kongtuke.zip
- SHA256 896e776552ee112d74349ae377f49d696622098996cd32ec9ae5fb390957fafc
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
kongtuke.zip
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target kongtuke.zip
- Size 520KB
- Sample260910-trx78ascqe
- SHA256 896e776552ee112d74349ae377f49d696622098996cd32ec9ae5fb390957fafc
- MD5 facd47c7d56c6092ebadb73a1aefd51f
- SHA1 b82f9f408bc0808ca54e00e8c3d32a965ad8b214
- SHA512 519dc2614689d59ff418d9e4a327e72ad254c374b7dafd132fa97658c680257e86905b4629f74ce1fa14554d9ae1b80b32f02ed31209633195eafcff13c02ddf
- SSDEEP 12288:iBtMxd8THs0WQSY9hwn9rxm3qa676rv1U/bOifKAVBjDz:hcMo9hwNgvUrx3z
- TLSH T165B42368F5FF8AC36F53C49E262ED98E2ABE464E8B3802D4258B354EC541394F9C3D54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/vclimg370.bpl - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/TRegSvr.exe
File Explorer
-
kongtuke.zip.zip 520KB
-
TRegSvr.exe.exe 1.6MB
-
run.bat30B
-
vclimg370.bpl.dll 20KB
TRegSvr.exe
- IMPHASH 80752fed42de227839196543e34327c9
- SHA256 4dafa7b6633309282d9b4fd5e75142eef438d970044e4d72ce090b7e1168bda6
- MD5 2cf56ad30086c98ac808cf95d571a807
- SHA1 33073c5340844bd084afc01802dabd4681214e42
- SHA512 153a82aba034c20024a4f62fe951d8db326eb548e586ae89c9c3887e2b6001faf8c444b7ef22b78ca037395e06ba75d600a9ea6ecf793a3edd952fef06816a3a
- SSDEEP 12288:XNUaH595Wz6dCTldYsG0GYnyLivxTnTZtN9IizNxPRU3D4f7hnneScv9Ge6ndFM8:XNtZETHYsGgy2ZRzNxPwvEnn/ST0
- TLSH T15C751A7F7195D13AC19ED13AC1A38F04A433B07A1B33C6E753944269AE0A9D95F7E3A0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
6b:ac:9c:2e:4c:01:48:91:1c:5f:54:fd:47:75:25:03:01:ed:ca:9e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=2582771,CN=Idera\, Inc.,O=Idera\, Inc.,L=Austin,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jan 1, 0001
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2013 - Jan 15, 2038
Subject
SERIALNUMBER=2582771,CN=Idera\, Inc.,O=Idera\, Inc.,L=Austin,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0e:49:e4:3a:a4:98:fb:34:ad:7b:1d:51:e2:e8:3e:39
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 21, 2026 - Jul 14, 2027
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
0
Major OS version
6
Entry point
1340528
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetFileType
RtlUnwindEx
GetACP
CloseHandle
LocalFree
QueryPerformanceFrequency
IsDebuggerPresent
VirtualFree
GetFullPathNameW
GetProcessHeap
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
EnumSystemLocalesW
GetStdHandle
GetModuleHandleW
FreeLibrary
TryEnterCriticalSection
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
CreateThread
CompareStringW
MapViewOfFile
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
SetCurrentDirectoryW
GetCurrentDirectoryW
InitializeCriticalSection
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetCommandLineW
GetSystemInfo
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
LCMapStringW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
GetConsoleOutputCP
UnmapViewOfFile
GetConsoleCP
lstrlenW
SetEndOfFile
QueryPerformanceCounter
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
GetLocaleInfoW
CreateFileW
IsDBCSLeadByteEx
GetLocalTime
WaitForSingleObject
WriteFile
CreateFileMappingW
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
IsValidLocale
TlsSetValue
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
CreateEventW
SetThreadLocale
GetThreadLocale
ole32
CoInitialize
CoUninitialize
CoTaskMemFree
StringFromCLSID
user32
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
CharLowerBuffW
LoadStringW
CharUpperW
PeekMessageW
GetSystemMetrics
CharToOemW
MessageBoxW
oleaut32
SafeArrayPutElement
LoadTypeLib
GetErrorInfo
VariantInit
VariantClear
SysFreeString
SafeArrayAccessData
SysReAllocStringLen
SafeArrayCreate
SafeArrayGetElement
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetUBound
SafeArrayGetLBound
RegisterTypeLib
VariantChangeType
advapi32
RegEnumKeyW
RegQueryValueW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
imagehlp
ImageDirectoryEntryToData
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
136KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
49KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
1024B
Virtual Size
658B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
584B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
109B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.pdata
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
run.bat
- SHA256 007647288e308b7dee6939133a868d64d8ee66203119445b1581d7fdde2c2f00
- MD5 4189ecea6bf068d7d1bd2e603c3ad3ec
- SHA1 c1b57e4ff8df216fe49f4130a7e96c10dc506a0f
- SHA512 b96fef61f5ed0d2fd049a216202594caea963b106aba9a25f3a7d729e1a51847abfe901c4cf2cb8373e1e5a4b2a3e4f872e009eac5ce71543573f6179d43aaa2
- MD5 SHA1 SHA512
vclimg370.bpl
- IMPHASH bf5b9c1ef3acb129f56191729513b033
- SHA256 d22a029b0fd967ef7a08501c1554a648f2f576f11706ab9a9ad9c042d63244ec
- MD5 9705b0432aed14d091d6a06392261b54
- SHA1 3c01795bf3bc3d7848df78572022ef9ee28e8100
- SHA512 72ab9b6cdbe60fd017687b593047e0ff0602dd3db91eeb6d47fcc5a989f30a12e9e621d38a97c9b27d96903de4e7a7c7721ca45100b67d1cae4108a0d53720ba
- SSDEEP 192:zbPLkSrYxpcvTUKnh9BlNJFIzPuDvGcCWpINKV21pwHdcYcrMlAXmImqThdD:zbP90uRvEs1m0WLZrMwTfD
- TLSH T14A92180FAAE354ADC69AC47482F74736F9B1BC014AB5AF3D8260CB324E60B506779F05
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateFileA
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
GetEnvironmentVariableA
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
ReadFile
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
lstrcatA
lstrcmpA
lstrcpyA
lstrlenA
msvcrt
__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf
user32
wsprintfA
DllRegisterServer
DllUnregisterServer
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
424B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ