XDR_ResponseApp_CollectFile_RM-20260813-00014_63ffb2a8-ee86-44fb-821c-64e576a0ebe4_20260813T084232Z.zip
- SHA256 7b3e0f7e6542a808160ee99d35089abda5219e68106a01bf194f224db66b2df4
Static task
static1
1 signatures
General
- Target XDR_ResponseApp_CollectFile_RM-20260813-00014_63ffb2a8-ee86-44fb-821c-64e576a0ebe4_20260813T084232Z.zip
- Size 987KB
- Sample260813-k3vrssvvb1
- SHA256 7b3e0f7e6542a808160ee99d35089abda5219e68106a01bf194f224db66b2df4
- MD5 c8867380c14417c9a5da12c5d49923a4
- SHA1 da09e71c53a41e1dfc51b3361969ed41af65d79a
- SHA512 49b7aafc407cd81a85c42363453d349579878c69df316e295eaa99dc2ffc56bc7bf6e9e66ed783538a3dd8f21d05321d6fae80334c4326b316a57fc7e8876dfc
- SSDEEP 24576:CyBDqRb5mGLcIZ14sVjpwKmAaZ7G/mpgXGfj6bnIiDphsshRqgQ:7DqR0G714sVjpwKmlZ7GOaWfj6bnIiDy
- TLSH T13C2533471FE2F597F3096D9D3BADE7E4175258728C6AC9622C824ABD0548C7AF3031B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/XDR_ResponseApp_CollectFile_RM-20260813-00014_63ffb2a8-ee86-44fb-821c-64e576a0ebe4_20260813T084232Z/vulkan-1.dll
File Explorer
-
XDR_ResponseApp_CollectFile_RM-20260813-00014_63ffb2a8-ee86-44fb-821c-64e576a0ebe4_20260813T084232Z.zip.zip 987KB
-
XDR_ResponseApp_CollectFile_RM-20260813-00014_63ffb2a8-ee86-44fb-821c-64e576a0ebe4_20260813T084232Z/08.13Statement of Account.exe.exe.exe 1.9MB
-
XDR_ResponseApp_CollectFile_RM-20260813-00014_63ffb2a8-ee86-44fb-821c-64e576a0ebe4_20260813T084232Z/vulkan-1.bin291KB
-
XDR_ResponseApp_CollectFile_RM-20260813-00014_63ffb2a8-ee86-44fb-821c-64e576a0ebe4_20260813T084232Z/vulkan-1.dll.dll 366KB
XDR_ResponseApp_CollectFile_RM-20260813-00014_63ffb2a8-ee86-44fb-821c-64e576a0ebe4_20260813T084232Z/08.13Statement of Account.exe.exe
- IMPHASH 559cb907fe52b806b92168cb50dec34c
- SHA256 facf78d474b66ed821288db41fa6ad8a7b6f30650eb12127cb3e9a3cc6146116
- MD5 72a8eb805e026accc0a5805847db978f
- SHA1 a1589326cc3fcd0c64a7c08ca78fe30b3f7ee5cf
- SHA512 c1fa2348f5b7b2938dacc27328e1fb105b42b39a248aa6e765b94254e0ba03b6cecfe6f69d08d7761e6789497663addabf56f94f2b2e5eb7987487367a8a2e5f
- SSDEEP 49152:8pojL/+cPZpJGmF+Ml7mbN6ZNjshcYpKkjsVc2ot4+Ej2ED+l3eFq8umM:jZpldnGMkjsVc2ot4+Ej2ED+l3eFqcM
- TLSH T161957D29F6488195C17AC17C8AD6CB4BE7B1B40D87359ACF508547DE0E63BE18D3EAE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4d:18:80:b7:ca:8f:e9:87:97:be:0c:d0:0b:ea:2f:1c:c4:b5:98:a3:39:1a:6c:cd:c2:9b:63:b2:9e:aa:ac:1e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 16, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
4d:18:80:b7:ca:8f:e9:87:97:be:0c:d0:0b:ea:2f:1c:c4:b5:98:a3:39:1a:6c:cd:c2:9b:63:b2:9e:aa:ac:1e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Intel Corporation,O=Intel Corporation,L=Santa Clara,ST=California,C=US
Chains
Jul 19, 2022
CN=Intel Corporation,O=Intel Corporation,L=Santa Clara,ST=California,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Intel Corporation,O=Intel Corporation,L=Santa Clara,ST=California,C=US
Serial Number
63:f8:00:10:50:1d:2b:4b:6c:5f:d1:00:46:65:ff:e7
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 31, 2021 - Mar 31, 2023
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 10, 2022 - Mar 8, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:7BF1-E3EA-B808,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:9f:2b:45:35:15:08:2e:4b:5d:00:01:00:00:01:9f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
29216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\j\msdk\build\Khronos-Tools\repo\build\vulkaninfo\RelWithDebInfo\vulkaninfo.pdb
kernel32
Sleep
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryExA
LoadLibraryA
GetConsoleScreenBufferInfo
SetErrorMode
SetConsoleWindowInfo
SetConsoleTitleA
GetConsoleProcessList
HeapSize
CreateFileW
ReadConsoleW
SetConsoleScreenBufferSize
GetStdHandle
WideCharToMultiByte
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetCurrentThread
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
GetProcessHeap
GetTimeZoneInformation
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
OutputDebugStringA
OutputDebugStringW
SetStdHandle
WriteConsoleW
SetEndOfFile
user32
LoadCursorA
MonitorFromWindow
gdi32
GetStockObject
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
386KB
Virtual Size
386KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.cfguard
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
1024B
Virtual Size
777B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
283B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=260, version=23917,
count=11, id=259, version=23917,
count=150, id=261, version=23917,
count=8, id=259, version=24123,
count=60, id=261, version=24123,
count=36, id=260, version=24123,
count=7, id=257, version=23917,
count=109, id=1, productName=Unmarked objects,
count=1, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
XDR_ResponseApp_CollectFile_RM-20260813-00014_63ffb2a8-ee86-44fb-821c-64e576a0ebe4_20260813T084232Z/vulkan-1.bin
- SHA256 f7eafc6c045f6bc01fdeb7bb9bfe154177dbd6a4f227fd5ca12e3a84031f6cfb
- MD5 81c52b89d2eb232ae1ee9f2140e978c1
- SHA1 05f1a7ab730796065228e83b1ac55f9656d45b4b
- SHA512 8e89ca655a4aa0c1ca44b8eec30180fba2740a1be6e15e2dc4de1c5caff5ca01d530f43a29df37d43edc2e6687b57b787c4220c863e7e269a2fe19574f840826
- SSDEEP 6144:7HOxO07wlo4ZBI1fv9Sltx8uXCJBo7Biw86m8wjrvx6lXqMhRd2QeW:7HS7Ko4m1fu1XCUAfjNYtB29W
- TLSH T1CC5423086EB161BEE34A285933DCE3E902D13C3ED835A34D74C46E9E185177AF50E59B
- MD5 SHA1 SHA512 SSDEEP TLSH
XDR_ResponseApp_CollectFile_RM-20260813-00014_63ffb2a8-ee86-44fb-821c-64e576a0ebe4_20260813T084232Z/vulkan-1.dll
- IMPHASH 3e93ae8463366701823d91da107abccb
- SHA256 956c4548873cad35ccc832e5d99bdd6f144664e7e909ef0349c5a0b34e77da85
- MD5 39c2c0e7fb6cbde4f0f432e90af15c9c
- SHA1 1c61853b06cf3a357000d642f1df78d478989473
- SHA512 ef890c609f7cdc6082e6ff79fb24673f77ce55f357fc58086b3034fcdd08f74b279efe11febbc39940a7055b6083e0b6092a0cbd8e929792ad05aea1e2a9443d
- SSDEEP 6144:oDe0+tDkZmEvUuIekUmvmlNn4kkeOAVA1rUGh0Hp:o5ZmvsNn4kkeQ1rUGuJ
- TLSH T16684281776520ADBC97AE03C4E8B6515F7B1B8A14730A7CF22B1027D4E677F89E3A205
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
0
Entry point
135290
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
././kernel32
IsDebuggerPresent
RaiseException
Sleep
GetCurrentProcess
ExitProcess
GetTickCount64
VirtualAlloc
VirtualProtect
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryW
lstrcatW
lstrlenW
WideCharToMultiByte
GetModuleHandleExW
FreeLibrary
EncodePointer
InterlockedFlushSList
VirtualQuery
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
CloseHandle
WaitForSingleObjectEx
GetCurrentThreadId
InitializeCriticalSectionEx
.\.\user32
MessageBoxA
./.\ole32
CoGetObjectContext
CoInitializeEx
.\./msvcrt
_msize
__getmainargs
__CppXcptFilter
?terminate@@YAXXZ
_errno
strcpy_s
_initterm_e
_initterm
_callnewh
abort
_beginthreadex
rewind
ftell
fseek
fread
fopen
fclose
rand
malloc
free
_setjmp
_local_unwind
__DestructExceptionObject
_amsg_exit
__C_specific_handler
memset
memmove
_CxxThrowException
longjmp
memcpy
realloc
__CxxFrameHandler3
vkEnumerateInstanceVersion
Name
Size
147KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
30KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
101KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE