04229ArchsufeeDigi0Evid-35871.zip
- SHA256 ac6a6e9e0ca44d20bab82b78232d5e4f32b520c9c8821a60046f79fb8dac77d0
Overview
overview
9Static
static
4Fact265662...pi.vbs
windows10-2004-x64
9Fact265662...pi.vbs
windows11-ltsc_2024-x64
9~/aglj1.dll
windows10-2004-x64
3~/aglj1.dll
windows11-ltsc_2024-x64
3~/ivgnfj2.dll
windows10-2004-x64
1~/ivgnfj2.dll
windows11-ltsc_2024-x64
1~/mrar/les...d2.pdf
windows10-2004-x64
3~/mrar/les...d2.pdf
windows11-ltsc_2024-x64
3~/mrar/les...s1.pdf
windows10-2004-x64
3~/mrar/les...s1.pdf
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
Fact265662S80XPVI_3E92_Conc_Com-Pend9V220-sbpi.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fact265662S80XPVI_3E92_Conc_Com-Pend9V220-sbpi.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
~/aglj1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
~/aglj1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
~/ivgnfj2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
~/ivgnfj2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
~/mrar/lesxpc/gahxbi/kojp/ptcd2.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
~/mrar/lesxpc/gahxbi/kojp/ptcd2.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
~/mrar/lesxpc/gahxbi/kojp/rbhnds1.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 04229ArchsufeeDigi0Evid-35871.zip
- Size 2.5MB
- Sample261029-1e56mace62
- SHA256 ac6a6e9e0ca44d20bab82b78232d5e4f32b520c9c8821a60046f79fb8dac77d0
- MD5 b44e3dd8be4e56521b4fc37177bb85e1
- SHA1 912441673cda1cff37a80c6000f2090f2952dd1e
- SHA512 1563484b8743c0eb002d997a40c75c0e3bc5d518f0cfc0b4dc8e29c4265bbf9033cc7b4669ef3949fda4e0f78b05772960718bedb93b6f96c676f7c8c37394b0
- SSDEEP 49152:hMZfLIEMzKUJpKda4yIY86gFyhSlfXQDDtvhkE2Ms9:8f0EMYyIh6g88fXG/h2Ms9
- TLSH T1C0C53308A33E1029AAD6869F4EE451042E35D5580390E59E4FE77E0A49BF0AE7F15CFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/~/aglj1.xml
File Explorer
-
04229ArchsufeeDigi0Evid-35871.zip.zip 2.5MB
-
Fact265662S80XPVI_3E92_Conc_Com-Pend9V220-sbpi.vbs3.6MB
-
~/aglj1.xml.dll 20KB
-
~/ivgnfj2.xml.dll 22KB
-
~/mrar/lesxpc/gahxbi/kojp/ptcd2.pdf.pdf 25KB
-
~/mrar/lesxpc/gahxbi/kojp/rbhnds1.pdf.pdf 46KB
Fact265662S80XPVI_3E92_Conc_Com-Pend9V220-sbpi.vbs
- SHA256 b92b333da29e1dde170d60f424e7dfa432c3a07903c454671721e770d5eb2ad1
- MD5 f0a49ddffad0ed5eb5676f728407e1a1
- SHA1 4fd1c6bc2665bb1fe66768381dbe6b2aaa0a1e3d
- SHA512 2439ee80d780f511762df64e5eb4bb0f041a733e3b254fba88a3ec2519f5ee00ab954e2a10ea7bb22060a4fd7310ddce5c57e90d5b6191b7bbb7c5ec3b3a8b0f
- SSDEEP 49152:+oWO58sd4V1j5orIfiHX2nTPkt/0EYqnQzznNxAHnlACPvg:ml
- TLSH T146060237ABA8010709B2477AF14A6173BE76C423874D83A5CCDDE21935DB4EE827E5E4
- MD5 SHA1 SHA512 SSDEEP TLSH
~/aglj1.xml
- IMPHASH 80bd9c6779706dbd0301e3c4d772ff00
- SHA256 39768457bbeb5af3d537b8311c73e2d5dffc4a6e9a29ab5077341a951f2468d1
- MD5 1d93a7ab93e4b1e7233e77523fcc676d
- SHA1 a0b3c36c6df20ea5c705669756887c3eb74f757d
- SHA512 3b0a9564639a0c796ee6ae382d851da7fdec444c7203dd9155ed4773620ba1724106c679a29e9e4c47d739f627879c6b01d1c667d2e7de4526d226cd8fc1d80d
- SSDEEP 384:qkqM+ObiQVns8VBSIRw/eDX9OUOZ2OPVIdvYuYJL+mcXfeMQ:qkqM+uELKX9OUOZ2Od+g3LJp
- TLSH T164924997BB048072E9CD4A7450B7D23B487977411FC120E3B7E80A5E5EA87E22B74A47
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
0d:b3:38:13:ef:0b:c6:0f:25:ae:ff:be:95:21:6a:7c:f1:13:ed:bc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Chains
Mar 30, 2012
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Serial Number
15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 15, 2010 - Dec 14, 2012
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
5
Entry point
11310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\depot\build-FW-Rel-Win\Mainline\fw\app\output\ASE.pdb
msvcr100
_unlock
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_lock
_onexit
_except_handler4_common
?terminate@@YAXXZ
_crt_debugger_hook
__clean_type_info_names_internal
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
??2@YAPAXI@Z
??3@YAXPAX@Z
malloc
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
__dllonexit
free
_CxxThrowException
__CxxFrameHandler3
memcpy
msvcp100
?_Xlength_error@std@@YAXPBD@Z
kernel32
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
ASEFreeBuffer
ASEFreeStructure
ASERead
ASEWrite
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=152, version=20115,
count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=4, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=44, id=1, productName=Unmarked objects,
count=7, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
~/ivgnfj2.xml
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ed6131702df41a1c2c4ab1027614bc028c61d54c3261d7090d43838a79bd9266
- MD5 b80e8c6c63a953fc1258d28996b0ca8f
- SHA1 161c6845c2663b574d226fdf9bde0f256d72ddd6
- SHA512 253834fbd6c121674b2af71cb591e210563d18e29b8511fd854b25eec52d5137de66d03bbfd0b79ae7f4a2ffb8398ce7f68d99090f01f9a863e53edeec4f4f96
- SSDEEP 384:fnj+rwTA4EnRteUcDGNMK6jzZBUcDG1BIXFhl:f8QrusDG6KglbDGc1h
- TLSH T1BEA20A62C7945C12EDB78F3170F4C6056F70BA85AAA5C5FF910CC0568FD2B8269B837A
- MD5 SHA1 SHA512 SSDEEP TLSH
PE Signature issue
Digest
81:d3:6d:8a:48:ba:82:07:a5:19:3d:fc:ee:41:5f:fb:7b:5e:95:81:c9:97:e8:dd:54:3f:a6:40:9e:fe:7a:14
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET Foundation,O=.NET Foundation,L=Redmond,ST=WA,C=US
Chains
Oct 26, 2026
CN=.NET Foundation,O=.NET Foundation,L=Redmond,ST=WA,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
13:7a:a8:5a:cd:22:ad:11:c0:d1:77:03:49:3d:96:91:d9:c2:92:83
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=.NET Foundation,O=.NET Foundation,L=Redmond,ST=WA,C=US
Chains
Nov 21, 2016
CN=.NET Foundation,O=.NET Foundation,L=Redmond,ST=WA,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=.NET Foundation,O=.NET Foundation,L=Redmond,ST=WA,C=US
Serial Number
06:7e:0e:bd:ca:b8:99:ab:9d:1d:07:13:b4:33:9b:dc
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 16, 2016 - Oct 28, 2019
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert\, Inc.,C=US
Serial Number
02:ce:42:94:59:02:a4:f3:c0:40:b0:ff:77:93:d1:4f
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 24, 2015 - Jan 7, 2025
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
13418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\rx-net\Rx.NET\Source\System.Reactive.Interfaces\bin\Release\net45\System.Reactive.Interfaces.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
~/mrar/lesxpc/gahxbi/kojp/ptcd2.pdf
- SHA256 d8a939595c8105ece6189b480d96a6884e9790fc93980c385d666da57f372d88
- MD5 eea518aed26f9f80d92dd6849b3bc8eb
- SHA1 ed41fd87b9b173d7729878e280479807cef5417b
- SHA512 c93b98f08aaf2bac86f9b57ace0bea267bfaa0d23874773e0b7087838ff179e246f331aa5847828142ce26e5e22e192cc72a464df6caf30ed50e8d9aaa129e17
- SSDEEP 768:M57rOIaJhtyGeMmH6PqrDcUFsw3q7f0vtO3iqKIA+h3:M5nO5JSG8Rr4UD3qne+Z
- TLSH T1BAC29E4A2547C550EB0742DAFB2FBDA7A149B30F2268C8811D6D9DA21A57FE4F20D1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
qr https://verificacfdi.facturaelectronica.sat.gob.mx/?id=3C664176-365C-11EF-8D53-CF8911D267C7&re=TPM06111759A&rr=IMH240401J77&tt=158879.35&fe=uWtGvA==
~/mrar/lesxpc/gahxbi/kojp/rbhnds1.pdf
- SHA256 62ed2c5c059fa01e792f87270f280765cbdac7faf5c6fc29c23995280e5cebf5
- MD5 5111fca3672e6da61bdfb9d0ca9967fd
- SHA1 9081075dbac4e7b1e271022d0ae1d5dc7407036b
- SHA512 64358adbfa91b415a153c46108b935730602f9453a28e9f6cfc9d855e7f7dfb91140c6471169c5b1e77f19be76632ad313a67a83095374dbe71f13d9d2dd28cb
- SSDEEP 768:VbBW8qkZ1DtGhQdG1gELYWhYGls6igH1U9cdn0bZ9lmjpCx4MDM/:dDR1BGiwjIGls6i01ScdmLrXD4
- TLSH T19723E15DAD268FA6F5F153703F3879926A68740221DFB64C30385B4734A1E70648B36B
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
file http://www.sat.gob.mx
-
qr https://siat.sat.gob.mx/app/qr/faces/pages/mobile/validadorqr.jsf?D1=0&D2=1&D3=%7C%7C03%2F07%2F2024%7CIMH240401J77%7CGOLJ7103166W2%7C1780%7CEvaluaci%C3%B3nEncargoConferido%7C200001088888800000031%7C%7C_k2DgMv5PqvtTLtaQ%2FAKzIfUuQeFRyydmEnvnF5ac0FtigF1vXKYzMEULnYsldl6Qa7s%2FOksibrHTCTf1ov6vAJYQI5KaihvN9BGCPfbBb2BW1mrLnqJ874WvEUN4pgyhABsaEhJfStQ8xq39Xm34zI51FZ03pH9FIq1bSNeJ1lw%3D