Account_Transcript.zip
- SHA256 33a7b824bc687c330c33c1870a9243d2f527c43d63a1fa95b3ad02c12dfe5f81
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Account_Transcript/FirewallAPI.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
Account_Transcript/FirewallAPI.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
Behavioral task
behavioral3
Sample
Account_Transcript/Open-Account-Transcript.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral4
Sample
Account_Transcript/Open-Account-Transcript.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target Account_Transcript.zip
- Size 12.4MB
- Sample260929-w52tnsda39
- SHA256 33a7b824bc687c330c33c1870a9243d2f527c43d63a1fa95b3ad02c12dfe5f81
- MD5 a09a20a6fc558fe39af29647f4395a9d
- SHA1 9e8a6c0cfad9a0d778e1abd1fc4986a59071991e
- SHA512 83775dd39a0e633bc48c8e3e4b8ac2277453f90de3169e61e6993cab17eb658720ca8984e507b260f4e365f604567f58bb6a51b41aa286f7b1225ba68a94ef4c
- SSDEEP 393216:YoZC1rnGsdLZHaMH44F8GIuM1ck+38C+uyz0:PAlDPNO+Mt0
- TLSH T1A3D63362675B374F097293F53A378D7F9264FC526C38B9784E8F9EB58422281646CC38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Account_Transcript/FirewallAPI.dll
File Explorer
-
Account_Transcript.zip.zip 12.4MB
-
Account_Transcript/FirewallAPI.dll.dll 12.9MB
-
Account_Transcript/Open-Account-Transcript.exe.exe 87KB
Account_Transcript/FirewallAPI.dll
- IMPHASH 8d9db9a718aac690d750a9341c62a944
- SHA256 39923ed0e95cd4912c76466a90fcba015752fec7ae5811831acf8cdb1afcf884
- MD5 b33baa05f62c77a4265d1f967ca8de22
- SHA1 7d9dd952ea401150622475e56941ad50b9146782
- SHA512 6307a80e2f04106671f7c33c03c4ed781c87b2bc17a9ca092da1938d2d672100fa4c5d334444bfd155cb1b48df422b7911dacca6e38f52519b68664443e990a4
- SSDEEP 196608:beQJ+08Pr7advdPh47n+yq/reQJ+08Pr7advdPhCeQJ+08Pr7advdPhieQJ+08PS:R+WTuns+WTE+WTk+WT5+WTl+WTl+WT
- TLSH T14CD622A2D2AB2E0BBDF933B9665D055B32F0E602D9E0247C7FC99591042F54817F6B0E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4847
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
GetTokenInformation
OpenProcessToken
kernel32
CloseHandle
CreateDirectoryA
CreateFileA
CreateProcessA
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetTempPathA
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WriteFile
lstrcatA
msvcrt
__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
fprintf
free
memcpy
realloc
strlen
strncmp
vfprintf
shell32
ShellExecuteA
NetworkIsolationEnumAppContainers
NetworkIsolationFreeAppContainers
NetworkIsolationGetAppContainerConfig
NetworkIsolationSetAppContainerConfig
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12.9MB
Virtual Size
12.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
368B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
84B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Account_Transcript/Open-Account-Transcript.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f8ed4cb272e52b7ef2b1c2672dbc6ace9f3ef752a38ce535265cfab891c9cbff
- MD5 13072c3b2a5a405b32a60d8cf1631bbc
- SHA1 6996ab027fe913cccb9f8e26ad0e9491d4a609b1
- SHA512 337311e0b2c0a22b749930f7212b5040d27c2b997404dc8cecfbbf89c86f2f5d5077d6157090078a8421acaa23850b24f963ba1b984b0600e9b80505bdb125c5
- SSDEEP 768:HzEI16zcI2eTcvEWm/ljPjOPAxr25znrSh7ANg3CqnZ+6qmmlG0KdFumjDdFWf1:F1H5MiP1zrSh7WwZ3xmlGddFjjDdFWf1
- TLSH T1359339403BE84276FAFA8F749572E0104A79BDAA99B0D6CD2CD5A49F19F3B408321717
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
15:e7:df:e8:ec:a1:15:23:eb:c2:b4:b7:8c:b0:33:32:1d:6f:51:89:ce:ea:04:e5:a5:87:21:08:e2:58:51:7c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Progress Software Corporation,O=Progress Software Corporation,L=Bedford,ST=Massachusetts,C=US
Chains
Apr 14, 2020
CN=Progress Software Corporation,O=Progress Software Corporation,L=Bedford,ST=Massachusetts,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Digest
87:31:26:0c:2a:b6:c3:19:a0:cf:19:aa:7c:e8:cb:d3:0b:aa:78:4b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Progress Software Corporation,O=Progress Software Corporation,L=Bedford,ST=Massachusetts,C=US
Chains
Apr 14, 2020
CN=Progress Software Corporation,O=Progress Software Corporation,L=Bedford,ST=Massachusetts,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Progress Software Corporation,O=Progress Software Corporation,L=Bedford,ST=Massachusetts,C=US
Serial Number
63:49:07:64:c0:61:2b:98:43:7b:f3:de:08:3b:29:d1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 15, 2020 - Jan 15, 2021
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Entrust Time Stamping Authority,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
ab:dd:67:65:f2:5a:ef:50:00:00:00:00:55:91:e9:0c
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 5, 2018 - Jan 5, 2030
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 22, 2015 - Jun 22, 2029
Minor OS version
0
Major OS version
4
Entry point
61970
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Jenkins\Fiddler_Windows\workspace\Fiddler2\BundledExtensions\EnableLoopback\obj\Release Signed\EnableLoopback.pdb
mscoree
_CorExeMain
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ