trucker_info.zip
- SHA256 b482fa39dc924a5e6557ebb76d296bcd7cea9fd5580b44e3222893a07b85e9ec
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
msvcp140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
msvcp140.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
trucker_info.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
trucker_info.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target trucker_info.zip
- Size 133KB
- Sample260804-l92pcss1dv
- SHA256 b482fa39dc924a5e6557ebb76d296bcd7cea9fd5580b44e3222893a07b85e9ec
- MD5 c1a9d739c0b83604ba3a289640f73787
- SHA1 35b05239160615c2c34c2c9d0577d19fb2ad88a9
- SHA512 d0e574be5c058d9aa602121090bf160656b2370f14d6364f270f4b38873d26a5c42f6fb71143447529b2cf90dec8e7d4d7bb062bb315a4e750ed282ecb5499e1
- SSDEEP 3072:CDjeNB0ruyZ73YSBck/2tnzLqOJUiIAgRo9IzHB/0C:CneyuyS3zLqOOTPS9o/f
- TLSH T170D3126AFBD6B828035EFD653893E858C3CF3209970F6507879B888054D12EC9DB389D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/msvcp140.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/msvcp140.dll
File Explorer
-
trucker_info.zip.zip 133KB
-
msvcp140.dll.dll 151KB
-
trucker_info.exe.exe 239KB
msvcp140.dll
- IMPHASH 3b38c2f8f8dd51e77ed5625aebb969b3
- SHA256 8d41b053caa71fc65e86054bd81bb2a34dbbc8d132dfd0a63cabcd47add75623
- MD5 acb50da3baa8c209ee811352ebea7e99
- SHA1 fc2efd2c850285fe23a4a83220c50c0dc5c7e5da
- SHA512 d14d276b16c6c2d6e14c4bf6d1245a2314a8790ab28ded54ad0db53efcd83dc08b8ac8543a3371b2b9ce15ef021a5d83d2bab08966e4c2bf8b61b3382667b5b4
- SSDEEP 1536:mFcy7r4OlbUsoqV5uYtKzWcDHmCrvGNxTHtS+JzMhYzuUuUco4E9XRsWNqdX9dlo:mFHbTJ0HmCr85NNKWuUuUJ4fXSR183w
- TLSH T1D2E36C1BB7A500B7E1B38239C9534A45E772785147609BEF03A443762F233D1AE3EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
10708
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
user32
SetWindowPos
IsWindowVisible
EnableWindow
GetWindowLongPtrA
SetWindowLongPtrA
FindWindowA
GetWindowThreadProcessId
EnumWindows
ShowWindow
wininet
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA
shell32
ShellExecuteA
kernel32
GetModuleHandleExW
WriteConsoleW
SetEndOfFile
ReadConsoleW
ReadFile
HeapReAlloc
HeapSize
SetFilePointerEx
GetFileSizeEx
CreateFileW
GetStringTypeW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
CreateFileA
GetFileAttributesA
WriteFile
CloseHandle
SetErrorMode
Sleep
GetCurrentProcessId
CreateThread
GetLocalTime
DisableThreadLibraryCalls
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetProcessHeap
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetProcAddress
GetModuleFileNameW
IsProcessorFeaturePresent
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualProtect
LoadLibraryExW
LCMapStringW
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getdateorder@_Locinfo@std@@QEBAHXZ
?_Getdays@_Locinfo@std@@QEBAPEBDXZ
?_Getmonths@_Locinfo@std@@QEBAPEBDXZ
?_Gettnames@_Locinfo@std@@QEBA?AV_Timevec@2@XZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_W_Gettnames@_Locinfo@std@@QEBA?AV_Timevec@2@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
f1
f10
f11
f12
f2
f3
f4
f5
f6
f7
f8
f9
Name
.text
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=146, id=261, version=33145,
count=12, id=260, version=33145,
count=6, id=259, version=33145,
count=9, id=259, version=35403,
count=14, id=260, version=35403,
count=31, id=261, version=35403,
count=9, id=257, version=33145,
count=109, id=1, productName=Unmarked objects,
count=1, id=261, version=35729,
count=1, id=256, version=35729,
count=1, id=258, version=35729,
trucker_info.exe
- IMPHASH b798166eaba674297ed4280012518390
- SHA256 130a4605825eea29caadb8594dd5a1762c18d778759eebcc648b4b96596ce20f
- MD5 df483fa93ffe6ac26167d9ea5965842b
- SHA1 5a96223767aa8e4b4ed058530d522324933b4bd4
- SHA512 a61d37af5c718b6990ff87391505930da0d9c628fdde0dee48005a720ede691991486d840b9c5f5fff12dbec9a404f26198be7faa6d8fa2122aecc641a936e4e
- SSDEEP 1536:fQneMD9rAZN18Krc7tGHZCI2nKpPToxVgRwR/BFFQwL7S:MDVa18WLocKdBFFJfS
- TLSH T12934094C8B80C979F1B5A871FD6A53F10FA19C29F281856315FC7E583AB0CA99BF21D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
62:74:a5:59:33:0a:a7:61:20:79:6a:c4:cb:fe:b3:db:c2:e2:ad:9a:53:f7:7c:a8:4e:db:ef:e8:36:b9:c1:5a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=The Document Foundation,OU=LibreOffice Build Team,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267
Chains
Jul 23, 2026
CN=The Document Foundation,OU=LibreOffice Build Team,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=The Document Foundation,OU=LibreOffice Build Team,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Subject
CN=The Document Foundation,OU=LibreOffice Build Team,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267
Serial Number
5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Issuer
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 14, 2023 - Sep 13, 2026
Subject
CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL
Serial Number
28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03
Issuer
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 11, 2026 - Feb 27, 2036
Subject
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Subject
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 31, 2021 - Sep 17, 2029
Minor OS version
1
Major OS version
6
Entry point
16100
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\build\workdir\LinkTarget\Executable\scalc.pdb
kernel32
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
HeapFree
GetCommandLineW
GetModuleFileNameW
WaitForSingleObject
FormatMessageW
GetLastError
CloseHandle
CreateProcessW
GetProcessHeap
TerminateProcess
vcruntime140
_CxxThrowException
__std_terminate
memcpy
__std_exception_copy
__current_exception_context
__current_exception
__std_type_info_destroy_list
memmove
__C_specific_handler
memset
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_set_app_type
_crt_atexit
_crt_at_quick_exit
_register_thread_local_exe_atexit_callback
_c_exit
_seh_filter_dll
terminate
_configure_narrow_argv
_exit
exit
_initterm_e
_initialize_narrow_environment
_initialize_onexit_table
_invoke_watson
_seh_filter_exe
_cexit
_execute_onexit_table
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_register_onexit_function
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
malloc
free
_set_new_mode
user32
MessageBoxW
vcruntime140_1
__CxxFrameHandler4
msvcp140
?_Xbad_alloc@std@@YAXXZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
198KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35207,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=25, id=261, version=35207,
count=5, id=257, version=30795,
count=75, id=1, productName=Unmarked objects,
count=2, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=151,
count=1, id=258, version=35228,