SetACL 3[.]1[.]2 (executable version)[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
SetACL 3.1.2 (executable version).zip
Size 517KB
Sample260804-marwjss1e1
SHA256 ba74399a70963c156580180455fbfc0fa68ea673a64eb89010a46273c7d478cc
MD5 53f3f42686caf4d23835c5aa9b7970a2
SHA1 8c570a770ceaa2376c6cf941f252b5231479f699
SHA512 371231b49e233619d778189c049e19942d2548059de5a2d00fc41c43468f532a662dd6374c3e8a789b2d1f7fdf7488c899862feba4c4bad16f81f9136ab70cc1
SSDEEP 12288:c0FIq+m7zgb1rsv2SaPZt+Og9lnwekb8WY+CJ+KYf64GLjg:ca785XlflgfwYWJCcg4G3g
TLSH
T143B4234B18EDD31C9E36858BF884C48C4DE30FB227AC92C521DF77596F49E3AA914635
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

SetACL 3.1.2 (executable version).zip

.zip 517KB
SetACL (executable version)/32 bit/SetACL.exe

.exe 513KB
SetACL (executable version)/64 bit/SetACL.exe

.exe 601KB

SetACL 3.1.2 (executable version).zip

SHA256 ba74399a70963c156580180455fbfc0fa68ea673a64eb89010a46273c7d478cc
MD5 53f3f42686caf4d23835c5aa9b7970a2
SHA1 8c570a770ceaa2376c6cf941f252b5231479f699
SHA512 371231b49e233619d778189c049e19942d2548059de5a2d00fc41c43468f532a662dd6374c3e8a789b2d1f7fdf7488c899862feba4c4bad16f81f9136ab70cc1
SSDEEP 12288:c0FIq+m7zgb1rsv2SaPZt+Og9lnwekb8WY+CJ+KYf64GLjg:ca785XlflgfwYWJCcg4G3g
TLSH
T143B4234B18EDD31C9E36858BF884C48C4DE30FB227AC92C521DF77596F49E3AA914635
MD5 SHA1 SHA512 SSDEEP TLSH

SetACL (executable version)/32 bit/SetACL.exe

IMPHASH e0d3cfc2c5cd0096dee443b503358f64
SHA256 9e2e0f10f6dde0e19e441dec7a6f14a813e5d39e9d7f70b2b48b88491f69bb9b
MD5 93b828ed97cb2c701364df520ddd5331
SHA1 cd8b4b8499d14a0e44de3dc855aa5a8ba588e3d9
SHA512 86ef1caf8102a119c239e62af416aa07d85bdd0fa6815beab075a7b68dec3f8da293a309d915683010b6f7476f85ef38c9f5a8ff518b1f0a1edb15884713b4b9
SSDEEP 12288:dISQ0bSlUcGj4wJUWKk2cgLOKvlZeX8KDNqb3kE1+mQwxVqnz1gqntMeyNC5fmVa:SLvlUcoXoxqnz17nryM5fmVlZq
TLSH
T1B5B45A01B5A1C231F1A151B06EBDEB6190BDBD389F7145DF77C00A6A5970AC2AA31F3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

ad:83:7c:10:fc:2c:88:e8:1d:ed:10:2a:aa:36:11:72:cd:21:48:71:05:7f:a3:98:c5:7e:d2:87:33:3e:c7:6f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=vast limits GmbH,O=vast limits GmbH,POSTALCODE=50733,STREET=Werkstattstr. 98,L=Cologne,ST=NRW,C=DE

Chains

Jun 26, 2021

CN=vast limits GmbH,O=vast limits GmbH,POSTALCODE=50733,STREET=Werkstattstr. 98,L=Cologne,ST=NRW,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=vast limits GmbH,O=vast limits GmbH,POSTALCODE=50733,STREET=Werkstattstr. 98,L=Cologne,ST=NRW,C=DE

Serial Number

f9:28:d8:58:4a:73:ea:4b:0a:69:0d:b1:15:02:87:dd

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 11, 2018 - Dec 11, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

241885

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Code\SetACL3\Source\SetACL.exe\Win32\Release\SetACL.pdb

ws2_32

WSAStartup WSACleanup

secur32

GetUserNameExW

version

VerQueryValueW

activeds

ord13

kernel32

LeaveCriticalSection LocalFree FormatMessageA InitializeCriticalSectionAndSpinCount WaitForSingleObject SetLastError TlsFree TlsAlloc TlsSetValue TlsGetValue SetEvent CreateEventW LoadLibraryExW FormatMessageW FreeLibrary FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime FileTimeToLocalFileTime GetCurrentThreadId GetFileSizeEx WriteFile SetFilePointerEx CreateMutexW ReleaseMutex ResetEvent FindFirstFileW FindNextFileW FindClose CreateFileW MultiByteToWideChar WideCharToMultiByte GetStringTypeW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter DeleteCriticalSection GetCPInfo WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW LCMapStringW GetUserDefaultLCID RtlUnwind RaiseException CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree IsValidCodePage GetACP GetOEMCP GetLocaleInfoW IsValidLocale EnumSystemLocalesW CompareStringW GetFileType HeapReAlloc FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleCP GetConsoleMode HeapSize ReadFile ReadConsoleW WriteConsoleW InitializeCriticalSection GetModuleFileNameW GetVersionExW GetComputerNameW GetUserDefaultLangID FreeResource LockResource LoadResource FindResourceW CloseHandle GetCurrentProcess GetProcAddress GetLastError GetModuleHandleW EnterCriticalSection CompareFileTime DeleteFileW GetFileAttributesW CreateDirectoryW GetLocalTime MoveFileExW SetEndOfFile

user32

LoadStringW

advapi32

LookupAccountNameW CopySid ConvertSidToStringSidW ConvertStringSidToSidW IsValidSid EqualSid GetAce GetAclInformation ConvertSecurityDescriptorToStringSecurityDescriptorW GetSecurityDescriptorControl SetEntriesInAclW MakeAbsoluteSD ConvertStringSecurityDescriptorToSecurityDescriptorW ReportEventW DeregisterEventSource LookupAccountSidW RegCloseKey GetSecurityDescriptorLength AddAccessAllowedAce AddAce InitializeAcl IsValidAcl DeleteAce MakeSelfRelativeSD SetSecurityDescriptorSacl SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetNamedSecurityInfoW SetSecurityInfo RegisterEventSourceW MapGenericMask RegCreateKeyExW RegOpenKeyExW RegConnectRegistryW RegEnumKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken GetLengthSid GetKernelObjectSecurity GetNamedSecurityInfoW IsValidSecurityDescriptor IsWellKnownSid

ole32

CoSetProxyBlanket CoInitialize CoInitializeSecurity CoCreateInstance CoUninitialize CoQueryProxyBlanket

oleaut32

SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData VariantClear SafeArrayGetLBound SafeArrayGetUBound SysAllocStringLen VariantInit SysAllocString SysStringByteLen SysAllocStringByteLen SysFreeString

netapi32

DsGetDcNameW NetApiBufferFree NetShareSetInfo NetShareGetInfo NetDfsGetClientInfo

mpr

WNetEnumResourceW WNetCloseEnum WNetOpenEnumW

SetACL (executable version)/64 bit/SetACL.exe

IMPHASH d4f9425f57877ed12395f309e063b715
SHA256 4efc87b7e585fcbe4eaed656d3dbadaec88beca7f92ca7f0089583b428a6b221
MD5 1fb64ff73938f4a04e97e5e7bf3d618c
SHA1 aa0f7db484d0c580533dec0e9964a59588c3632b
SHA512 da6007847ffe724bd0b0abe000b0dd5596e2146f4c52c8fe541a2bf5f5f2f5893dccd53ef315206f46a9285ddbd766010b226873038ccac7981192d8c9937ece
SSDEEP 12288:3G2NBTh+l8gAqAbdsuEa3nZGSebY7o937bfJ9Ud:3xNBTYlaLdaynZGBc7orbJ9Ud
TLSH
T12AD44A56A3E901B8E0B7D1788A674912F77A7C4907759AFF039102271F27AE09F7A730
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

58:79:a5:f0:95:48:9a:59:4d:13:ba:ad:1b:d9:84:2a:dd:4e:29:7c:47:1b:d6:d8:4f:d2:2d:20:28:42:3c:8b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=vast limits GmbH,O=vast limits GmbH,POSTALCODE=50733,STREET=Werkstattstr. 98,L=Cologne,ST=NRW,C=DE

Chains

Jun 26, 2021

CN=vast limits GmbH,O=vast limits GmbH,POSTALCODE=50733,STREET=Werkstattstr. 98,L=Cologne,ST=NRW,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=vast limits GmbH,O=vast limits GmbH,POSTALCODE=50733,STREET=Werkstattstr. 98,L=Cologne,ST=NRW,C=DE

Serial Number

f9:28:d8:58:4a:73:ea:4b:0a:69:0d:b1:15:02:87:dd

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 11, 2018 - Dec 11, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

271480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Code\SetACL3\Source\SetACL.exe\x64\Release\SetACL.pdb

ws2_32

WSAStartup WSACleanup

secur32

GetUserNameExW

version

VerQueryValueW

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

activeds

ord13

kernel32

InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree FormatMessageA InitializeCriticalSectionAndSpinCount WaitForSingleObject SetLastError TlsFree TlsAlloc TlsSetValue TlsGetValue SetEvent CreateEventW LoadLibraryExW FormatMessageW FreeLibrary FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime FileTimeToLocalFileTime GetCurrentThreadId GetFileSizeEx WriteFile SetFilePointerEx CreateMutexW ReleaseMutex ResetEvent FindFirstFileW FindNextFileW FindClose CreateFileW MultiByteToWideChar WideCharToMultiByte GetStringTypeW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetModuleFileNameW GetCPInfo WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW LCMapStringW GetUserDefaultLCID RtlUnwindEx RtlPcToFileHeader RaiseException CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree IsValidCodePage GetACP GetOEMCP GetLocaleInfoW IsValidLocale EnumSystemLocalesW CompareStringW GetFileType HeapReAlloc FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleCP GetConsoleMode HeapSize ReadFile ReadConsoleW WriteConsoleW GetVersionExW GetComputerNameW GetUserDefaultLangID FreeResource LockResource LoadResource FindResourceW CloseHandle GetCurrentProcess GetProcAddress GetLastError GetModuleHandleW CompareFileTime DeleteFileW GetFileAttributesW CreateDirectoryW GetLocalTime MoveFileExW SetEndOfFile

user32

LoadStringW

advapi32

LookupAccountNameW CopySid ConvertSidToStringSidW ConvertStringSidToSidW IsValidSid GetAclInformation ConvertSecurityDescriptorToStringSecurityDescriptorW GetSecurityDescriptorControl SetEntriesInAclW MakeAbsoluteSD ConvertStringSecurityDescriptorToSecurityDescriptorW ReportEventW DeregisterEventSource RegisterEventSourceW RegCloseKey LookupAccountSidW GetSecurityDescriptorLength AddAccessAllowedAce AddAce InitializeAcl IsValidAcl DeleteAce MakeSelfRelativeSD SetSecurityDescriptorSacl SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetNamedSecurityInfoW SetSecurityInfo IsValidSecurityDescriptor GetNamedSecurityInfoW MapGenericMask RegCreateKeyExW RegOpenKeyExW RegConnectRegistryW RegEnumKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken EqualSid IsWellKnownSid GetLengthSid GetKernelObjectSecurity GetAce

ole32

CoSetProxyBlanket CoInitialize CoInitializeSecurity CoCreateInstance CoUninitialize CoQueryProxyBlanket

oleaut32

SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate SysAllocString VariantInit VariantClear SafeArrayGetLBound SysAllocStringLen SafeArrayGetUBound SysFreeString SysAllocStringByteLen SysStringByteLen

netapi32

DsGetDcNameW NetApiBufferFree NetShareSetInfo NetShareGetInfo NetDfsGetClientInfo

mpr

WNetEnumResourceW WNetCloseEnum WNetOpenEnumW

Name

.text

Size

423KB

Virtual Size

423KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SetACL 3.1.2 (executable version).zip

SetACL (executable version)/32 bit/SetACL.exe

ws2_32

secur32

version

activeds

kernel32

user32

advapi32

ole32

oleaut32

netapi32

mpr

generic

SetACL (executable version)/64 bit/SetACL.exe

ws2_32

secur32

version

ntdll

activeds

kernel32

user32

advapi32

ole32

oleaut32

netapi32

mpr

generic