9af68612bb86bdbf6d4cafe3b4477a98867081c3685f1d9448fb0bffd25c5260
- SHA256 9af68612bb86bdbf6d4cafe3b4477a98867081c3685f1d9448fb0bffd25c5260
Static task
static1
Behavioral task
behavioral1
Sample
GreenZip/GZipRetainSvr.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
GreenZip/GZipRetainSvr.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 9af68612bb86bdbf6d4cafe3b4477a98867081c3685f1d9448fb0bffd25c5260
- Size 79KB
- Sample260806-e4yl7ax1ct
- SHA256 9af68612bb86bdbf6d4cafe3b4477a98867081c3685f1d9448fb0bffd25c5260
- MD5 6d291a7d119366776ad3586fae261af3
- SHA1 35d0ee5d9d3c85ceb806c5a4e9cf4a0246800dbd
- SHA512 638668bb55a98ef698b91dea1c603bee6f01a2e41a9f4b0c89926dfb2c4038d65e7e419430c04d0d8fe5fa78f6c6af93220eaefa0674716a1842b08ad54aae72
- SSDEEP 1536:pgc17RRNYnxOb8tzyGEMyJD21Z0UTDfpzqZ38hE444eu6VXzRtgZmb8BnqL:pgcYoYNRyJD21XgZs44eFXdtEFqL
- TLSH T13C8302F09D4136D6CA9850BEAC9F4635B272D5C33C4781FB87ED13138DCD8A232956AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
9af68612bb86bdbf6d4cafe3b4477a98867081c3685f1d9448fb0bffd25c5260.zip 79KB
-
GreenZip/GZipRetainSvr.dll.dll 145KB
-
GreenZip/ntche/B10B9A6716EF8C6F4759DD67AF22A5B412KB
-
GreenZip/ntche/F2765F06EB759C3DBE19413A3DD4E581260B
GreenZip/GZipRetainSvr.dll
- IMPHASH 034379964071e57ce32e579b1b5adfbe
- SHA256 674a2383c388a1ea40ccf70bf040c8f65c17a71a86b5fbd5152b7104cd7f28e9
- MD5 19c426786bf26d34cc9fb42cf431590e
- SHA1 f5d1d1efb768bb06d405ebf849f0c9a8cb718b2d
- SHA512 d08ab5856ff00cfb1fa586482492e44bff8b78e963ee6d644ea23e95d28c841d27bd001897c5e4c5a10fa80122a16966656aede3244bdb201fad8dcb90b80091
- SSDEEP 3072:bRhZz1dsrqx8v81lV6vh8YS5LQiWsJjeeJ3AE:9hZZdsrq9lVsnyLJ3AE
- TLSH T132E37D1075808432E5BE19382878DB626B7EB960CF748DD763A8467D4F742C1AE38F76
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
87:04:b4:54:3a:08:df:51:37:77:99:c6:2a:b7:63:c0:6e:36:ad:a1:67:ae:25:a0:45:b5:39:8f:6e:fd:c1:fd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=沧州句号网络科技有限公司,O=沧州句号网络科技有限公司,L=沧州市,ST=河北省,C=CN
Chains
Jun 22, 2020
CN=沧州句号网络科技有限公司,O=沧州句号网络科技有限公司,L=沧州市,ST=河北省,C=CN
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
c8:41:6d:4d:06:91:05:cd:1a:0d:0f:7e:f8:c1:be:40:89:bd:ba:2e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=沧州句号网络科技有限公司,O=沧州句号网络科技有限公司,L=沧州市,ST=河北省,C=CN
Chains
Jun 22, 2020
CN=沧州句号网络科技有限公司,O=沧州句号网络科技有限公司,L=沧州市,ST=河北省,C=CN
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:1c:b2:8a:00:00:00:00:00:26
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=沧州句号网络科技有限公司,O=沧州句号网络科技有限公司,L=沧州市,ST=河北省,C=CN
Serial Number
0b:60:01:c5:7d:90:7b:15:98:49:20:a3:b8:27:0c:d9
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 15, 2020 - Apr 20, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
5
Entry point
25082
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\hudson\jobs\GreenZip_1.0.0.0\workspace\GreenZip\Bin\Release\RetainService.pdb
kernel32
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
HeapDestroy
RaiseException
DecodePointer
DeleteCriticalSection
WideCharToMultiByte
WriteConsoleW
FlushFileBuffers
GetModuleHandleW
GetModuleFileNameW
Sleep
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetNativeSystemInfo
FreeConsole
OutputDebugStringW
CreateThread
LocalFree
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
WTSGetActiveConsoleSessionId
OpenProcess
MultiByteToWideChar
CloseHandle
Process32NextW
Process32FirstW
InitializeCriticalSectionAndSpinCount
CreateToolhelp32Snapshot
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
SetStdHandle
FreeEnvironmentStringsW
CreateFileW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
LCMapStringW
GetStringTypeW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
advapi32
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
ControlService
DeleteService
QueryServiceStatus
OpenServiceW
CloseServiceHandle
StartServiceW
RegCreateKeyW
CreateServiceW
OpenSCManagerW
RegSetValueExW
RegOpenKeyExW
SetServiceStatus
RegisterServiceCtrlHandlerW
ConvertSidToStringSidW
LookupAccountNameW
OpenProcessToken
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
GetTokenInformation
shlwapi
PathFileExistsW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
wtsapi32
WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSFreeMemory
WTSQueryUserToken
netapi32
NetUserEnum
NetApiBufferFree
InsertSvc
ServiceMain
UninstallSvc
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=125, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=260, version=26706,
count=21, id=259, version=26706,
count=39, id=261, version=26706,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=138, id=1, productName=Unmarked objects,
count=1, id=261, version=27032,
count=5, id=265, version=27032,
count=1, id=256, version=27032,
count=1, id=255, version=27032,
count=1, id=151,
count=1, id=258, version=27032,
GreenZip/ntche/B10B9A6716EF8C6F4759DD67AF22A5B4
- SHA256 e032265f55fd7399e2c11862a97a874ba565f6412804111a8d46f62749b10d06
- MD5 0e87ead35b4d7e081e111ca6a70c2f04
- SHA1 643730f04032bb742fba6247d04cc6c2c7facaba
- SHA512 24699c4b753d585f70b8dff000afed83c7968a5e236963e8044dd475f1c0d87d41f1d8dced6b6c2024d35492278bf06a5e57f4e9d3f340c75b12b4b5811e116c
- SSDEEP 96:CZwjJ4CyBPtCvkL5qn6KL4BAGKy1r4Rq9s1h5yJB1l974l47:2wNCBos5qn6KGFih5yJBP2m7
- TLSH T11D42D12719F88172224688DF29B52F2D3D98F2448F6A4D0537EC59FA43C7FA4CDA7611
- MD5 SHA1 SHA512 SSDEEP TLSH
GreenZip/ntche/F2765F06EB759C3DBE19413A3DD4E581
- SHA256 bb7dae76032f0ceb66cf1fb6cf3d54d01878df4d20f91a72d183ad218da1ad93
- MD5 f0b46e51f75d5bccf73d56725bd8d87c
- SHA1 c432083a7282249a9d7b6117652d1c1cef3164f2
- SHA512 59e35aa718d3102a84ed6a5368c20ea2576affcc2cf712e30a84513da21cfcb6c3aae902bdc166733e5493f2df1e546d14d632854b2e30383d786219851a4354
- TLSH T194D095214F9464003F0CC1BDE15FC5672E05C400B384E4D46F40C1B545B79DBC58CE6D
- MD5 SHA1 SHA512 TLSH