berlin_triage[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
berlin_triage.zip
Size 7.1MB
Sample261017-btke2ace55
SHA256 5eba9656c846168d0a009de5d3175c7ea1789469998e1899c8981ba89badeb97
MD5 6412e5e69068c7afc95a6c517f307f4d
SHA1 7cc35336fc866755fd82754e09502ebe407d030e
SHA512 a800ca15ead903da2ac4d23d111e3dbe840a707f09d079ad2bf0f6ff4657b2d48d3f558771d9e7b43739f87598bd5ddc140ea1aa1b285c23f8aaa510c3adf1d9
SSDEEP 98304:gOeow4F8ZAAApme2nm3yweloBlb06YQIXF9xfRZJoBD8XJQ7b9QmKdE10iF8XYjY:7elXAMdBlClorQIXzxx9+tQ+2
TLSH
T19176337AF7FA814D7A868D5075C45D821B6E887938DE8E683FBE344B08B59C8CC175C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Berlin.exe
unpack001/WinDivert.dll

File Explorer

berlin_triage.zip

.zip 7.1MB
Berlin.exe

.exe 7.2MB
WinDivert.dll

.dll 46KB
WinDivert64.sys

.sys 91KB

berlin_triage.zip

SHA256 5eba9656c846168d0a009de5d3175c7ea1789469998e1899c8981ba89badeb97
MD5 6412e5e69068c7afc95a6c517f307f4d
SHA1 7cc35336fc866755fd82754e09502ebe407d030e
SHA512 a800ca15ead903da2ac4d23d111e3dbe840a707f09d079ad2bf0f6ff4657b2d48d3f558771d9e7b43739f87598bd5ddc140ea1aa1b285c23f8aaa510c3adf1d9
SSDEEP 98304:gOeow4F8ZAAApme2nm3yweloBlb06YQIXF9xfRZJoBD8XJQ7b9QmKdE10iF8XYjY:7elXAMdBlClorQIXzxx9+tQ+2
TLSH
T19176337AF7FA814D7A868D5075C45D821B6E887938DE8E683FBE344B08B59C8CC175C8
MD5 SHA1 SHA512 SSDEEP TLSH

Berlin.exe

IMPHASH 3cb5fb414b6ae269ed140fc7561c8dbe
SHA256 a31a2baa33a70d024924d11c60c1d9dec18f9e6ed20d9adef9ae542f745c8207
MD5 6a268fb005b72a26b5393151a4ec2f67
SHA1 070d4dc5ed917531171e3eff2e2a9e064df00050
SHA512 474a2e5d78f12356dda3d9fb24052eaf69e83cbce28ff1804a1322075e79254aa2e0cbe74b9399855dda2ad8abdd894defc54283a424b3df7d105a73c9718a32
SSDEEP 98304:/JQYqAtmLsk6rqQ8DAYQDtLndFf9DvR0qOwylRXnJXbfAP3sh/49fPU+knZLZbm:/JQbn6WDQDF9Dv2dwyltnVjQVUBS2
TLSH
T16C7633EB7EC68C69F002CBB4C281977D326A7F764895CE533A8E79501F2F589443B294
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12998723

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9

kernel32

GetProcessHeap GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess GetModuleHandleA LoadLibraryA GetProcAddress

user32

LoadCursorA

advapi32

IsValidSid

shell32

SHGetFolderPathA

ole32

CreateStreamOnHGlobal

windivert

WinDivertClose

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

shlwapi

PathFindFileNameW

ntdll

RtlCaptureContext

urlmon

URLDownloadToFileA

gdiplus

GdipFree

crypt32

CertFindCertificateInStore

ws2_32

WSACloseEvent

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

fread

api-ms-win-crt-string-l1-1-0

_wcsdup

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-heap-l1-1-0

realloc

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-filesystem-l1-1-0

_unlink

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-math-l1-1-0

cosf

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

293KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.q5'

Size

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fdB

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.)=6

Size

7.2MB

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

WinDivert.dll

IMPHASH 0b649f8e17494bb31b47f6e959a1769c
SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 b2014d33ee645112d5dc16fe9d9fcbff
SHA1 aa69498562d350f2de06954b133e59fac1e57002
SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
TLSH
T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

WinDivert64.sys

IMPHASH db584dd0570594898805dd67d7ff391c
SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 89ed5be7ea83c01d0de33d3519944aa5
SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
TLSH
T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

5a:de:d7:5d:6b:eb:31:58:49:f6:98:a7:8f:80:33:de:26:eb:15:19:55:a1:cb:c0:1e:30:37:32:0e:2a:0e:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 20, 2022

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

5a:de:d7:5d:6b:eb:31:58:49:f6:98:a7:8f:80:33:de:26:eb:15:19:55:a1:cb:c0:1e:30:37:32:0e:2a:0e:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510107MA7E8Y2876,CN=成都密思听科技有限公司,O=成都密思听科技有限公司,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Sep 20, 2022

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

Serial Number

61:50:19:91:b1:8f:32:38:04:52:51:37:dc:25:00:5a

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2022 - May 25, 2023

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:0A56-E329-4D4D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:a7:35:bb:2e:c2:64:85:50:29:00:01:00:00:01:a7

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

4484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\WinDivert-2.2.2\install\MSVC\amd64\WinDivert64.pdb

ntoskrnl.exe

RtlCopyUnicodeString KeBugCheckEx IoGetRequestorProcess PsGetProcessId ExUuidCreate ObfDereferenceObject ObfReferenceObject IoWriteErrorLogEntry IoGetCurrentProcess IoFreeMdl IoAllocateMdl IoAllocateErrorLogEntry MmMapLockedPagesSpecifyCache MmBuildMdlForNonPagedPool ExFreePoolWithTag ExAllocatePoolWithTag KeReleaseInStackQueuedSpinLock KeAcquireInStackQueuedSpinLock RtlGetVersion RtlIntegerToUnicodeString

hal

KeQueryPerformanceCounter

ndis.sys

NdisAllocateNetBufferPool NdisFreeNetBufferPool NdisAllocateNetBufferListPool NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart NdisFreeNetBufferListPool

fwpkclnt.sys

FwpmTransactionAbort0 FwpmTransactionBegin0 FwpmEngineClose0 FwpmEngineOpen0 FwpsQueryPacketInjectionState0 FwpmProviderAdd0 FwpmProviderDeleteByKey0 FwpsInjectNetworkReceiveAsync0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmCalloutAdd0 FwpmCalloutDeleteByKey0 FwpmFilterAdd0 FwpmFilterDeleteByKey0 FwpmTransactionCommit0 FwpsCalloutRegister0 FwpsCalloutUnregisterByKey0 FwpsFlowAssociateContext0 FwpsFlowRemoveContext0 FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsAllocateNetBufferAndNetBufferList0 FwpsFreeNetBufferList0 FwpsInjectNetworkSendAsync0 FwpsInjectForwardAsync0

wdfldr.sys

WdfVersionBindClass WdfVersionUnbindClass WdfVersionBind WdfVersionUnbind

Name

.text

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

berlin_triage.zip

Berlin.exe

d3d9

kernel32

user32

advapi32

shell32

ole32

windivert

dwmapi

imm32

msvcp140

shlwapi

ntdll

urlmon

gdiplus

crypt32

ws2_32

psapi

userenv

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

WinDivert.dll

advapi32

kernel32

generic

WinDivert64.sys

ntoskrnl.exe

hal

ndis.sys

fwpkclnt.sys

wdfldr.sys

generic