servU-v6.301H.rar
- SHA256 7808ec0e5c494bfabb4afe41c39e6fc8f763820088cb4ffca84cb167a1223300
Behavioral task
behavioral1
Sample
Serv-U FTPServer_v6.3.0.1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Serv-U FTPServer_v6.3.0.1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target servU-v6.301H.rar
- Size 4.0MB
- Sample260809-wvrkystbmf
- SHA256 7808ec0e5c494bfabb4afe41c39e6fc8f763820088cb4ffca84cb167a1223300
- MD5 e8cf76ab52e2326d3c138228dc4b8f2a
- SHA1 9b0b8301003e1b92825d84b94af8c4ce62e37e83
- SHA512 c5541f40d94e1917a527ca50a0b9688204cd25f5bf08f174e05be169b2ec477d0c07eb21f1a2dbd3e9c9ab7541541facf3e27c82ab1c1d243a6f74611387ba03
- SSDEEP 98304:zNO3THIVooTBYn6hQEiKkCt9FLWD85YbUX:QjH4vdY6Ziy9FLS8O4
- TLSH T1E116337161F88388C185716FF8626F5291F1E4A7C68B288CEF845CEBACDE7695373052
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Revoked Certificate in Chain 1 IoCs
One or more certificates in the signing chain have been revoked, indicating potential compromise.
resource unpack001/Serv-U FTPServer_v6.3.0.1.exe - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/setup.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Serv-U FTPServer_v6.3.0.1.exe
File Explorer
-
servU-v6.301H.rar.rar 4.0MB
-
Serv-U FTPServer_v6.3.0.1.exe.exe 2.4MB
-
setup.exe.exe 1.7MB
-
下载说明.htm.html .js 5KB
-
汉化新世纪.txt3KB
-
汉化说明.txt2KB
Serv-U FTPServer_v6.3.0.1.exe
- SHA256 c52fc1b11915c55deeb733db5324b7bfde83eb8fa00af592043b12ac67ea965b
- MD5 b40c1054f6234887d7e0247791dd2b68
- SHA1 a677f68e0c58c185afe0723545a22d282a45d083
- SHA512 cb4e880a913bf098d295dac39c824f0105eb8f6a1ad6684461ee98eb2d68398e954130d766b04c276e487d20af003f7c99c209243f86f18b9bc44bbfb92345ea
- SSDEEP 49152:f6dDUZgKtPKPJSyl890U5KKTvbIGZyzQYgq8jp4NtKDmJ6Zul:idDskJLl82UZTvJZypaDCJ6wl
- TLSH T11CC533815FF0F6F9C8018B357CA561FD99AFED11AA2822372A0C3D4DBBB53644D49718
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
41:98:d2:a6:08:e0:96:5a:0e:2b:d7:85:a6:99:72:ab:0a:7d:61:0f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Rhino Software\, Inc.,O=Rhino Software\, Inc.,POSTALCODE=53137,STREET=P.O. Box 53,L=Helenville,ST=WI,C=US
Chains
Oct 5, 2006
CN=Rhino Software\, Inc.,O=Rhino Software\, Inc.,POSTALCODE=53137,STREET=P.O. Box 53,L=Helenville,ST=WI,C=US
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US
Serial Number
0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2008
Subject
CN=Rhino Software\, Inc.,O=Rhino Software\, Inc.,POSTALCODE=53137,STREET=P.O. Box 53,L=Helenville,ST=WI,C=US
Serial Number
c9:dc:e7:c9:ae:a5:c3:27:c6:ff:ee:33:42:37:05:96
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Mar 22, 2006
Timespan
Mar 22, 2006 - Mar 21, 2008
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Jul 9, 1999 - Jul 9, 2019
Minor OS version
0
Major OS version
1
Entry point
38896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
584B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
setup.exe
- SHA256 579f75a7d5d69f257719a3343caad08bdf3d77635111250bdb7ce807584b8eb6
- MD5 3d3dcf649b7ff303a84170a6edacc929
- SHA1 437264160b3c48176fd46151f13ad22deaf959f0
- SHA512 4c6222fc1bf33e846d96442d97589b9446ab8961618bd5c4407fc544b4dc4ac58b45f0e8c639323c70d7d80582308168d1470c3608a71b5ce18e9d934d57a7cf
- SSDEEP 49152:76dMemjjKKg62YfaHfqLcbKeAHsMt7gZ4OT7TWZ4Cz:edMDErHBK53OT7TWSCz
- TLSH T1338533D0C9CB1935C0B281B428178F0806EF7D10657CEE5ABA8C479D9E37AE9E655B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
38896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
584B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
下载说明.htm
- SHA256 09b45f792a0c100a6e1aef2fbeed1da96b53f3cb2b6ef4ef19c6809ff482bc5a
- MD5 0c1971727b047450aead02d37117c445
- SHA1 bf50fb4c2e5d9c53659c3b6584d7c79477d452d1
- SHA512 a392e4a434ad4d2aaf7453b05c270063f14729ff28704317101afa914871bd580dd9997f8653b65670056d693dc19cb0f1ab93ecea5569c66d7344394746ba70
- SSDEEP 96:mnOQeRA2RWhsFf6Hm4WtVgTrUdl//OdddddddddddddddddddddddddEddddddag:uX8A0JFyGlHZ4/z5w1U4j2NckC
- TLSH T1CAB142D965433627821B1B58B21699CFED0120E06651CB59F13EB4D327D8EBC046BEA9
- MD5 SHA1 SHA512 SSDEEP TLSH
汉化新世纪.txt
- SHA256 20d1fc9bc4b71929780cd67b9713c28e1d13b0f0737e5d2f22a14f53a4988163
- MD5 c64187e4ebd47f25c30c8f207e2e87b4
- SHA1 7822fa17065e5d0a8dc30f417e968a654030a752
- SHA512 d4c512aa926416fdf857af9ea29999f2911ccfbf964cbda173944805a91e13a728897e0a264963a2fde53974b8562f2a6f884a88595a991319e3d9e060fe602a
- TLSH T14471DAB0BFFE8539037E2D25A0275CE2C2B95B77AA285D64365CC5111B316B4C0E9B1F
- MD5 SHA1 SHA512 TLSH
汉化说明.txt
- SHA256 4f22d6b87a6abef3b0d2b52b7721d84a235d41acf23ec443975b9bb6225ea20a
- MD5 a2e0b224268eb0988c8638f10f423fd0
- SHA1 c0b8c9e2f66e94768fc7830b3bc5d04e1dd3aeee
- SHA512 840ce0141812072489b53d8eaf91cfb1d00872a2908e0af04e0c301a70dcf9c8cfce0825db17d2557f351c34fec6b0237cada9298f8ac6de703469f0d6849d9a
- TLSH T1E94184BFB7DE12AABBB200220413D44FC35012967EBBDA05365D2B963FB359681086D5
- MD5 SHA1 SHA512 TLSH