DOCJUD_955.zip
- SHA256 c5597f0e30d7a6bdcb6c9219f06789edae5c68427bd05eb611450044417cc7bb
Behavioral task
behavioral1
Sample
/\t/UBSEBWQ8/ Z9MQIWGQIPF7WC505SR6SNYDV.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
/\t/UBSEBWQ8/ Z9MQIWGQIPF7WC505SR6SNYDV.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target DOCJUD_955.zip
- Size 480KB
- Sample260924-pj5j4stdkd
- SHA256 c5597f0e30d7a6bdcb6c9219f06789edae5c68427bd05eb611450044417cc7bb
- MD5 f27edb57a508047e69971e328881d15e
- SHA1 5b1ab9b7309b1d4dd731ca104c362c57d562aa9e
- SHA512 8b21c50ba5dc2811e1f0fed4e57bb7dfc3614836b58e5225d4257f1b14efbbd62159ea52b03d7d7845700d6fb021cfa3e57a1f3f5132785a9e3f5595eb0ffdbb
- SSDEEP 12288:AnL36rrXKCfTmgyUnOgmM6lxoOo+q3NQzdKrT6BR0:DrjFfTfyUnQM6laOo+q3NUdsuq
- TLSH T174A433E10BB15A5F8E2EC56BFCA3ECC9EA6A05F17D522D4E13B602159BC0611586C3CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ /\t/UBSEBWQ8/ Z9MQIWGQIPF7WC505SR6SNYDV upx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx
File Explorer
-
DOCJUD_955.zip.zip 480KB
-
/\t/UBSEBWQ8/ Z9MQIWGQIPF7WC505SR6SNYDV.exe 492KB
-
out.upx.exe 188KB
-
DOCJUD_66º.HTA.html .js 15KB
/\t/UBSEBWQ8/ Z9MQIWGQIPF7WC505SR6SNYDV
- SHA256 81725dd3e5adb872f3832401911291b3d178a30989b3dc561ef2313ea98a9d23
- MD5 6be012f6d8b607074f72f5920226033a
- SHA1 b60f084813be95b28428ed8f3d8e0a6e989ffbfb
- SHA512 43592fc96233a04c6ed378143f2e44233def8a9a71de6d6fd0fb9709a8a1c46857d5bad532ddceff28a6aca8cb6beaba72bca5e58a8e79c7d08c902817766962
- SSDEEP 12288:5MROxTfOnMmXkQmgIUnUgmMalxCOeWq3zQz/KrTbJN:mIxinvXXfIUn+MalcOeWq3zU/sVN
- TLSH T100B422F10EA008CFDC53E877BC26999B9D7A5EF220058D6B4A39B8547F83923151D39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fc:d6:7d:f4:36:48:c4:d5:24:2b:e3:e4:3f:a8:83:a6:19:62:d3:eb:9a:02:fd:2a:99:a4:92:9f:5a:45:aa:dd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=San Francisco,ST=California,C=US
Chains
Jun 1, 2026
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=San Francisco,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=San Francisco,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 9, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Dummy
Serial Number
7e:89:b9:df:00:6b:d1:aa:4c:48:d8:65:03:96:34:ca
Issuer
CN=Dummy
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 1, 2013 - Jan 2, 2013
Subject
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=San Francisco,ST=California,C=US
Serial Number
0f:0e:f7:c2:d8:19:27:3e:8c:13:f0:16:d2:e0:9b:25
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 9, 2025 - Jan 8, 2027
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
0
Major OS version
4
Entry point
216992
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
64KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=14, version=7299,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=172, id=1, productName=Unmarked objects,
count=26, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=73, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
out.upx
- SHA256 d010265be33ead064c15604dcf5e90bf9f0608585eb9a04171294941e14a95a2
- MD5 2a779706848199e597315870c4b077d4
- SHA1 48c674022d55ddb45d741c9c901204471ac973c7
- SHA512 b092be4b0276c4fdc95ffa9635ae7be9b7babb0d3aa99bf9b6e17b8d53fc3351b1e0934ffc19639da89e580f028c5e9c38a2e78f84a071ddb546e619cf41889c
- SSDEEP 3072:488bdXF8FtO5dyzEAKZ/hx7c3unn+b09CIWncYodntK+C7VieM3SFZNt9ckP:XsdXFryQfP7nn+b0AvncfdwX3MmIO
- TLSH T14414AE323AD5C8FAD2532271CB49B7EAE1FADB180814493323142E5D7FBE846931D61E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=172, id=1, productName=Unmarked objects,
count=26, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=73, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
DOCJUD_66º.HTA
- SHA256 388f6c30e067e84038a856ad8748e4ddbb51381c797d47bb3a74d5e8716e7411
- MD5 7c15c93ecd6982d90d3379066a2349a7
- SHA1 fdeea8bdc6f4159a64271a54638e7f3dd3277bad
- SHA512 e4d05357966fa040977653ef2024c7b426231a6d1cbd07a54393155080c1966e858380fbad9e25e1e0167838ab04e57dae95f89eb4281f16af895a3d3c84ce77
- SSDEEP 192:BDBTAo+uD5TAG10bbZbgVkaXj5IK5Mh+6caRc/7T/BdSM49Zm5uh5lGeBd2JY9R2:PTAdTGO5KqGRj2r9Zmsg+wJYHtrM
- TLSH T1B972FA2695840419743383A5ABA3570AFBB9D007834643787AECA25D5FF7988CD27FF8
- MD5 SHA1 SHA512 SSDEEP TLSH