build-VEPI10IT.zip
- SHA256 425da68e77b3c80361dbc5277f4d43dd9425ae3ec147b62f08c0737a3f7808ac
Static task
static1
1 signatures
General
- Target build-VEPI10IT.zip
- Size 120.1MB
- Sample261024-t6bb1avyg1
- SHA256 425da68e77b3c80361dbc5277f4d43dd9425ae3ec147b62f08c0737a3f7808ac
- MD5 b66fb4c5de60f4467e6564b6f74bf8f1
- SHA1 1c98e531fd3369099f9f856395939f7c61a0f2e3
- SHA512 27c614be0fb1e86133bf301d760fe17808455113445fbb8e22cc2895aaa1a11a8ce85531a7686ff19cd1121a32c1fd1d196289c2aa30aaa82fd15be43a0d801b
- SSDEEP 3145728:pT9KurjDe0NNorOwgPhfm5PjOAQVnVaba+jj8ts:pIurPTHorOwGhfIjOvnMba+jjAs
- TLSH T16858338418738B7EC5828374EE4459244272FE9CCB149F5B3580BAFDFEB269446E6B34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MpClient.dll
File Explorer
-
build-VEPI10IT.zip.zip 120.1MB
-
MpClient.dll.dll 709KB
-
data.bin119.1MB
-
installer.exe.exe 320KB
MpClient.dll
- IMPHASH f8ccc8beb74eb0aee5f16286ac2ff69d
- SHA256 bc7f92ab18bde3796f11e8f2b1b21a579d79ae4e6c7151244af081ecebae427e
- MD5 0b757cdd74e49e75a791293aa6a9862c
- SHA1 131b632108a6d3b449a0ab515fa0f20117c7fe62
- SHA512 104ac6169df033d1974be27138e665347216d58143c908db21553387cea652ef67a56e172348e58521809708924b8998635800769a6b4af35f7d96450b73cb19
- SSDEEP 12288:ac2A2QQL1E394l5r9Nj4RTNiuMaM9IiEu6KEeTBJ9WNIsNp99SGrQhsHI73zF4EC:aBARBcN92xNiJIvOB+ND399SjhqI7A
- TLSH T11CF41201F6A541F5C139C1396A635A04A676BC540B606BFF13E4FBBA2F627C0933E7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
37568
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
teplajol.pdb
user32
GetActiveWindow
GetClientRect
GetDesktopWindow
GetForegroundWindow
GetSysColor
GetSystemMetrics
SystemParametersInfoW
kernel32
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetFileType
GetLargePageMinimum
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetPhysicallyInstalledSystemMemory
GetProcAddress
GetProcessHandleCount
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemPowerStatus
GetSystemTimeAsFileTime
GetThreadId
GetThreadTimes
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
WideCharToMultiByte
WriteConsoleW
WriteFile
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
MpAllocMemory
MpClientUtilExportFunctions
MpConfigClose
MpConfigGetValue
MpConfigInitialize
MpConfigOpen
MpConfigRegisterForNotifications
MpConfigUninitialize
MpConfigUnregisterNotifications
MpFreeMemory
MpUtilsExportFunctions
Name
.text
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
338KB
Virtual Size
338KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
272KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
185B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
data.bin
- SHA256 97438f496f3498a6bafad140c312963902f36275ac3d333d741d5d7dd6ac52ee
- MD5 3626af1faffb689de6bcef2b0f9fa9b2
- SHA1 efdd1c436068af79890471e8a76f3245f56af056
- SHA512 6ce9b92bf831b08e0a9d0df7b55505456a0706a8d218b635baa3eae8b2bbf2675835e77733458706061e9c76115b754927e865d1fc59331ea79cc2c6fb9a248c
- SSDEEP 3145728:mT9KurjDe0NNorOwgPhfm5PjOAQVnVaba+jj8tP:mIurPTHorOwGhfIjOvnMba+jjAP
- TLSH T13B5833C40C33493CC6C293757E486A1502BBFBDD99186F197884A5FDFEC1AA812D2B79
- MD5 SHA1 SHA512 SSDEEP TLSH
installer.exe
- IMPHASH e43bee43ade4b1f56aeae5d05a0fc99d
- SHA256 dd256d36786d244b83387287fa77fea73d9d7edc07d831aac1a966eaf7b2941c
- MD5 a89d0b2548a91340ece2df0073f401f0
- SHA1 51ffa2bfae58d4a59e6ec81cf4a3fa681ba098f7
- SHA512 67de431d7e742e6cf6e8151892da58b5aa655c103611635adeb823ec9c677acf12502d25af60432faa1ad990a0862a8c46b965198252eb3afef2966e6d3112bf
- SSDEEP 3072:P9+dzW+2KnGd17fwHviPmzQEa43uQh23Q/qvkWYSA7DKTePrIbJJpCjD+EybEXTl:ClUfHPmzQAd/ZNSC3X+EyfkcKvko
- TLSH T1A6643915A694CBFBD1669239C85205F5EA713C42CB60D68B33907E96BE336D08DFEB01
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ac:2c:b2:d1:96:94:5b:ee:7a:96:54:09:c0:41:64:5f:9f:36:f2:3b:c4:d2:56:3a:e8:d2:6a:92:0e:01:1f:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 6, 2026
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:40:2a:4a:d7:d2:31:21:a6:15:00:00:00:00:05:40
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Sep 8, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
23536
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
MpCopyAccelerator.pdb
mpclient
MpConfigUninitialize
MpConfigUnregisterNotifications
MpConfigInitialize
MpFreeMemory
MpConfigRegisterForNotifications
MpConfigGetValue
MpConfigOpen
MpAllocMemory
MpConfigClose
MpUtilsExportFunctions
MpClientUtilExportFunctions
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
kernel32
GetSystemDirectoryW
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEnvironmentVariableW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileSizeEx
SetFilePointerEx
WriteFile
OpenProcess
LoadLibraryExW
GetProcessMitigationPolicy
SetProcessMitigationPolicy
QueryPerformanceFrequency
HeapSetInformation
GetTempPathW
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
VirtualProtect
RaiseException
CreateFileW
TerminateProcess
DeviceIoControl
MoveFileExW
GetLocalTime
SetFileInformationByHandle
GetFileInformationByHandle
GetCommandLineW
SetLastError
GetModuleHandleExW
GetTickCount
GetDateFormatW
GetSystemTimeAsFileTime
GetTimeFormatW
Sleep
K32GetProcessImageFileNameW
K32GetModuleFileNameExW
GetCurrentProcessId
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetCurrentProcess
GetProcAddress
FreeLibrary
CopyFileExW
CopyFile2
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
SetEvent
ReleaseSRWLockExclusive
DebugBreak
LocalFree
CloseHandle
GetLastError
CreateEventW
WaitForSingleObject
SetErrorMode
DecodePointer
WriteConsoleW
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
HeapFree
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
InitializeCriticalSectionEx
WakeAllConditionVariable
SleepConditionVariableSRW
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStdHandle
ExitProcess
GetCommandLineA
GetFileType
FlsAlloc
FlsGetValue
advapi32
RegOpenKeyExW
RegQueryValueExW
CloseServiceHandle
OpenSCManagerW
AllocateAndInitializeSid
ConvertStringSidToSidW
EnumServicesStatusExW
CheckTokenMembership
ConvertSidToStringSidW
EventUnregister
EventRegister
RegCloseKey
EventWriteTransfer
ConvertStringSecurityDescriptorToSecurityDescriptorW
TraceMessage
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
rpcrt4
NdrServerCall2
NdrServerCallAll
NdrAsyncServerCall
RpcRevertToSelf
RpcImpersonateClient
RpcServerInqBindings
RpcEpRegisterW
RpcEpUnregister
RpcServerTestCancel
RpcStringBindingParseW
RpcStringFreeW
RpcAsyncCompleteCall
RpcServerRegisterIf3
RpcServerUseProtseqW
RpcBindingToStringBindingW
RpcServerUnregisterIfEx
RpcServerUseProtseqEpW
RpcBindingInqAuthClientW
RpcBindingVectorFree
Ndr64AsyncServerCallAll
Name
.text
Size
152KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=174, id=261, version=33145,
count=17, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=18, id=260, version=35207,
count=1, id=259, version=35222,
count=4, id=260, version=35222,
count=8, id=257, version=33145,
count=90, id=261, version=35207,
count=3, id=257, version=35222,
count=371, id=1, productName=Unmarked objects,
count=34, id=261, version=35222,
count=24, id=265, version=35222,
count=7, id=126, version=50727,
count=1, id=255, version=35222,
count=1, id=151,
count=1, id=258, version=35222,