Docum-UFFRR.boponkmp_emxbSign.zip
- SHA256 ac9564080dd24a6bb62ad3d3549282b7b251a24dcdef1eeb1ead986938f96957
Behavioral task
behavioral1
Sample
_08838Regist-Q2K52MKBVM_S4JJInstBYRQKK.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
_08838Regist-Q2K52MKBVM_S4JJInstBYRQKK.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target Docum-UFFRR.boponkmp_emxbSign.zip
- Size 3.0MB
- Sample260824-e4vkjacp3y
- SHA256 ac9564080dd24a6bb62ad3d3549282b7b251a24dcdef1eeb1ead986938f96957
- MD5 503517f06db36846b863c50ec2cdb5ab
- SHA1 dbc50c842138eadc8d08f39704cb6183211e6753
- SHA512 0e7ab1f8a472e1fa10368e9d053d9e13d2d9a6b035951e4b208eb323d926505377dfb2565cc6dcca89962912b1c29c02cb41f7fee768e1ec33559011918e4721
- SSDEEP 49152:8/eIxprP+DFuY8H79NrqJatzGgWM+T5lwY8u+IdrP7OLLhElQ:ykDcV7eEtCg5wnZ9P7O+6
- TLSH T155E533E5DFF49A0DDEB8BA0633A6E17F1117B559070C1171945B2898E0BB030FC98AEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
File Explorer
-
Docum-UFFRR.boponkmp_emxbSign.zip.zip 3.0MB
-
_08838Regist-Q2K52MKBVM_S4JJInstBYRQKK.vbs4.1MB
-
~/gfmf/ucio/onkc/qcgrdf/blfldb2.pdf.pdf 30KB
-
~/gfmf/ucio/onkc/qcgrdf/dnsb1.pdf.pdf 1KB
-
~/yrkrx2.xml.dll 41KB
-
~/yzth1.xml.dll 20KB
_08838Regist-Q2K52MKBVM_S4JJInstBYRQKK.vbs
- SHA256 1d33136f99f6f9121b6176602d1a66bf1839e9c4023423bf29e8d3cb909fa763
- MD5 894ba359ead45532553fb68c8218bf57
- SHA1 5d96e18bb859d4bba4825fee08691cd425ac27c9
- SHA512 5ced7fd502a3b06b16a21d3f1e226f1a12662f655183d43b1c85ca8941fbc3be8a3e8cabe93a94440fd877326fe3bf183da6eab9a301b09609aa3b452e2bf6ed
- SSDEEP 49152:ARR+wexU15EkYV/Cb2N7doOXOjAE9eMgeVF3O8EGJF/z45:5
- TLSH T1F2162331AF392967083CC626616B3EF56FBC460347C4F66E485522C734EEA83D91F869
- MD5 SHA1 SHA512 SSDEEP TLSH
~/gfmf/ucio/onkc/qcgrdf/blfldb2.pdf
- SHA256 b47113beebc9f6016cb68b3b99c19ae37503dbfe91d783655faac3b6260362af
- MD5 41e71b077ea3d59bcb5f2813a055fd7c
- SHA1 4a90bd570faaaffaac40463fdadbe0d5f5714b86
- SHA512 cc4a8c4ee0efce7ba44da9608173f87aa292f7fbaa001b40f2d12b0442b1df28e5263090c8293a2bbade1daa29203b5aaa22f3c4bd16ce4cf804ee342d61b8c2
- SSDEEP 384:HoHkod7p44/Ez3XWb0bWdpTFqziADFdwbSnRkz0+NNGmuGkvJ9dmUWMNv5itbFon:HG7b/Ez2bdOiZb+54NkGwJV
- TLSH T1B1E2940DF246FA90D45147E52F397579653F732968CA1A908DA2C32BE6019FB3B7CC82
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
file http://bardahl.com.ar
~/gfmf/ucio/onkc/qcgrdf/dnsb1.pdf
- SHA256 a13380c87f31b47c1b292d0a942ac548412798bbe80ca9bb0c3ecc27c2cf2b44
- MD5 3a29b8f490b3bc6a9f1023f0eed12d55
- SHA1 ad32c4a3b97ab417222b3e2f9877d25d3c3ed058
- SHA512 5869f38c5c413e872bd7e1bd84487a176711ae33a2e553eff7121386026f07f35fe00b3b9b5206360b8dfe1cad8ef861de585df3118770d39ae3b939201d8e5c
- TLSH T173310E2495CC4CDCF1A686C1BF2F7886A47AB00352E8A8C111BCC64FC18AFD5AC53B17
- MD5 SHA1 SHA512 TLSH
~/yrkrx2.xml
- IMPHASH 6c8408bb5d7d5a5b75b9314f94e68763
- SHA256 7d750be30b5d239e62585ce223016dbf2c24dccd6c31b1c4737e03936c755c2e
- MD5 8790abac4c4b63b922ba21ad5004884a
- SHA1 11f2475143578eecbbfd5865501c7201c4d12eda
- SHA512 ed2f4ea3df5b956aeaa79b364bb627acc372b7680dbde9f351611b80d746f62450e11006f81875f48f5d1575ef5c4a1e3b12cee76fd8f95e4ca6fc3c66a5cd56
- SSDEEP 384:6kOtkCLu+JGRNyEIYi2mL4/y8RLVHFwaeE5:fOtkCLdvYiDLk5/aBa
- TLSH T1CE132E720948DD3CE7137A30D59ACE3F916711D29CC4736A21A4A93186B0722AB5FEFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
90:0c:05:b1:58:2e:e3:3e:cc:bb:cb:9c:27:ad:3f:66:51:53:c5:0c:be:a1:49:09:97:60:3a:1b:02:31:c6:0e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US
Chains
Jul 17, 2026
CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US
Serial Number
0e:98:2f:dd:f0:6e:93:e9:11:06:5d:03:7d:4d:d4:82
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 28, 2024 - Aug 6, 2027
Minor OS version
1
Major OS version
5
Entry point
4820
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
goopdateres_unsigned_ar.pdb
kernel32
DisableThreadLibraryCalls
Name
.text
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
106B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=260, version=33808,
count=3, id=257, version=30795,
count=6, id=1, productName=Unmarked objects,
count=1, id=265, version=34123,
count=1, id=256, version=34123,
count=1, id=255, version=34123,
count=1, id=258, version=34123,
~/yzth1.xml
- IMPHASH 80bd9c6779706dbd0301e3c4d772ff00
- SHA256 39768457bbeb5af3d537b8311c73e2d5dffc4a6e9a29ab5077341a951f2468d1
- MD5 1d93a7ab93e4b1e7233e77523fcc676d
- SHA1 a0b3c36c6df20ea5c705669756887c3eb74f757d
- SHA512 3b0a9564639a0c796ee6ae382d851da7fdec444c7203dd9155ed4773620ba1724106c679a29e9e4c47d739f627879c6b01d1c667d2e7de4526d226cd8fc1d80d
- SSDEEP 384:qkqM+ObiQVns8VBSIRw/eDX9OUOZ2OPVIdvYuYJL+mcXfeMQ:qkqM+uELKX9OUOZ2Od+g3LJp
- TLSH T164924997BB048072E9CD4A7450B7D23B487977411FC120E3B7E80A5E5EA87E22B74A47
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
0d:b3:38:13:ef:0b:c6:0f:25:ae:ff:be:95:21:6a:7c:f1:13:ed:bc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Chains
Mar 30, 2012
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Serial Number
15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 15, 2010 - Dec 14, 2012
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
5
Entry point
11310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\depot\build-FW-Rel-Win\Mainline\fw\app\output\ASE.pdb
msvcr100
_unlock
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_lock
_onexit
_except_handler4_common
?terminate@@YAXXZ
_crt_debugger_hook
__clean_type_info_names_internal
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
??2@YAPAXI@Z
??3@YAXPAX@Z
malloc
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
__dllonexit
free
_CxxThrowException
__CxxFrameHandler3
memcpy
msvcp100
?_Xlength_error@std@@YAXPBD@Z
kernel32
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
ASEFreeBuffer
ASEFreeStructure
ASERead
ASEWrite
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=152, version=20115,
count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=4, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=44, id=1, productName=Unmarked objects,
count=7, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,