cukkNotif10678.980050-16861.zip
- SHA256 c006997765a787324f0ad62db2a591dc3c545497343b4f1828c21d7a79f16634
Overview
overview
9Static
static
3_FactHKJCT...65.vbs
windows10-2004-x64
9_FactHKJCT...65.vbs
windows11-ltsc_2024-x64
9~/llqpu2.exe
windows10-2004-x64
3~/llqpu2.exe
windows11-ltsc_2024-x64
3~/xmbm1.dll
windows10-2004-x64
1~/xmbm1.dll
windows11-ltsc_2024-x64
1~/zhmj/qil...s2.pdf
windows10-2004-x64
3~/zhmj/qil...s2.pdf
windows11-ltsc_2024-x64
3~/zhmj/qil...s1.pdf
windows10-2004-x64
3~/zhmj/qil...s1.pdf
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
_FactHKJCT20281-044978.Proc30465.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
_FactHKJCT20281-044978.Proc30465.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
~/llqpu2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
~/llqpu2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
~/xmbm1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
~/xmbm1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
~/zhmj/qily/mdfc/geluc/hcfces2.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
~/zhmj/qily/mdfc/geluc/hcfces2.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
~/zhmj/qily/mdfc/geluc/ptqs1.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target cukkNotif10678.980050-16861.zip
- Size 2.7MB
- Sample261009-pjf7hset7m
- SHA256 c006997765a787324f0ad62db2a591dc3c545497343b4f1828c21d7a79f16634
- MD5 b684e5adedea69831b13c66e7c1636f2
- SHA1 b7c4de5958b89cc3ca150d3e3225ff5a8d147902
- SHA512 c97e519a518c339b0b0b5a7fc09ca54b065daacfa852a9d9b354e0e8e69a2cffe90a1f55cab2475c5c2d81262176830643caa930aac67c9006e98c2cd93b47bd
- SSDEEP 49152:0ZsU8rucYFRyXDNJCTRb1OWugPpAgIGONcjqg4o3o8GpjgLLW:0b8r0aGR4WuSx9ccug4oTGpL
- TLSH T1E2D53300F419858C8F8F7ABDC96B90DD274FB5DD5BB350E3D2213648AFB201B9B68685
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/~/llqpu2.xml
File Explorer
-
cukkNotif10678.980050-16861.zip.zip 2.7MB
-
_FactHKJCT20281-044978.Proc30465.vbs3.6MB
-
~/llqpu2.xml.exe 77KB
-
~/xmbm1.xml.dll 16KB
-
~/zhmj/qily/mdfc/geluc/hcfces2.pdf.pdf 90KB
-
~/zhmj/qily/mdfc/geluc/ptqs1.pdf.pdf 24KB
_FactHKJCT20281-044978.Proc30465.vbs
- SHA256 574c9bd0592b5a18f04047b642bc7045f688b43f5c354aaeb6c179d5595a0475
- MD5 9146ade36b5c1d894d5d45ca380a6152
- SHA1 d9d2eba9a086b316fae3acbdc26a5424c1412f57
- SHA512 88d740ced46f2978867728af20cc919db163efdb4035e12c5b84dbae4c615aa60d2e7e6a57461922263f94b5b8ed5930548735b146ec657c3c534bd1336406fe
- SSDEEP 49152:oyNzLteDoeJ5+B1+AOe1KYRw4ihP+TKaRmr4C2KVm+YhIj:2
- TLSH T113061237AAA4151B09F1476AF00A6172BE7ED423874CC2A5CC9DE22935CB4DE827E5F4
- MD5 SHA1 SHA512 SSDEEP TLSH
~/llqpu2.xml
- IMPHASH 085b8a5d9e723b8ba9982a936ce1c779
- SHA256 2a3a6566b3628c0e13b8fe653446f3538c3c498043c2633ccbb3a9ff16908632
- MD5 bbb0c7d5694183e69ff12249668705a7
- SHA1 082cc5b36e7788ab81360b67a6b79b71b3d6b7a2
- SHA512 41c35bd59e6974da523bda4b5efda5a0aed328e06268fadbcba93a792815460d15603a23fd7510ca5871ee6da0f691d2eab19eff9159bdf917c609f24fde53a8
- SSDEEP 1536:dzLfWeTxL0OwDxm8NLHsLtkO1iZzgRHw4c2DJ7pk/uHVd3u/0HByr5NOna0Ci:FL0Dxm82LM0vr/3TByr5NOaq
- TLSH T14C738D2276A0D032E8D25A30852DC6B29F3BBC325AE4D447F798476B5F607E0D76631B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
ab:13:d4:b3:56:7d:98:5f:19:e0:29:ae:43:8d:d3:4d:2b:1f:14:63
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US
Chains
Aug 5, 2011
CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Subject
CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US
Serial Number
7e:28:2b:07:49:66:9b:59:5f:79:49:ff:06:13:4e:92
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 5, 2009 - Oct 1, 2012
Minor OS version
0
Major OS version
5
Entry point
13116
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
g:\Acro_root_apwsbbp\Main\code\build\win\results\Release\info\arh.pdb
kernel32
WideCharToMultiByte
CreateFileA
HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
LocalFree
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WriteFile
SetFilePointer
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStartupInfoA
Sleep
GetModuleHandleW
GetProcAddress
ExitProcess
LoadLibraryW
RaiseException
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
VirtualAlloc
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryA
RtlUnwind
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
msi
ord141
ord90
ord205
ord173
ord16
shlwapi
PathAppendW
PathRemoveFileSpecW
StrDupW
StrChrA
PathAppendA
advapi32
CryptAcquireContextW
CryptDestroyHash
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
CryptReleaseContext
CryptCreateHash
CryptHashData
CryptGetHashParam
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=150, version=20413,
count=17, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=115, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=44, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=123, productName=VS2005 build 50727, version=50727,
count=119, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
~/xmbm1.xml
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3cadcb6b8a7335141c7c357a1d77af1ff49b59b872df494f5025580191d1c0d5
- MD5 9a341540899dcc5630886f2d921be78f
- SHA1 bab44612721c3dc91ac3d9dfca7c961a3a511508
- SHA512 066984c83de975df03eee1c2b5150c6b9b2e852d9caf90cfd956e9f0f7bd5a956b96ea961b26f7cd14c089bc8a27f868b225167020c5eb6318f66e58113efa37
- SSDEEP 192:erLXx0hyLsbb3rxVj7WU2WLTYoW4GD5dHnhWgN7acWlbAkWD7DiqnajKs3WoHpZ:Ih06sbbVVPWU2WPY7dHRN77RGlGs3jJZ
- TLSH T18F724B45CBEC4607ED232B7085A8D583FF38A3D75816A32929C5F67C0C9A7C5AF21638
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5d:cb:7e:a5:69:25:4f:af:a8:12:26:de:6b:e9:9e:73:3e:09:68:df:fb:5d:fe:9e:c2:d5:81:e1:60:48:4c:a4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 4, 2020 - Mar 3, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:D9DE-E39A-43FE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:2d:2e:4d:41:ca:63:65:33:a0:00:00:00:00:01:2d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
13198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
~/zhmj/qily/mdfc/geluc/hcfces2.pdf
- SHA256 26cfa79ae9b841b7aaa166371767c1c00b471590755221fab05d1e46d8b35c8e
- MD5 85f7de2b0a5df43979f7735143fcc0bf
- SHA1 3b042eefbc4496231d7ee004714665dd7aa1bd8f
- SHA512 fbc1cf42f2172c5248ea677ccb2f312a9ce2aa012120a80e8c88e7307b3b1fb1b8acbf94b555bd12b2d5f280ca43ee7f33c19d205a27d47a3b4cdf78be89fed4
- SSDEEP 1536:62VCjJTiF2Z4O8d69XXT34teAxbbbPHi+7Xxj0uarUphdVKpW65GijIoAadVKpW3:5oJk2Z269Hj4JbbbK+jN4r6hdVMPGNby
- TLSH T15693019D4152AA01E1C5D66A5FD46CC708F7F0C2120805223E6D9BAF6B22FE1F594FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
~/zhmj/qily/mdfc/geluc/ptqs1.pdf
- SHA256 68d8c12391e2294db9e614463e60741e7def8906141fa98db6a4d4504e181944
- MD5 bd766bdf053039564a39096005113bf7
- SHA1 62a23c4ccdcb5046c29c02e42b60b9af532c9ab7
- SHA512 aeb68cb5c5f6c5fb370145c6f8ce2ce9e583cb02f2b3b15518f016177cf053083f1c800388671c578e7bef4d3fd99d394d7a52366d6acc03fdd79bf47b31d6d2
- SSDEEP 384:ORStQttQDCpLjmlx8eUBgUntKKc82JFThmp9rd5XD06lgmUHKzba9xLsN:O4pDCpPm38e6jcTJF4p946lPn
- TLSH T1E4B2BF834D468D76D4F18B51BF03EF0E5B9A7E44704B7AD710A2A8CA7F24AC29C1962D
- MD5 SHA1 SHA512 SSDEEP TLSH