f514c9ad20dc42f44f971dc96425a116.zip
- SHA256 74718452ae0cd5282823570d31d063ec18ba4e00813baac2bd4ab2c463643723
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260513-es
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win11ltsc2024-20260709-es
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target f514c9ad20dc42f44f971dc96425a116.zip
- Size 446KB
- Sample260818-vrt18sad67
- SHA256 74718452ae0cd5282823570d31d063ec18ba4e00813baac2bd4ab2c463643723
- MD5 c59a4168582485580c859e4db519aa37
- SHA1 39c7dc5e4b3d3e68ec7af3816eb67be96c79c77b
- SHA512 eaef58987a08a1aac5ad47f91b77417e611bae62cbd0dd7c1244cec8c8e820385e3b7c7513a925df38ef152ffd921fb9aa1928383b280b920df84eaad0e3979e
- SSDEEP 12288:aRY/Hu0aKxfOTBxxPJTE1mZhYsJiXEp/GBR:aRYPuSxWjxPpJZG1n
- TLSH T118A42331E361196F9F12FBE1C198798AA1460B8706EECB75F6FA158F1E4BC41D1E3214
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
f514c9ad20dc42f44f971dc96425a116.zip.zip 446KB
-
Setup.zip.zip 446KB
-
Setup.exe.exe 532KB
Setup.zip
- SHA256 4a59935ad65b592a3b279d5930d60b653484cf84a8fb2b40a64f9fd07aec7c86
- MD5 f514c9ad20dc42f44f971dc96425a116
- SHA1 d50f15ec7c86716dd9a17730ee0e0a2a3d34a986
- SHA512 df541be301ba6db426055476131964079170e1a4c1c69160a8644fdfb49ed3a0048ffea0d843ac10d4300b3ddf348da5a82457b803db94dce3c5d737acd57927
- SSDEEP 12288:+gx+yDw8zmVa2YRRB9pfQWSms4DGx0eRxq:rxh0g0a/SmQSea
- TLSH T16AA42319F834292540C905EDCC6F1DAA6C34949A41D0D8FFB66DC2FEEEC3926B2B5984
- MD5 SHA1 SHA512 SSDEEP TLSH
Setup.exe
- IMPHASH e00de6e48b9b06aceb12a81e7bf494c9
- SHA256 70a10e559c27092a2f22db963989eb8f6c28b846b67b417b4d97a13d462dc56e
- MD5 753bccd9e5bb39cf64d34bbb35bd65b9
- SHA1 3d373a3c7f04bb13de6e9b4b563172bc377fe2f1
- SHA512 52d822f2a19bd11e4b9a6c517badfd9c26208f32f84f515fe92e8434c8ec57cbdd67c9e399bcde72ede30d9085d5d3607b4b55efb9c9d3b34e80b541e0511b4c
- SSDEEP 12288:NG5knZfFKeTTOydwORmV42Y5RBHtf8WS8sejGxUeRx7/bB:NG50ZfFKMTRCa0gDS8geePB
- TLSH T17EC4F1127DE089B5D5820431CC745FA6A2B6FE560A20887773997E3E7F7F642C232A1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f9:b5:d1:c4:70:d5:79:12:67:67:14:a0:7e:55:4b:bf:80:89:e4:12:62:47:bf:d4:24:d6:8e:43:67:23:71:96
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=1417258-2,CN=7270356 Canada Inc.,O=7270356 Canada Inc.,L=Saint-Laurent,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
Chains
Jun 14, 2024
SERIALNUMBER=1417258-2,CN=7270356 Canada Inc.,O=7270356 Canada Inc.,L=Saint-Laurent,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US
CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US
SERIALNUMBER=1417258-2,CN=7270356 Canada Inc.,O=7270356 Canada Inc.,L=Saint-Laurent,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US
CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Subject
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
4a:53:8c:28
Issuer
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 7, 2009 - Dec 7, 2030
Subject
CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US
Serial Number
4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Issuer
CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2021 - Nov 7, 2030
Subject
CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US
Serial Number
35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Issuer
CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 7, 2021 - Dec 29, 2040
Subject
SERIALNUMBER=1417258-2,CN=7270356 Canada Inc.,O=7270356 Canada Inc.,L=Saint-Laurent,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
Serial Number
25:d0:cb:9d:7b:0d:6c:70:0c:da:e4:3d:24:3a:b1:c6
Issuer
CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 1, 2024 - May 1, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
84180
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
VariantClear
SysAllocString
user32
SendMessageA
SetTimer
DialogBoxParamW
DialogBoxParamA
SetWindowLongA
GetWindowLongA
SetWindowTextW
LoadIconA
LoadStringW
LoadStringA
CharUpperW
CharUpperA
DestroyWindow
EndDialog
PostMessageA
ShowWindow
MessageBoxW
GetDlgItem
KillTimer
SetWindowTextA
shell32
ShellExecuteExA
kernel32
GetCurrentDirectoryA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
GetCurrentProcess
TerminateProcess
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
SetUnhandledExceptionFilter
TlsAlloc
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
WaitForSingleObject
CloseHandle
CreateProcessA
GetCommandLineW
GetVersionExA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetLastError
LoadLibraryA
GetModuleFileNameW
GetModuleFileNameA
LocalFree
FormatMessageW
FormatMessageA
SetFileTime
CreateFileW
SetLastError
SetFileAttributesW
SetFileAttributesA
RemoveDirectoryW
RemoveDirectoryA
CreateDirectoryW
CreateDirectoryA
DeleteFileW
DeleteFileA
GetFullPathNameW
GetFullPathNameA
SetCurrentDirectoryW
SetCurrentDirectoryA
GetCurrentDirectoryW
GetTempPathW
GetTempPathA
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindFirstFileA
FindNextFileW
FindNextFileA
CreateFileA
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
GetStdHandle
WaitForMultipleObjects
Sleep
VirtualAlloc
VirtualFree
CreateEventA
SetEvent
ResetEvent
InitializeCriticalSection
RtlUnwind
RaiseException
HeapAlloc
HeapFree
HeapReAlloc
CreateThread
TlsSetValue
TlsGetValue
ExitThread
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=25, id=14, version=7299,
count=64, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=95, version=2190,
count=178, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=77, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=7, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,