26371659873.zip
- SHA256 4d2663448d3086f8a00181bafdec5ff02db8b36d0a6d996a3853156cbcc58088
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
de3421f559fd2afacbfdde03eaeb7daeec5317a5f8e2968cc36cc0a3b319fe74.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 26371659873.zip
- Size 62KB
- Sample261024-bcn2wsdh89
- SHA256 4d2663448d3086f8a00181bafdec5ff02db8b36d0a6d996a3853156cbcc58088
- MD5 7e7b2718f3dcfda2e79f893aaa22cc95
- SHA1 e1a34c11c83a35d60dbd9ec4316b946edbbffe10
- SHA512 e4f566448d14d1d088765536ed76f062acd92f61e05871126436ebec0f4ddd51844baf8e71a6941f7ae9a0e26446d640158fb83e770a33a0b8a563923f07d450
- SSDEEP 1536:JJmAiRKAOldkrfxx+k2fUWSO+urWpR+/6PdAV2:JgRklKfejMW1+lPdAI
- TLSH T1A453F155967394186B31B749B88D9EB4181899A3C2872121F1E7BB63BEC31432F1CFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
26371659873.zip.zip 62KB
-
de3421f559fd2afacbfdde03eaeb7daeec5317a5f8e2968cc36cc0a3b319fe74.exe 136KB
de3421f559fd2afacbfdde03eaeb7daeec5317a5f8e2968cc36cc0a3b319fe74
- IMPHASH 10d3bc92abd766470e10a51f92dc2b84
- SHA256 de3421f559fd2afacbfdde03eaeb7daeec5317a5f8e2968cc36cc0a3b319fe74
- MD5 369c933d7576b7d1cf1e4745ff37a13f
- SHA1 8cf0b3e01e719d9356ecfe61fd51405fec1cab03
- SHA512 c2c67be46180a563f0710675fe90f3506c87ee52a5b9b287ca6e51b0a84359634503d1337bd7070ebccbcb88f260d817fc8c78c1bd5d5728651417d2569474ff
- SSDEEP 3072:Qg3Z2vwBKddW5whxtgufAdWuvGCHLn2CfY:Q0Z2YYZFguoGCHL2UY
- TLSH T17DD3F65A77F950D5E5B7A13C89B1864AE7B2F8201732A7DF02D0817E0F23AE45D39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
23:b0:bc:03:b1:ac:4a:5b:2e:63:c2:2b:c4:7a:77:d3:f6:4c:1b:a3:47:90:ec:50:6c:94:1c:74:1d:20:a0:30
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 16, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:57:cf:90:dd:c7:d1:c0:88:8c:00:00:00:00:05:57
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e3:df:bd:9b:9a:1c:68:83:22:00:01:00:00:01:e3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
73872
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
WinREUpdateInstaller.pdb
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
kernel32
GetLastError
IsDebuggerPresent
OutputDebugStringW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
SetLastError
CloseHandle
ReleaseSemaphore
ReleaseMutex
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
GetModuleHandleW
CreateThreadpoolTimer
LoadLibraryExW
FreeLibrary
GetCurrentProcessId
CreateMutexExW
FormatMessageW
CreateSemaphoreExW
SizeofResource
LockResource
LoadResource
FindResourceExW
SetErrorMode
HeapSetInformation
GetModuleFileNameW
GetWindowsDirectoryW
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
HeapFree
GetProcessHeap
GetProcAddress
HeapAlloc
OpenSemaphoreW
GetCurrentThreadId
LeaveCriticalSection
msvcp_win
_Xtime_get_ticks
api-ms-win-crt-string-l1-1-0
memmove_s
memset
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_register_thread_local_exe_atexit_callback
_c_exit
_initterm
api-ms-win-crt-private-l1-1-0
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o_calloc
_o_exit
_o_free
_o_malloc
_o_memcpy_s
_o_terminate
__C_specific_handler
_CxxThrowException
_o__exit
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__errno
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
wcschr
wcsrchr
__std_terminate
__CxxFrameHandler4
_o___p__commode
_o___p___wargv
_o___p___argc
memcmp
memcpy
__CxxFrameHandler3
memmove
ntdll
RtlCaptureContext
RtlNtStatusToDosError
RtlVirtualUnwind
RtlDowncaseUnicodeChar
RtlLookupFunctionEntry
RtlRaiseStatus
DbgPrintEx
ole32
CoInitializeEx
CoUninitialize
winreagent
SaveWinREServicingManager
crypt32
CertVerifyCertificateChainPolicy
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapDestroy
HeapSize
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
oleaut32
SysAllocString
SysFreeString
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-file-l1-1-0
GetFileInformationByHandle
CreateFileW
GetFileAttributesW
FindFirstFileW
GetVolumePathNameW
FindClose
api-ms-win-core-com-l1-1-0
CoCreateInstance
dismapi
DismDelete
DismGetPackages
DismAddPackage
DismInitialize
DismCloseSession
DismOpenSession
DismShutdown
wintrust
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
user32
UnregisterClassA
wdscore
WdsSetupLogMessageW
ConstructPartialMsgVW
CurrentIP
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=260, version=27412,
count=3, id=259, version=27412,
count=23, id=257, version=27412,
count=1278, id=1, productName=Unmarked objects,
count=33, id=264, version=27412,
count=34, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,