f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f.zip
- SHA256 68bdc2c63af2ab9fe75bc3bc55cf44bf48f82c81f5ca366b2f539d45bbe9d502
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
11 signatures
300 seconds
General
- Target f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f.zip
- Size 93KB
- Sample260831-bzcmdatanb
- SHA256 68bdc2c63af2ab9fe75bc3bc55cf44bf48f82c81f5ca366b2f539d45bbe9d502
- MD5 a59779f75bce10acef6df40db1c2baf7
- SHA1 0d0b03f7adc1b38d5e23164707153862369478f7
- SHA512 4761f90f698e4fe5972c571f872f84b1e4d216e6bdb3da76ead00f8bd3940f80a9a90da811032453409b1d72815c53f4822ea562b1f1f9a21d6bd0539f19c460
- SSDEEP 1536:ORBN8aVqM0HOVxwE3rrDHxmKXXZxMbm0K649xvUQD6WmMwig6HoUKX26IzdSM/7K:4BFVqja648K3EDr4rsQm3iRbKSjU1
- TLSH T1689312B441194A8633214F7E36D91B5F91AA9034ED4D7B78F30B8D410F5E533AE2BA4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f.exe
File Explorer
-
f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f.zip.zip 93KB
-
f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f.exe.exe 105KB
f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f.exe
- IMPHASH 2ed2f81f89a1bf1f161dc30df28cef9a
- SHA256 f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f
- MD5 4a654205ddda5187ea3bf4b03074e4d2
- SHA1 172a7bfb9eedb8b7c18ea7186309f013944caa75
- SHA512 e91f7426065026bd7c5fa837e772570ad73039f58c5d23afc35c3fcf01849bf27bb899c438af66359291a8c0c19fed2a6bd61e7535df5dc0fb8cde0bf6409cf5
- SSDEEP 1536:078EQgoMNcjwGzlAbBbqfSpApMjY9WgWWlfSqyTX56+UzAP3vaqtVY7PJhMpPcv:cQT3lAbBbRpA+TgWqd69Uz8vTtViJh06
- TLSH T1CDB3F107F30A0652DD2AA272D089C4F3F770CFC912215D7D992B99242667B926B3A35F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
Password
infected
PE Signature issue
Digest
63:78:b4:23:18:c5:53:c6:fe:ca:b0:1b:67:73:00:eb:cb:e1:b6:90:69:2b:59:89:22:35:f8:9c:a6:d3:3f:12
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 18, 2019
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 3, 2018 - Jul 26, 2019
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:0842-4BE6-C29A,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:00:d8:1a:e4:cc:3f:7a:11:fa:e1:00:00:00:00:00:d8
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 23, 2018 - Nov 23, 2019
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
4123
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
RegCloseKey
RegCreateKeyExA
RegSetValueExA
kernel32
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
IsDBCSLeadByte
LeaveCriticalSection
LoadLibraryA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualAlloc
VirtualProtect
VirtualQuery
api-ms-win-crt-environment-l1-1-0
__p__environ
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p__acmdln
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_initialize_narrow_environment
_initterm
_initterm_e
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
fflush
setvbuf
api-ms-win-crt-string-l1-1-0
strlen
strncmp
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ