SecuriteInfo[.]com[.]Trojan[.]DownLoader44[.]40553[.]568[.]24582

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Trojan.DownLoader44.40553.568.24582
Size 3.1MB
Sample220222-x4dk5aeacj
SHA256 99c01d1fd62da5b29fb9b5335319ae532d30679f39096284ee2da359a411b529
MD5 f74f67f98a700f27d7a894a630e73077
SHA1 f584f846f46cce8c6697f2cba01f5184360a34a1
SHA512 f9cc772244d12a573d73938c4e6f7d5faec4d83ae9330203d100141d82a01aaef73551e6076a9f7932ba87eae4ec44f5e3e13d4cb6b11e2514ad80c67e8cb796
SSDEEP 98304:RK5C/ErkKaRBnQNtDFtdndcTDixRv5wxGVyk7:RK5C/Er4RBWh6TDeD
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Trojan.DownLoader44.40553.568.24582

.exe 3.1MB

SecuriteInfo.com.Trojan.DownLoader44.40553.568.24582

IMPHASH 629d572bad2dcff0fc429ecaf29f92a3
SHA256 99c01d1fd62da5b29fb9b5335319ae532d30679f39096284ee2da359a411b529
MD5 f74f67f98a700f27d7a894a630e73077
SHA1 f584f846f46cce8c6697f2cba01f5184360a34a1
SHA512 f9cc772244d12a573d73938c4e6f7d5faec4d83ae9330203d100141d82a01aaef73551e6076a9f7932ba87eae4ec44f5e3e13d4cb6b11e2514ad80c67e8cb796
SSDEEP 98304:RK5C/ErkKaRBnQNtDFtdndcTDixRv5wxGVyk7:RK5C/Er4RBWh6TDeD
MD5 SHA1 SHA512 SSDEEP

windows x64

PE Signature issue

Digest

e3:f5:1e:57:2e:e7:cc:2b:e7:14:45:93:25:8f:c4:29:f4:c0:68:94:36:07:97:f8:e8:9d:2c:3f:81:7f:a6:ec

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US

Serial Number

02:66:ad:fa:17:63:89:d9:b4:30:1a:c8:7e:fd:6a:96

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 14, 2021 - Apr 16, 2024

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

Major OS version

Entry point

2091180

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

OpenProcessToken GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

ws2_32

getaddrinfo WSAGetLastError WSACleanup WSAStartup freeaddrinfo closesocket send select recv getsockopt ioctlsocket connect socket

user32

EnumDisplayDevicesA GetProcessWindowStation GetUserObjectInformationW

kernel32

SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose CloseHandle SetLastError WaitForSingleObject GetCurrentProcess ResumeThread CreateProcessA SetPriorityClass GetThreadContext SetThreadContext VirtualAlloc VirtualAllocEx WriteProcessMemory FreeLibrary GetProcAddress LoadLibraryA WinExec lstrlenA FreeConsole LocalFree FormatMessageA QueryPerformanceCounter QueryPerformanceFrequency EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc RtlUnwind LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

Name

.text

Size

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.RZnZuo0

Size

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.RZnZuo1

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

204B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ