0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.zip
- SHA256 bcc97e932612250052749fb8afb735797674bff564d59e2bc4ac954d64a1d3da
Password
infected
General
- Target 0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.zip
- Size 54KB
- Sample260808-adcvksyvay
- SHA256 bcc97e932612250052749fb8afb735797674bff564d59e2bc4ac954d64a1d3da
- MD5 d24e29036217e18ca087387b8cf8f536
- SHA1 f375271462e7ee0b79de5fa1a7fbc90566705b88
- SHA512 931d9902e924e200f869aea9dc08669239f7afd98ed9387e43797279104a2e7855310a5531d383c1f1d8905925eaeeb68a4a929758866823a338842d358fda6e
- SSDEEP 1536:Eoqk//mEhCF9+AFqjuvlTzpgrOLUxFgTA3gjyv:NqknS97FqjqzpPOgTpyv
- TLSH T1064301D76BB4588924E20BF9F0E3E0802347D5ABCE932A24BC879185C575139E3BD86C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: HermeticWiper
HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.
-
resource yara_rule static1/unpack001/0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe family_hermeticwiper - Revoked Certificate in Chain 1 IoCs
One or more certificates in the signing chain have been revoked, indicating potential compromise.
resource unpack001/0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe
File Explorer
-
0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.zip.zip 54KB
-
0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe.exe 114KB
0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe
- IMPHASH 4233d97404e1fecedef6a46e0f7c09b9
- SHA256 0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da
- MD5 84ba0197920fd3e2b7dfa719fee09d2f
- SHA1 912342f1c840a42f6b74132f8a7c4ffe7d40fb77
- SHA512 bbd4f0263abc71311404c55cb3e4711b707a71e28dcc1f08abd533a4c7f151db9cc40697105d76f1c978000e8fa7aa219adb65b31fb196b08f1ae003e04b9d23
- SSDEEP 1536:lV3+WmNcWbwurilmw9BgjKu1sPPxaS5qY:lV3+WmjbwxlPwV1qPkS5qY
- TLSH T15CB325539AEC3CC6D47913B137BFA3E5D32EECA46A90C09E96D01182D57C5933A227E4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infected
PE Signature issue
Digest
e0:71:1b:51:ca:fc:5e:0b:87:8a:c5:8b:d8:2f:a5:34:56:08:04:26
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=HE 419469,CN=Hermetica Digital Ltd,O=Hermetica Digital Ltd,L=Nicosia,C=CY,1.3.6.1.4.1.311.60.2.1.3=#13024359,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Aug 6, 2026
SERIALNUMBER=HE 419469,CN=Hermetica Digital Ltd,O=Hermetica Digital Ltd,L=Nicosia,C=CY,1.3.6.1.4.1.311.60.2.1.3=#13024359,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=HE 419469,CN=Hermetica Digital Ltd,O=Hermetica Digital Ltd,L=Nicosia,C=CY,1.3.6.1.4.1.311.60.2.1.3=#13024359,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:48:73:28:73:ac:8c:ce:ba:f8:f0:e1:e8:32:9c:ec
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Apr 13, 2021
Timespan
Apr 13, 2021 - Apr 14, 2022
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
1
Major OS version
5
Entry point
15232
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
StrStrW
StrRChrW
StrChrW
StrToIntW
PathAddExtensionW
PathFindExtensionW
PathFileExistsW
StrCatBuffW
PathAddBackslashW
PathAppendW
StrStrIW
StrCmpNW
wnsprintfW
StrStrA
lz32
LZClose
LZCopy
LZOpenFileW
msvcrt
towupper
wcsncpy
memcpy
_except_handler3
memset
kernel32
HeapAlloc
GetProcessHeap
DeviceIoControl
GetLastError
HeapReAlloc
HeapFree
lstrcmpA
GetSystemTimeAsFileTime
CreateFileW
CloseHandle
SetFilePointerEx
ReadFile
GetDiskFreeSpaceW
lstrlenW
WriteFile
FlushFileBuffers
CreateThread
WaitForMultipleObjects
GetModuleHandleW
GetProcAddress
GetCurrentProcess
VerSetConditionMask
VerifyVersionInfoW
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemDirectoryW
Sleep
WaitForSingleObject
SetThreadPriority
FindFirstFileW
FindNextFileW
FindClose
GetLogicalDriveStringsW
SetLastError
GetCommandLineW
GetModuleFileNameW
CreateEventW
SetEvent
ExitProcess
GetCurrentProcessId
GetFileInformationByHandle
DeleteFileW
user32
wsprintfW
CharLowerW
advapi32
InitiateSystemShutdownExW
ControlService
CloseServiceHandle
DeleteService
StartServiceW
ChangeServiceConfigW
QueryServiceStatus
CreateServiceW
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteKeyW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyW
RegCloseKey
RegSetValueExW
shell32
CommandLineToArgvW
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=98, id=1, productName=Unmarked objects,
count=15, id=265, version=25835,
count=1, id=255, productName=VS2017 v15.5.6 build 25835, version=25835,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.5.6 build 25835, version=25835,