Urget Contract Action.zip
- SHA256 137cfbc6611add95e7dd00247098efc9aa4b16771d62c20a5d149f2181da6d6c
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
email-html-2.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
600 seconds
Behavioral task
behavioral2
Sample
email-html-2.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral3
Sample
email-plain-1.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
600 seconds
Behavioral task
behavioral4
Sample
email-plain-1.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
General
- Target Urget Contract Action.zip
- Size 424KB
- Sample260930-l2ff6av15j
- SHA256 137cfbc6611add95e7dd00247098efc9aa4b16771d62c20a5d149f2181da6d6c
- MD5 607104ec5c797bd46a0a6bc76bfac512
- SHA1 d6c5562c2c63c5d164cf09ab8c829cf8d4ed1581
- SHA512 0fdd49b6939bcf281a2cbcd50ab53989864a498e37dbf0d55ebc8f2e1ec3ee14c41ec52c8828d99f1ca612d95a53f22d2c76c0d8aa219740f00a736d9573b0b2
- SSDEEP 12288:ZUpblYhNXCaq0DXHyLoo4Re+Bo3KhiJeHMgV+awgp:ZUpblYDXZDXKFJ+BOKSi+5G
- TLSH T146942368D26149A76B8CB67F0B96CC16E338936640ED2645CC809F316DEC48D773BA8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack002/Urgent Contract Action.pdf.exe
File Explorer
-
Urget Contract Action.zip.zip 424KB
-
Urget Contract Action.eml.eml 604KB
-
Urgent Contract Action.pdf.exe.exe 431KB
-
email-html-2.txt4KB
-
email-plain-1.txt3KB
Urget Contract Action.eml
- SHA256 c5fe32e5de97a1c0ff01c7bcbc99d7086a485b6df9ac7cdb37e906f6e1d01da3
- MD5 048c02e929690bcb0a537d08e71f6b50
- SHA1 e35f34239708f1d2ac63dc88366dcb3686d0d1eb
- SHA512 bd942387e85c4981cba4617089728958e7bf163efb73ee5624e3f5e409552426a3ee67d0900bca18dc089552d5c855ca99dbf5115f4293eb5162e346a68fcaa9
- SSDEEP 12288:G35ETPjPNu1JoTIIu4Q3H3KNgrYq/6lm2pNRs/P7IunP9m4QSmWveSI:PPDkreIItQqev/Qmofs/TdnPvPpeB
- TLSH T118D4123E49C2ABCB07329CBF50457A9ABC84D35B6956210093ECA2233E657F0976D4FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Email Headers
Delivered-To
From
Sender
=?utf-8?B?RHJ1bWJvwq4=?= <[email protected]>
Return-Path
Date
Fri, 13 Dec 2024 22:27:38 +0000
Subject
Immediate Action Required: Your Employment Contract.
Content-Type
multipart/mixed; boundary="--_=_NextPart887_c9b48180-2a98-41f6-b723-6678633baac4"
Received
by 2002:a05:6674:6783:b0:5c7:9645:8cca with SMTP id vl3csp820661pxc; Fri, 13 Dec 2024 14:27:39 -0800 (PST)
from dezoeteinval.co.za (vps-fa2b00d6.vps.ovh.net. [51.195.254.223]) by mx.google.com with ESMTPS id 4fb4d7f45d1cf-5d652f81b7dsi311467a12.471.2024.12.13.14.27.38 for <[email protected]> (version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128); Fri, 13 Dec 2024 14:27:39 -0800 (PST)
from spruce-goose-ax.twitter.com (spruce-goose-ax.twitter.com. [199.59.150.93])
from efianalytics.com (efianalytics.com. 216.244.76.116)
X-Received
by 2002:a05:6402:354f:b0:5d0:e2c8:dc8d with SMTP id 4fb4d7f45d1cf-5d63c33bafamr4543368a12.20.1734128859131; Fri, 13 Dec 2024 14:27:39 -0800 (PST)
Received-Spf
pass (google.com: domain of [email protected] designates 51.195.254.223 as permitted sender) client-ip=51.195.254.223;
Message-Id
<1419576.bWFhcmtrbm9wZmxlckBnbWFpbC5jb20=@iobBeE5>
Urgent Contract Action.pdf.exe
- IMPHASH e3bda9df66f1f9b2b9b7b068518f2af1
- SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
- MD5 fbbdc39af1139aebba4da004475e8839
- SHA1 de5c8d858e6e41da715dca1c019df0bfb92d32c0
- SHA512 74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
- SSDEEP 12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
- TLSH T1199412426729EE92D1E1B8F84093E7CC4BB97B090FB991EF9D993485CC79B8319380D5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
Password
infected
PE Signature issue
Digest
c9:13:30:16:a3:e5:cf:bf:b1:aa:8b:50:d1:16:0f:a5:35:73:41:3d:4f:81:f8:71:05:4e:c7:39:6d:5a:8b:17
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US
Chains
Sep 8, 2017
CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
bd:ae:90:d3:3b:42:bf:69:31:7c:f4:d9:c1:9d:fd:c2:69:86:ca:f0
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US
Chains
Sep 8, 2017
CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US
Serial Number
0e:bf:ea:68:d6:77:b3:e2:6c:ab:41:c3:3f:3e:69:de
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 16, 2016 - Dec 17, 2017
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US
Serial Number
2e:6b:e6:bd:11:a8:67:6e:6c:57:90:9e:9b:0d:5f:57
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 15, 2017 - Apr 13, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2014 - Jul 21, 2024
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 2, 2017 - Apr 1, 2028
Minor OS version
1
Major OS version
5
Entry point
4800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
GetCommandLineW
GetFileSize
CreateProcessW
HeapAlloc
HeapFree
GetModuleHandleW
GetProcessHeap
WriteFile
GetSystemDirectoryW
ReadFile
GetModuleFileNameW
CreateFileW
lstrcatW
CloseHandle
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
user32
wsprintfW
shell32
CommandLineToArgvW
msvcrt
wcsstr
memcpy
free
malloc
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
590B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=224, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=1, productName=Unmarked objects,
count=1, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
email-html-2.txt
- SHA256 2843f5721f82a52a0de9adb17b4a39ead22356711065a7deff15b0d7c5dd3523
- MD5 54e28bc9a318a7c34ba36b040ae22f7c
- SHA1 8e1b616b2d55f1bf7db468863c0ac9b875f8e883
- SHA512 286024e1d4f89c21513437ec6ad9115dd6cf45e2de7b7a49ae27f687498a439f2bff2d912b15f9d1efb868144fd63fa7214dce7f277d5e260ac770f8bf7b58a3
- SSDEEP 96:VAeznkXKWFEwchCH5dmklZoey1c7QDPMPpPc:yQULEfe5UkDfQIhk
- TLSH T1CE915B6AC233390702C32004D315BFA26743B288D25A6FB17ABD211F7798A65217FADC
- MD5 SHA1 SHA512 SSDEEP TLSH
email-plain-1.txt
- SHA256 e58a6b8c4042916b7c7299c9ae49bb9f2ce281e1cd62abb6c6e82938bc97dd7d
- MD5 d12a8819f44c12586fad964d4d15de58
- SHA1 4f2a7b1fa287d412b250762e70547e5afaba03d1
- SHA512 3dcaac6ca5f8291fbb06a71424f270899866ef86f83daa3a3d8959a0714e394ef4a76831a9eca971c293983b2eb43d2566d9e1ec272fddcb48630dad048acbaa
- TLSH T123713C2BD147211A05D374011318BAE3BD63F388929AAD536EB9311E2318DBA6323EDC
- MD5 SHA1 SHA512 TLSH