368-Arch%21vo-61D9ZRSDsY1r5hndqVAbVold.zip
- SHA256 33cdfc638e8400e3d9e96b2cd924891537489e04eeb11438aa549ff95934b53a
Behavioral task
behavioral1
Sample
368-Arch!vo-61D9ZRSDsY1r5hndqVAbVold.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
368-Arch!vo-61D9ZRSDsY1r5hndqVAbVold.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 368-Arch%21vo-61D9ZRSDsY1r5hndqVAbVold.zip
- Size 309KB
- Sample260910-pr2s7atcja
- SHA256 33cdfc638e8400e3d9e96b2cd924891537489e04eeb11438aa549ff95934b53a
- MD5 39ac87ce11094686bac62adcf43fb355
- SHA1 662b7c23e2fc065451e9b83178ad710de324076d
- SHA512 7650b73803a7f6c4aa4c60b3e2a147cc13b488634c1d8546b921ad0e4dd57a3fc6ae32464455a079965e4ae3c321418cd52ca8bfbf23305b2866148e71e913ba
- SSDEEP 6144:wIRYAHXZw5RhjuOjQzP2ny0MUaD3ioZjMzQAqnesh7j/lEw5sQ71oJMZzyI4poN:BTYR8WQzuny973ioV7Pesh9F5sgoJeT
- TLSH T1BB6423E5EDD08FFA0888A7FB796C4B9CAAB9DE0CCE70545244F459842ED2B439744847
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/_ upx - Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/_ - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx
File Explorer
-
368-Arch%21vo-61D9ZRSDsY1r5hndqVAbVold.zip.zip 309KB
-
368-Arch!vo-61D9ZRSDsY1r5hndqVAbVold.vbs.vbs 3KB
-
_.exe 325KB
-
out.upx.exe 188KB
368-Arch!vo-61D9ZRSDsY1r5hndqVAbVold.vbs
- SHA256 e725e58b77d87158a9c4d68ba6468ddd4cf13ab61f18131dd1fa6d9be830ae76
- MD5 7d96f2ea6837aa91456455afa582da83
- SHA1 bbf3e2a3310a7e4b5f2602cd16bc7fb7a57c7592
- SHA512 fbc1d63f035723e94f0a858a85f865a5a64b872dd06ed819cf620578d2f5b67a10423567d3ec6943adfe686440bd463dd4be71d9f9156631b5fe3a0e202e8a2f
- TLSH T1A471DCB1B1152533DFC12604E761BC8516BE7EBD2185672DF8090A4A3209773DCCA6EB
- MD5 SHA1 SHA512 TLSH
_
- SHA256 28225c5622637cdaed8342e14560e8de7b53dd6ba145d973643fc4b5bdd67b75
- MD5 04704493bcdc4d0c1c9d0fd8ebf5afbc
- SHA1 95d64b037a8d0c5d8318a7c1429d89529ac5c766
- SHA512 ed06b9f7931326ff6923b65e95db45931b21995aa8b52eb26f578017e5b60bee7139251bc3fedc65fc7becb7e1d7d4dfdaa17361d01d8d36ebd770c9142c5c8d
- SSDEEP 6144:daVWdyzOxeA1DfdwX3MmIO12waD3ioZjkzQAqnee7j/lEm5sQ71oJwZzyIrz:dMROxdDfOnMmXa3ioVTPee9t5sgoJqrz
- TLSH T16A6412E65FBC88DEC8C1A476AD6CC74B9F799E089744C8779470F8947B4BB8B2348112
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
28:94:1d:78:32:21:70:43:20:17:99:0c:a4:7f:48:7a:fe:99:45:ca
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
Chains
Sep 27, 2021
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
Serial Number
0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fd
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 9, 2021 - Jun 19, 2024
Subject
CN=Dummy
Serial Number
7e:89:b9:df:00:6b:d1:aa:4c:48:d8:65:03:96:34:ca
Issuer
CN=Dummy
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 1, 2013 - Jan 2, 2013
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Minor OS version
0
Major OS version
4
Entry point
216992
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
64KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=14, version=7299,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=172, id=1, productName=Unmarked objects,
count=26, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=73, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
out.upx
- SHA256 d010265be33ead064c15604dcf5e90bf9f0608585eb9a04171294941e14a95a2
- MD5 2a779706848199e597315870c4b077d4
- SHA1 48c674022d55ddb45d741c9c901204471ac973c7
- SHA512 b092be4b0276c4fdc95ffa9635ae7be9b7babb0d3aa99bf9b6e17b8d53fc3351b1e0934ffc19639da89e580f028c5e9c38a2e78f84a071ddb546e619cf41889c
- SSDEEP 3072:488bdXF8FtO5dyzEAKZ/hx7c3unn+b09CIWncYodntK+C7VieM3SFZNt9ckP:XsdXFryQfP7nn+b0AvncfdwX3MmIO
- TLSH T14414AE323AD5C8FAD2532271CB49B7EAE1FADB180814493323142E5D7FBE846931D61E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=172, id=1, productName=Unmarked objects,
count=26, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=73, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,