cf648d0d6dc000fee07dbd7b6b04d245[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
cf648d0d6dc000fee07dbd7b6b04d245.exe
Size 767KB
Sample220830-af2lqaaae8
SHA256 dfdedc4060f4944298bcdf25778b7f7eaaef43fdae61238d7debf88825e66294
MD5 cf648d0d6dc000fee07dbd7b6b04d245
SHA1 28fdfad4f62577cfe3ada300e0697742461e6e39
SHA512 04b2836ecad721841ce56d356e1e14201a7a1a6f798a0bd9b51a3f1cdeb89eafe64614f46c2ea71f37e0993526eb3b7894be1b886ec721d45f5e60c44d99dba0
SSDEEP 12288:qo0YV0J8j5czSBqgXqBf3CSrd6JOosHTWLgtQ5kls8cKXtLyTrjAc+SdgkY:R4WBqzf3Nrd6v+CklFcQOTrCSdgkY
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

cf648d0d6dc000fee07dbd7b6b04d245.exe

.exe 767KB

cf648d0d6dc000fee07dbd7b6b04d245.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 dfdedc4060f4944298bcdf25778b7f7eaaef43fdae61238d7debf88825e66294
MD5 cf648d0d6dc000fee07dbd7b6b04d245
SHA1 28fdfad4f62577cfe3ada300e0697742461e6e39
SHA512 04b2836ecad721841ce56d356e1e14201a7a1a6f798a0bd9b51a3f1cdeb89eafe64614f46c2ea71f37e0993526eb3b7894be1b886ec721d45f5e60c44d99dba0
SSDEEP 12288:qo0YV0J8j5czSBqgXqBf3CSrd6JOosHTWLgtQ5kls8cKXtLyTrjAc+SdgkY:R4WBqzf3Nrd6v+CklFcQOTrCSdgkY
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

58:10:7b:59:9d:23:77:9a:58:d1:63:91:e1:a3:ed:f0:16:ae:a6:1c:f6:a6:02:2a:16:9b:08:67:d5:37:81:1b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

PE Signature issue

Digest

46:1d:01:93:52:c7:5a:11:9e:c1:55:fc:c7:94:ff:ef:35:2c:c8:5c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Subject

CN=Luftfarternes Anorak\ ,OU=Skraabaandets Tavlemesteren Dhyana\ ,O=bodyless,L=Röttingen,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c174d6f64696369747940426169737365726e65732e436f6c

Serial Number

31:65:49:e4:64:47:85:f7

Issuer

CN=Luftfarternes Anorak\ ,OU=Skraabaandets Tavlemesteren Dhyana\ ,O=bodyless,L=Röttingen,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c174d6f64696369747940426169737365726e65732e436f6c

Timespan

Aug 26, 2022 - Aug 25, 2025

Subject

CN=Luftfarternes Anorak\ ,OU=Skraabaandets Tavlemesteren Dhyana\ ,O=bodyless,L=Röttingen,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c174d6f64696369747940426169737365726e65732e436f6c

Serial Number

31:65:49:e4:64:47:85:f7

Issuer

CN=Luftfarternes Anorak\ ,OU=Skraabaandets Tavlemesteren Dhyana\ ,O=bodyless,L=Röttingen,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c174d6f64696369747940426169737365726e65732e436f6c

Timespan

Aug 26, 2022 - Aug 25, 2025

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

12960

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance