27_F!CHER0_.53kQgPqe2IGGjpIlJGQX.zip
- SHA256 e0b8c8f5d00fcb0ab33b6c8a0d4e86f47e8991b16d1746f4ca5b45b0313d066d
Behavioral task
behavioral1
Sample
27_F!CHER0_.53kQgPqe2IGGjpIlJGQX.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
27_F!CHER0_.53kQgPqe2IGGjpIlJGQX.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 27_F!CHER0_.53kQgPqe2IGGjpIlJGQX.zip
- Size 309KB
- Sample260908-plhs5afd89
- SHA256 e0b8c8f5d00fcb0ab33b6c8a0d4e86f47e8991b16d1746f4ca5b45b0313d066d
- MD5 45ab5922ca9effd32ce949a1d849da16
- SHA1 49aaa29e4deda48ecd7e35e3a732459c06222364
- SHA512 0e9dafca414d6cc2eae6242c8895fc431ee7ee79ff524f755dde147ad37aa26ee32d9c534402af84eafbf2c72c4fdeae58471037d8af85ec9660e2881fab2930
- SSDEEP 6144:oIRYAHXZw5RhjuOjQzP2ny0MUaD3ioZjMzQAqnesh7j/lEw5sQ71oJMZzyI4poX:ZTYR8WQzuny973ioV7Pesh9F5sgoJe1
- TLSH T1B36423A5EDD08FFA08C8A6FB796C4BACAAB9DE0CCF70585244F459C41ED27439784847
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/_ upx - Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/_ - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx
File Explorer
-
27_F!CHER0_.53kQgPqe2IGGjpIlJGQX.zip.zip 309KB
-
27_F!CHER0_.53kQgPqe2IGGjpIlJGQX.vbs.vbs 4KB
-
_.exe 325KB
-
out.upx.exe 188KB
27_F!CHER0_.53kQgPqe2IGGjpIlJGQX.vbs
- SHA256 2f6fc25d2f4f79819828e9cf145f66b84332510a9f7052bc3b886e864cad1843
- MD5 7d0197fd08a96c63de0862c4b2de1390
- SHA1 110d4e0e000f5db8e60b6f80c6d624b45f6e6002
- SHA512 eae5cb6a08e32e2bab242cd9007f71b3d3497947aab107a23cc60e9c546ce977e8aca365b17d7ea0536b6a3b65283d990aea4f40dd446384f94b6f86a098efa2
- SSDEEP 96:eGHC4+pMWgkCGBZ/buWnjnPswlBGvvtjeUM4:bxhWgkCOZ/K2PllcvtV
- TLSH T141A1128B7B1AB27F9FCD6142382BBEAF41B265D16482BE5042063F35E186D79F60143D
- MD5 SHA1 SHA512 SSDEEP TLSH
_
- SHA256 28225c5622637cdaed8342e14560e8de7b53dd6ba145d973643fc4b5bdd67b75
- MD5 04704493bcdc4d0c1c9d0fd8ebf5afbc
- SHA1 95d64b037a8d0c5d8318a7c1429d89529ac5c766
- SHA512 ed06b9f7931326ff6923b65e95db45931b21995aa8b52eb26f578017e5b60bee7139251bc3fedc65fc7becb7e1d7d4dfdaa17361d01d8d36ebd770c9142c5c8d
- SSDEEP 6144:daVWdyzOxeA1DfdwX3MmIO12waD3ioZjkzQAqnee7j/lEm5sQ71oJwZzyIrz:dMROxdDfOnMmXa3ioVTPee9t5sgoJqrz
- TLSH T16A6412E65FBC88DEC8C1A476AD6CC74B9F799E089744C8779470F8947B4BB8B2348112
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
28:94:1d:78:32:21:70:43:20:17:99:0c:a4:7f:48:7a:fe:99:45:ca
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
Chains
Sep 27, 2021
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
Serial Number
0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fd
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 9, 2021 - Jun 19, 2024
Subject
CN=Dummy
Serial Number
7e:89:b9:df:00:6b:d1:aa:4c:48:d8:65:03:96:34:ca
Issuer
CN=Dummy
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 1, 2013 - Jan 2, 2013
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Minor OS version
0
Major OS version
4
Entry point
216992
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
64KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=14, version=7299,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=172, id=1, productName=Unmarked objects,
count=26, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=73, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
out.upx
- SHA256 d010265be33ead064c15604dcf5e90bf9f0608585eb9a04171294941e14a95a2
- MD5 2a779706848199e597315870c4b077d4
- SHA1 48c674022d55ddb45d741c9c901204471ac973c7
- SHA512 b092be4b0276c4fdc95ffa9635ae7be9b7babb0d3aa99bf9b6e17b8d53fc3351b1e0934ffc19639da89e580f028c5e9c38a2e78f84a071ddb546e619cf41889c
- SSDEEP 3072:488bdXF8FtO5dyzEAKZ/hx7c3unn+b09CIWncYodntK+C7VieM3SFZNt9ckP:XsdXFryQfP7nn+b0AvncfdwX3MmIO
- TLSH T14414AE323AD5C8FAD2532271CB49B7EAE1FADB180814493323142E5D7FBE846931D61E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=172, id=1, productName=Unmarked objects,
count=26, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=73, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,