archive.zip
- SHA256 51466f2fac40908891c9121f59dd192af84cb3aadcbd9865f098b6efeafacc16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
nc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
nc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target archive.zip
- Size 73KB
- Sample260730-pp7aws1zbz
- SHA256 51466f2fac40908891c9121f59dd192af84cb3aadcbd9865f098b6efeafacc16
- MD5 28608217589504d60009a1ec7e78dbfe
- SHA1 59f06d6d76cd977231c1adbcdb6d3957938148fe
- SHA512 28fef70d0c0f818fd4519a90245414db9d29d041f282b6375fd022097b437c8962ed605b606370215a4ac1faeb8b41b7794f330d2301b0be97418cc64a3043f8
- SSDEEP 1536:kydNIbFsEU++YMeYqtkXGPJ2l0EKmFlEwi/aiq2djgB2+/hqW/iK6aTQDeJXP:kciFsEnYqu2x2mhP/a2dEY+/hyXaTQDQ
- TLSH T1E57301E71E8811609B7FDE714C132430669E365BC1E090D4EAF594B9BA7A3EA24CB17C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/nc.exe
File Explorer
-
archive.zip.zip 73KB
-
logo.png.png 62KB
-
nc.exe.exe 37KB
logo.png
- SHA256 d36572cff8d65aeb5c0728653afd56f1396458624df2d91930083b1d829fc9de
- MD5 3228d5bc7956831de05f56b48f601248
- SHA1 c8a4d37dca1a391d585ba5bdcb5e08dc92fc6191
- SHA512 7a7c303c6afa170aa4ce6b6899680cbd4c6de0988e35e0010a6eb7109581d26286755ffbbd99577c5f86c5f750fba6506f764e5b9509634819b7f55ca5702fd4
- SSDEEP 768:XdtGx4HCPRQrWIISrEYLwKYzFl/0Q1tUuvpVrydvtlBy7exZDTqythSMP6cU+U/R:Ni5QywcKi7sQzUImLEc9bSMjUMTw4sd
- TLSH T17C53F19AF191DCE0C9A9F271C9D74B6D3AB9007C718F72567BFC82B40C36B5198E8582
- MD5 SHA1 SHA512 SSDEEP TLSH
nc.exe
- IMPHASH 98ce7b6533cbd67993e36dafb4e95946
- SHA256 e8fbec25db4f9d95b5e8f41cca51a4b32be8674a4dea7a45b6f7aeb22dbc38db
- MD5 5dcf26e3fbce71902b0cd7c72c60545b
- SHA1 970bbe298c8ec673fe2257ad6363d29942171fd1
- SHA512 b5b5ebe0e333a7331a08f488a66e9a3ff4ea5f5d2552bbc1477627df32f92fdf2a0c279e929cc93a61e20d90f7797f552f2c3a710903cbccc441d14b018928e1
- SSDEEP 768:mucfgSLKkEXRYxLKlVMGmmkn2TocrC+q4rPBn:vcfpKkEqKlGGmjwTrC+q4rPBn
- TLSH T10603170AD10BE1B2DE5248F8C4DDADFF9376E04689201D65EB898834A73AF51677C378
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
61:2e:98:a6:da:ba:99:9f:46:ee:8c:e8:21:76:e1:0b:77:b6:0c:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Jernej Simoncic,C=SI
Chains
Sep 16, 2011
CN=Jernej Simoncic,C=SI
Subject
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:23:9e:0f:ac:b3
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 28, 1999 - Jan 27, 2017
Subject
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Serial Number
04:00:00:00:00:01:20:19:c1:90:66
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 18, 2009 - Jan 28, 2028
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE
Serial Number
01:00:00:00:00:01:25:b0:b4:cc:01
Issuer
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 21, 2009 - Dec 22, 2020
Subject
CN=Jernej Simoncic,C=SI
Serial Number
01:00:00:00:00:01:30:7a:27:87:2d
Issuer
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 10, 2011 - Jun 10, 2012
Subject
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:23:9e:0f:af:24
Issuer
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Aug 26, 2014
Timespan
Jan 22, 2004 - Jan 27, 2017
Minor OS version
0
Major OS version
4
Entry point
4752
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreatePipe
CreateProcessA
CreateThread
DeleteCriticalSection
DisconnectNamedPipe
DuplicateHandle
EnterCriticalSection
ExitProcess
ExitThread
FreeConsole
FreeLibrary
GetCurrentProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetStdHandle
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
PeekNamedPipe
ReadFile
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
TlsGetValue
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WriteFile
msvcrt
_close
_dup
_itoa
_kbhit
_open
_read
_strcmpi
_strnicmp
_write
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_iob
_isatty
_onexit
_setjmp
_setmode
_sleep
_winmajor
abort
atexit
atoi
calloc
exit
fflush
fprintf
fputc
free
fwrite
getenv
gets
longjmp
malloc
memcmp
memcpy
memset
rand
signal
sprintf
srand
strcat
strchr
strcmp
strcpy
strlen
strncmp
strncpy
time
vfprintf
wsock32
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getservbyname
getservbyport
getsockname
htons
inet_addr
inet_ntoa
listen
ntohs
recv
recvfrom
select
send
setsockopt
shutdown
socket
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE