6eaf4b2f67fa41762b5cfefc2ec67e79[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
6eaf4b2f67fa41762b5cfefc2ec67e79.exe
Size 3.2MB
Sample220315-rda5esaffl
SHA256 cdd12576c48c2123efbc19404d37cc9505c80d8378f37e793a4b0ecb02aa2361
MD5 6eaf4b2f67fa41762b5cfefc2ec67e79
SHA1 5c910ecb57f7a1016ae972058e9b785e3b4e232b
SHA512 5a8cf9f63e979fefc5e64a0bd976687f8a9188fad18e21c67d747c39bb4a1209afae4eea9f913dfb6703ddb3a1614912e868b3265558e9729968dafa16c292bb
MD5 SHA1 SHA512

Score

N/A

Malware Config

Signatures

File Explorer

6eaf4b2f67fa41762b5cfefc2ec67e79.exe

.exe 3.2MB

6eaf4b2f67fa41762b5cfefc2ec67e79.exe

IMPHASH f41bd45d825b0e2e44373b89f24d3e52
SHA256 cdd12576c48c2123efbc19404d37cc9505c80d8378f37e793a4b0ecb02aa2361
MD5 6eaf4b2f67fa41762b5cfefc2ec67e79
SHA1 5c910ecb57f7a1016ae972058e9b785e3b4e232b
SHA512 5a8cf9f63e979fefc5e64a0bd976687f8a9188fad18e21c67d747c39bb4a1209afae4eea9f913dfb6703ddb3a1614912e868b3265558e9729968dafa16c292bb
MD5 SHA1 SHA512

windows x64

PE Signature issue

Digest

cd:a7:8f:53:16:de:28:03:b4:f6:74:00:5c:c0:4a:ee:98:95:c9:01:db:8d:9e:79:ea:50:fb:ab:f3:55:25:ee

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Nvidia Corporation,OU=IT-MIS,O=Nvidia Corporation,L=Santa Clara,ST=California,C=US

Serial Number

02:66:ad:fa:17:63:89:d9:b4:30:1a:c8:7e:fd:6a:96

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 14, 2021 - Apr 16, 2024

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

Major OS version

Entry point

2249470

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

OpenProcessToken GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

ws2_32

getaddrinfo WSAGetLastError WSACleanup WSAStartup freeaddrinfo closesocket send select recv getsockopt ioctlsocket connect socket

user32

EnumDisplayDevicesA GetProcessWindowStation GetUserObjectInformationW

kernel32

SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose CloseHandle SetLastError WaitForSingleObject GetCurrentProcess ExitProcess ResumeThread CreateProcessA SetPriorityClass GetThreadContext SetThreadContext VirtualAlloc VirtualAllocEx WriteProcessMemory FreeLibrary GetProcAddress LoadLibraryA lstrlenA FreeConsole LocalFree FormatMessageA QueryPerformanceCounter QueryPerformanceFrequency EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree GetExitCodeProcess CreateProcessW GetFileAttributesExW HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc RtlUnwind LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

Name

.text

Size

222KB

Virtual Size

222KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.LdgsuLA

Size

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.LdgsuLA

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ