76_F%21CHER0__58c5hm0fSmEEJCJfaaXw.zip
- SHA256 28a51f0e8b88e5dbcddd1ced1d101fa86f7baa16edd0fe6d4ff0f96cd544bdb1
Behavioral task
behavioral1
Sample
76_F!CHER0__58c5hm0fSmEEJCJfaaXw.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
76_F!CHER0__58c5hm0fSmEEJCJfaaXw.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
_.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
_.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 76_F%21CHER0__58c5hm0fSmEEJCJfaaXw.zip
- Size 309KB
- Sample260913-amn9zacf23
- SHA256 28a51f0e8b88e5dbcddd1ced1d101fa86f7baa16edd0fe6d4ff0f96cd544bdb1
- MD5 508bf018734e9635f16b968fb3b42962
- SHA1 0e531fe8ec74b891c140c50624b05a1d8a07ac08
- SHA512 8e9a6da2719dd1f4273547b153b10dcc98bd7fd73449c5ef2c8523454ffba111af95456a5ac64f93662cb252789877d5488a3d41f4aef24425217c314bdbb3a8
- SSDEEP 6144:ckIRYAHXZw5RhjuOjQzP2ny0MUaD3ioZjMzQAqnesh7j/lEw5sQ71oJMZzyI4po0:c1TYR8WQzuny973ioV7Pesh9F5sgoJei
- TLSH T1C76423A5FDD08FF608C8A7FB756C4BADAAB9DE0CCE70585244F44A841ED27439784847
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/_ upx - Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/_ - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx
File Explorer
-
76_F%21CHER0__58c5hm0fSmEEJCJfaaXw.zip.zip 309KB
-
76_F!CHER0__58c5hm0fSmEEJCJfaaXw.vbs.vbs 4KB
-
_.exe 325KB
-
out.upx.exe 188KB
76_F!CHER0__58c5hm0fSmEEJCJfaaXw.vbs
- SHA256 db75b6e02e47046b7e6e31c16d2b5c069985f7a59ea0e48b5488facdac90b888
- MD5 152a2f84df4d89ea45df6320fe2d4654
- SHA1 8841c1232af0430db2b0853b853785497604c8e8
- SHA512 471eb3cb25a286d13b549e22c4119cb28b1c556cea0af42765e577d358379c5bd6c67f5f00669292c8cd5f3154cbb988b28c41e9f9f6c9e5b53dbba098e39540
- SSDEEP 96:nxCefKmNJAg9dg9TDp8h5+hP50UGdhNOhDQz/Fc7X1AFFQi3oPW:nxJfKMJJdg9TCh5melV67WF6i3oPW
- TLSH T1DDA1F0499C225F29B7E64021CE0778D7BE804C51B9CF6567B59B0EE1F21E632C2816EF
- MD5 SHA1 SHA512 SSDEEP TLSH
_
- SHA256 28225c5622637cdaed8342e14560e8de7b53dd6ba145d973643fc4b5bdd67b75
- MD5 04704493bcdc4d0c1c9d0fd8ebf5afbc
- SHA1 95d64b037a8d0c5d8318a7c1429d89529ac5c766
- SHA512 ed06b9f7931326ff6923b65e95db45931b21995aa8b52eb26f578017e5b60bee7139251bc3fedc65fc7becb7e1d7d4dfdaa17361d01d8d36ebd770c9142c5c8d
- SSDEEP 6144:daVWdyzOxeA1DfdwX3MmIO12waD3ioZjkzQAqnee7j/lEm5sQ71oJwZzyIrz:dMROxdDfOnMmXa3ioVTPee9t5sgoJqrz
- TLSH T16A6412E65FBC88DEC8C1A476AD6CC74B9F799E089744C8779470F8947B4BB8B2348112
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
28:94:1d:78:32:21:70:43:20:17:99:0c:a4:7f:48:7a:fe:99:45:ca
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
Chains
Sep 27, 2021
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
Serial Number
0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fd
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 9, 2021 - Jun 19, 2024
Subject
CN=Dummy
Serial Number
7e:89:b9:df:00:6b:d1:aa:4c:48:d8:65:03:96:34:ca
Issuer
CN=Dummy
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 1, 2013 - Jan 2, 2013
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Minor OS version
0
Major OS version
4
Entry point
216992
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
64KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=14, version=7299,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=172, id=1, productName=Unmarked objects,
count=26, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=73, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
out.upx
- SHA256 d010265be33ead064c15604dcf5e90bf9f0608585eb9a04171294941e14a95a2
- MD5 2a779706848199e597315870c4b077d4
- SHA1 48c674022d55ddb45d741c9c901204471ac973c7
- SHA512 b092be4b0276c4fdc95ffa9635ae7be9b7babb0d3aa99bf9b6e17b8d53fc3351b1e0934ffc19639da89e580f028c5e9c38a2e78f84a071ddb546e619cf41889c
- SSDEEP 3072:488bdXF8FtO5dyzEAKZ/hx7c3unn+b09CIWncYodntK+C7VieM3SFZNt9ckP:XsdXFryQfP7nn+b0AvncfdwX3MmIO
- TLSH T14414AE323AD5C8FAD2532271CB49B7EAE1FADB180814493323142E5D7FBE846931D61E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=172, id=1, productName=Unmarked objects,
count=26, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=73, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,