check.zip
- SHA256 36bda33964e70d2bb893657a7b1b8ecd5b01604d01494b365dd6e9cf7c6bd8ad
Behavioral task
behavioral1
Sample
HTTP Debugger Pro 10.10/HTTPDebuggerPro.msi
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
16 signatures
150 seconds
General
- Target check.zip
- Size 12.3MB
- Sample260919-pgc23sbr2t
- SHA256 36bda33964e70d2bb893657a7b1b8ecd5b01604d01494b365dd6e9cf7c6bd8ad
- MD5 48d32ff6a8bf6fee2effa60d2d89c069
- SHA1 7fa8a2aee0f0e7ca62552d8e4ec497d67a2830be
- SHA512 33326fa0ccb8a88fe8e7982dd82f6b724269d83ae05d95f8de41c9ce086341d2d41664fa8a5695611a56e7c24578102f7c0dc15f45e5c4b12eb963b1791dfc6d
- SSDEEP 393216:0zmkEtSYxWHYjSQihcIogevr98djmLEc3JlLlT2zU64z:s+3eHQqZMr98pQEqjLlT24R
- TLSH T13AD6334158012BC70DA92BD157A15CECDB8E2B68F41C2F56ECCA4E1793F2534A4BB27B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack002/CORE/cr-keygen-x86.exe upx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/CORE/cr-keygen-x86.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/HTTP Debugger Pro 10.10/HTTPDebuggerPro.msi
File Explorer
-
check.zip.zip 12.3MB
-
HTTP Debugger Pro 10.10/HTTPDebuggerPro.msi.msi 12.0MB
-
HTTP Debugger Pro 10.10/Keymaker-CORE.rar.rar 638KB
-
CORE/cr-keygen-x86.exe.exe 630KB
-
core.nfo8KB
HTTP Debugger Pro 10.10/HTTPDebuggerPro.msi
- SHA256 aeea613a3d7f1f6480457ca6c94e25cb63354d2d419c11ed002a761e1949f677
- MD5 32f0ca2925f3dfb28c5c56a4135084a1
- SHA1 392bf3d9924a49558584ebb28e4d58526151df09
- SHA512 71d4517eb395d10375456cd029bf024228e3b7a76f46dfdf48bde7990a0ca0d055436b1433fd4a1abbb1acb95d71fc40ebdf1d597b009925f2c3ca2a936dc078
- SSDEEP 196608:8qglk7EZ5vq1PO0yPqG85bUvraCg52WNegYYoG1JYHC1frqy19ggWXwcRl1XxMSn:8qgcEb0NyX8lUvg2WwXYoGn++frqoWXJ
- TLSH T1F3C63306B4B00716C49516B205AA7F7CC7736F24A91E1A3BA5C59C4A2FF2710B7FB2D2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
File Signature issue
Digest
7ae1e689e99c91c20ca8820ce3e9eba91d635fa909cca8a2de3702170d700a0d
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Prehash
Signing Certificate
CN=DevSecOps\, Inc.,O=DevSecOps\, Inc.,L=Doylestown,ST=Pennsylvania,C=US
Chains
Jan 1, 0001
Subject
CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
1c:cf:9d:67:cd:e2:19:ff:12:d9:9a:ff:36:82:e5:a7
Issuer
CN=SSL.com Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 7, 2019 - Mar 3, 2034
Subject
CN=DevSecOps\, Inc.,O=DevSecOps\, Inc.,L=Doylestown,ST=Pennsylvania,C=US
Serial Number
1a:ea:c1:29:2d:7e:66:d5:5b:81:6f:6d:9d:ed:48:a7
Issuer
CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 20, 2026 - Mar 20, 2027
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
HTTP Debugger Pro 10.10/Keymaker-CORE.rar
- SHA256 97b015c0dc721df8f2295244bfdd9ec4f6382f8800855e3943c11f9ed673ba27
- MD5 8d9b891f57291851d2378b50a25b9b80
- SHA1 08892060d1e3ec7260795e5b095884eb6ba353e1
- SHA512 a9916ee3520c9f26032f35d10b96955b04a585d289375929de4dfe31527e5e09f2d26386ee4ff3b7ee2704cc84f1cd42a73186e0652035a0c0488004e97f5891
- SSDEEP 12288:/f8Z62z24/zLU6NuUytqatZeBB3KU8BIwxhYqT303uvWt8RcUtjlyQ6jJ:/f8Z1//zLU6vyFtgPWfxh/E8W+BjlijJ
- TLSH T106D423428D79F9ABDD3594F00D3184AABEB6387E301497993D4C1A1BA3C9238D05E97F
- MD5 SHA1 SHA512 SSDEEP TLSH
CORE/cr-keygen-x86.exe
- SHA256 ebc09645ea6de1bdfe4be4cf6dad540ee2d04e5b305493278b7eeb216ebc5619
- MD5 00e70c082d730e8bcc40219c43e64a8b
- SHA1 14135ed313471a76d2ebdd825db6867fcf643f5d
- SHA512 a7e3b9a6be70257f52fad4068a1017e39ed40c2bda687ec61cbab76166dae5bdf459a054895cf9caaa680c99ae4ed976237de3463ee9620fcb98537a2a5df3d5
- SSDEEP 12288:+f8Z62z24/zLU6NuUytqatZeBB3KU8BIwxhYqT303uvWt8RcUtjlyQ6j:+f8Z1//zLU6vyFtgPWfxh/E8W+Bjlij
- TLSH T149D423529E7AF94BDC3A98F01D31D8AEAEB6387D3014D3491D841A1BA1C821CE05ED7F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
2086976
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
629KB
Virtual Size
632KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
core.nfo
- SHA256 7a3585798650aeebf32608e5e690aa1d43fb9d09085cf30bd4f19d5cbe8e51ca
- MD5 f6437288970fec5e9cf4756101aabfc3
- SHA1 273a1c1705f68a9c12656e32a1a630c4c888405c
- SHA512 196e408f8faa40fa0b3ec3c5ec1f1211e4978715e5a804c3a0767f563a941ab9fddd9874a8f6a752dc6bd64d0617614f40003b6e3d945067a711b80dd34407b1
- SSDEEP 48:W2AOtP3N/4Xl3GONYUqivuPsuu6RmPI/XOjx805RRYtt+UTeFgYga9k3jNHAuJln:BHNN/uRRTqilmHvA3xy+Bga+hg4B+W
- TLSH T1CC02EF0B8979FEFE4F21A66004D212807A97348F27391EB1B06E143B6BD753B45AD631
- MD5 SHA1 SHA512 SSDEEP TLSH