WinZIP80.rar
- SHA256 c68c727a565790abd67a5286e980815478170782d793eb1b24947f9c6737e3b0
Behavioral task
behavioral1
Sample
Key1.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Key1.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Key2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Key2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
Setup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
winzip80.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
winzip80.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target WinZIP80.rar
- Size 2.2MB
- Sample261029-wrtadadw2v
- SHA256 c68c727a565790abd67a5286e980815478170782d793eb1b24947f9c6737e3b0
- MD5 67a332f32ccdc668e9eaa18d43c7d9c6
- SHA1 b3371433502450603c305e7ae51b68f802e31de7
- SHA512 1dbb4ca84ede28345a794a4f8b5692dfbebe8a894b96932f4f8f607550ac97689d9a64f718020c193ad11d7b763dfb836f97c09b543e68cc9b02b4c65ac75427
- SSDEEP 49152:RGBfWvV96yzCdxx+iNWeigk0F1dySA/88m+vkKq2HjtRfC6fAmJK:RGBfWvV4yzCdxx5NFzHdOG+lq2H5Ra6a
- TLSH T1F8B533CF0172DBC47894FBA9973DCD043473BBD8FC28A8616A6B1D0315B8167867A636
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Key1.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Key1.exe unpack001/Key2.exe unpack001/Setup.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/winzip80.exe
File Explorer
-
WinZIP80.rar.rar 2.2MB
-
Key1.exe.exe 3KB
-
Key2.exe.exe 14KB
-
Setup.exe.exe 1.1MB
-
WinZIP80.txt129B
-
winzip80.exe.exe 1.2MB
-
汉化说明.txt1KB
Key1.exe
- SHA256 5560142728ce4d75a703d5577b09bacc105022dcf7d0e2a3691116369faa0a64
- MD5 2f6fd8528f144e325e05430dfe2e30f6
- SHA1 01c363b4e056352f341329240de9d2e56b74cfe0
- SHA512 9ccbe5b03673e6890144a177e67f3c5331f5e222de8904b3fc1588be47220dbdfb741f993b5ea09110c8e9550c6e2f59ba221c65b4508d461c977a85e212ae3f
- TLSH T15661B6C9BBA60A63CBDF023E071AAC6137A8624043BC6FD64DAD91DF79CD345896C604
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
UPX3
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=27, id=1, productName=Unmarked objects,
count=5, id=19, version=9049,
count=12, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
Key2.exe
- SHA256 623182e0fd8b5897bbc1958970cb2697e3362780751b23a12a6d286b8fd74227
- MD5 43d51b9dd66d57a57622f4fda39e3fca
- SHA1 edbdb78f7eab5c656267a11b68c76976490e6f15
- SHA512 fb606eaead5eeaf64f9633c53e78b606077c3a8eb34fbda500e0f27639b2f83d39e14b2a73ec9b2d9dcd9f3627d5ae3c393b57d5d3aaa6d490ddf507ff566dc9
- SSDEEP 384:eYITI7t/T2KjFlmSreggT76qHXhr6+N9PfBHyndTQ:eYI2bTFlmSreQq3sOxCM
- TLSH T12262BF37FD1087FBD8CA12B08096F52593295C758175C2CF52F4186B2C68C68EDAC3AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
45057
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
1KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Setup.exe
- IMPHASH 6c6e8576f6d86b0e67e45f26ef4de96d
- SHA256 790ce78f05a97b590552d350063a830e11891378981efd0f41d663c3ebee19bf
- MD5 3a9975d3a693418e785d3dba401e23a5
- SHA1 0e52ebfe2a3f861a67e296d1be86d537787405e8
- SHA512 9101871637c8929bd4d2ea5b3f4f301740a25c58cf583abb706df6915715d3a1e1d53bec7aaddd3ba9377559de0613223fc01eb90437642ab22b3451173e7bb0
- SSDEEP 24576:aGqn++MsJsAbvGo0mwJ/2b53C/DvPw1k5Z5mvUyGself8hc:aZ/MysADORJeS/jw1k8UyGFd
- TLSH T18435239A6483D2E3D06D15B999E09D1A8B35CD972522CBABBF06F4CD9F766C00D3301B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29088
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
_lopen
FindFirstFileA
lstrlenA
lstrcpyA
GetWindowsDirectoryA
lstrcatA
RemoveDirectoryA
FindNextFileA
DeleteFileA
lstrcmpA
SetFileAttributesA
_lread
FindClose
_lcreat
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetLastError
GetCurrentProcess
_llseek
GetModuleFileNameA
GlobalFree
GlobalAlloc
SetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
GetLocalTime
UnhandledExceptionFilter
FreeEnvironmentStringsA
HeapReAlloc
_hread
_hwrite
CreateDirectoryA
GetTimeZoneInformation
GetSystemTime
_lclose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetCPInfo
GetACP
GetOEMCP
WideCharToMultiByte
TerminateProcess
GetFullPathNameA
GetCurrentDirectoryA
RtlUnwind
HeapFree
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
SetEnvironmentVariableA
VirtualAlloc
WriteFile
HeapAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
user32
LoadIconA
wsprintfA
ExitWindowsEx
MessageBoxA
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data1
Size
4KB
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=20, id=14, version=7299,
count=72, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=8, productName=Unmarked objects (old),
count=7, id=19, version=8034,
count=84, id=1, productName=Unmarked objects,
count=5, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
WinZIP80.txt
- SHA256 bbd28ce7a0868b1c02a387b1a12366b71fda9835b18853ba8158726969f56c7a
- MD5 def7c721c5bbf33d49430450b78d5e32
- SHA1 6492bf23c27c6445bbe18b8cb40632721275245e
- SHA512 bb9b80c76df32227de8d657a95830e813207c030c246b807cbc70df8a06aad98931a814680db700116b92b000ac26a0c9c130da497b560e1d41fecd8a7253306
- TLSH T187B02B0C801A136183B400256951412C203AD58187500E1325810C0A2802CB41009A07
- MD5 SHA1 SHA512 TLSH
winzip80.exe
- IMPHASH a9380f14c96a505de427e16e569c6daa
- SHA256 d59a38dc0d9b42400fa18a1122fd0b9c02b550926c7f910f79a6ae7aeb64a2c3
- MD5 d4455019d3557811d1a52f7f8d775adc
- SHA1 7f04b466c5d5eb6ee2af0fcd4d36f4076dc84dbd
- SHA512 4fbdb81de3c6fbee5654a2999bf1ee85e84e8b5b5d0b9016b1ef9a3a4c9bd53f2bd35b9edf5ea33b5e8efc57c5481fd9b9c185423302d61e9c4cb7d7af7ed128
- SSDEEP 24576:AhfOTzScFPT2x9Bmthy9OVBCEogzo12UCglybcXYW3CGfNOuG:0kSWPQ9kts9u1rkEMlTYrGq
- TLSH T12C453321A2D24176FC825BB0AF71B6A7D33FB5A092943C2FF5346C7D09C97E92A10746
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
c0:1d:03:fe:54:64:19:69:e7:70:12:c5:98:df:40:e6
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=WinZip Computing\, Inc.,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/CPS Incorp. by Ref.\,LIAB.LTD(c)96+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=VeriSign\, Inc.,L=Internet+L=Mansfield,ST=CT,C=US
Chains
Jan 1, 0001
Subject
CN=VeriSign Time Stamping Service CA SW1,OU=VeriSign Trust Network+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98,O=VeriSign\, Inc.
Serial Number
fc:a4:a5:9f:2c:0f:c0:b9:03:98:33:1b:7b:54:54:1d
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 16, 1999 - Jan 6, 2004
Subject
CN=WinZip Computing\, Inc.,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/CPS Incorp. by Ref.\,LIAB.LTD(c)96+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=VeriSign\, Inc.,L=Internet+L=Mansfield,ST=CT,C=US
Serial Number
5a:c5:c5:06:20:43:7d:42:57:3f:e2:5e:27:26:cb:c1
Issuer
OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet
Key Usages
KeyUsageDigitalSignature, KeyUsageKeyEncipherment
Timespan
Apr 13, 2000 - Apr 12, 2001
Minor OS version
0
Major OS version
4
Entry point
15985
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
EndDialog
GetWindowRect
SetCursor
DefWindowProcA
GetWindowWord
SetWindowWord
BeginPaint
GetSysColor
GetClientRect
SetRect
EndPaint
RegisterClassA
LoadIconA
OemToCharBuffA
LoadCursorA
GetLastActivePopup
ShowWindow
PostMessageA
EnableWindow
GetTopWindow
DestroyWindow
GetWindowLongA
SetWindowLongA
SetWindowTextA
SetForegroundWindow
SetActiveWindow
CharNextA
SetTimer
GetMessageA
PostQuitMessage
KillTimer
DialogBoxIndirectParamA
GetDlgItemTextA
SendMessageA
GetSystemMetrics
SetWindowPos
PeekMessageA
TranslateMessage
DispatchMessageA
GetParent
SetDlgItemTextA
SendDlgItemMessageA
GetDlgItem
InvalidateRect
UpdateWindow
wsprintfA
MessageBoxA
kernel32
_lwrite
GlobalAlloc
GlobalFree
_lread
GetDriveTypeA
VirtualAlloc
VirtualFree
RtlUnwind
HeapAlloc
HeapFree
GetCommandLineA
GetModuleHandleA
ExitProcess
FindNextFileA
MoveFileExA
CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CloseHandle
SetFilePointer
SetEndOfFile
RemoveDirectoryA
SetFileAttributesA
DeleteFileA
GetACP
GetModuleFileNameA
SetErrorMode
GetVersion
LoadLibraryA
GetProcAddress
FindClose
FindFirstFileA
SetCurrentDirectoryA
lstrlenA
CreateDirectoryA
lstrcatA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
_lcreat
lstrcpyA
_lopen
_lclose
GetVolumeInformationA
GlobalHandle
GetLastError
LocalFree
_llseek
WinExec
CreateProcessA
GlobalLock
OpenFile
GetEnvironmentVariableA
GlobalUnlock
GetWindowsDirectoryA
LocalAlloc
FreeLibrary
WaitForSingleObject
GetTickCount
FormatMessageA
gdi32
GetTextExtentPoint32A
SetBkColor
SetTextColor
SetTextAlign
GetBkColor
DeleteObject
ExtTextOutA
CreateDCA
GetDeviceCaps
CreateFontIndirectA
DeleteDC
SelectObject
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_winzip_
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=153, productName=Unmarked objects (old),
count=1, id=6, version=1668,
count=1, id=2, version=7303,
汉化说明.txt
- SHA256 8f0d3f0a75b1e71d4ecbab1ca716975344b22ce533a5db987e88287bf8c0dea3
- MD5 25bd2c5843450d4dd607b19de4065bd5
- SHA1 12a835f1c32355b38cf86520d7d16c693dedb956
- SHA512 b9eb09d35874ad47edcfd437a60460a85ed392c4b13e49cd3d64e4d34efc85be5040fa6aa3d7b5f16885a310216e422c896e1c7d48b069d6391c30a1285b33c9
- TLSH T191116365A7AB04B0E3BD2F60694B101BE18506B30C634FDE302C09A13B31400A68E9B5
- MD5 SHA1 SHA512 TLSH