpenSemaphoreA
CreateSemaphoreA
OpenFileMappingA
CreateFileMappingA
LocalAlloc
GetLocaleInfoEx
LCMapStringEx
IsValidLocale
GetSystemDefaultLCID
ResolveLocaleName
EnumSystemLocalesEx
GetSystemDefaultLocaleName
GetFileAttributesA
LoadLibraryExA
GetUserGeoID
GetLocaleInfoW
GetUserPreferredUILanguages
GetACP
GetTimeZoneInformation
AreFileApisANSI
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
InitializeCriticalSection
GetFullPathNameA
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
FlushViewOfFile
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
K32GetProcessMemoryInfo
GetPhysicallyInstalledSystemMemory
GetProductInfo
SwitchToThread
InitializeCriticalSectionAndSpinCount
FindFirstFileW
GetThreadLocale
lstrcmpW
ProcessIdToSessionId
GetCommandLineW
SetEnvironmentVariableW
GetPriorityClass
K32EnumProcesses
FreeLibraryWhenCallbackReturns
IsProcessorFeaturePresent
InitOnceComplete
InitOnceBeginInitialize
CreateSymbolicLinkW
DeleteTimerQueueTimer
GetThreadTimes
FreeLibraryAndExitThread
ExitThread
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
RemoveDirectoryW
GetFileInformationByHandle
GetStringTypeW
CompareStringW
SetStdHandle
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualProtect
VirtualQuery
GetLocalTime
ReleaseSemaphore
TryAcquireSRWLockExclusive
GetSystemPreferredUILanguages
K32GetProcessImageFileNameW
GetDateFormatW
GetTimeFormatW
GetDriveTypeW
setupapi
SetupIterateCabinetW
gdiplus
GdipDeleteGraphics
GdiplusStartup
GdipCreateFromHDC
GdipDrawImageRectI
GdipLoadImageFromStream
GdipAlloc
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipCloneImage
GdipFree
Name
.text
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
227KB
Virtual Size
257KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
342KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
377KB
Virtual Size
377KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=259, version=30795,
count=216, id=261, version=30795,
count=20, id=260, version=33030,
count=28, id=259, version=33030,
count=7, id=109, version=41204,
count=2, id=125, version=41204,
count=21, id=257, version=30795,
count=47, id=260, version=30795,
count=2, id=262, version=30795,
count=993, id=1, productName=Unmarked objects,
count=151, id=261, version=33030,
count=2394, id=265, version=33135,
count=1, id=255, version=33135,
count=1, id=151,
count=1, id=258, version=33135,
spustit instalaciu.bat
- SHA256 d7d4b20eb7e17dcf3ce914aa1bc29a94427434cc67519cacfde2c13419c70fb7
- MD5 83eea8c8bf2c4e394bd3d7b5e99b2ee3
- SHA1 e20292207e34ea18dee06ba57c218ac85096b7fb
- SHA512 9e10d9a4553c0fb125869d6575ab744568a9da71ba0b18c8bdcc31cfa53b11a20ee6c1dafc3645c31bae6b75955317a0b294b7c7e18fbf5c123f087154335fb6
- MD5 SHA1 SHA512