as40x64[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

as40x64.exe
Size

8.2MB
MD5

92b93504e60ac8cd53fd718cb0168605
SHA1

6431e31e7473b7abf2c275826ab886dd15e5fb31
SHA256

b5ceb790912681524b47f2f5603d8162ef696ef23b02db0e2bd2d25b9567078a
SHA512

d119f06e29de6ca082a2688588729a69b0d141e6b55268466ccd476684c52f8e7e2e381c5459196c1c4f7b59a188cc92395658d9c7e11b64ecac73389e6acbf3
SSDEEP

196608:CIKhlCZrxb6HqwMM4+zZycsZp30m8BJKt6aedTCMVFZC6cD:+hsBxSMM/ZJsn3AzOdeNy6y

Score

N/A

Malware Config

Signatures

Files

as40x64.exe
.exe windows x86

e5355231b73e3ac21d456975a0f2fac4

Code Sign

65:87:eb:33:5b:02:2c:8e:8f:44:c2:a7:3a:23:1e:6c
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07/11/2018, 00:00

Not After

14/11/2021, 23:59

Subject

CN=Fine spol. s r.o.,O=Fine spol. s r.o.,L=Praha 6,ST=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

bb:7a:04:44:9d:99:51:91:42:db:81:a9:d8:5f:6a:f4:e2:af:68:0a:ed:78:7d:a9:c2:7e:35:fb:7f:eb:ee:d4
Signer

Actual PE Digest

bb:7a:04:44:9d:99:51:91:42:db:81:a9:d8:5f:6a:f4:e2:af:68:0a:ed:78:7d:a9:c2:7e:35:fb:7f:eb:ee:d4

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Fine spol. s r.o.,O=Fine spol. s r.o.,L=Praha 6,ST=Praha,C=CZ

01/07/2019, 08:54
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

kernel32

WriteFile
CloseHandle
GetLastError
lstrcpyW
lstrlenW
MultiByteToWideChar
GlobalAlloc
GlobalFree
CreateFileA
Sleep
GetModuleHandleA
FormatMessageA
FormatMessageW
lstrcpyA
lstrlenA
GetCommandLineA
SetCurrentDirectoryA
CreateDirectoryA
DeleteFileA
FindClose
SetFilePointer
FindNextFileA
GetFileAttributesA
GetFileSize
RemoveDirectoryA
SetFileAttributesA
GetTempPathA
GetTempFileNameA
WaitForSingleObject
GetCurrentProcess
ExitProcess
CreateThread
GetExitCodeThread
CreateProcessA
GetTickCount
GetSystemDirectoryA
GetVersionExA
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpynA
CompareStringA
SetFileAttributesW
ReadFile
CreateFileW
CreateDirectoryW
SetFileTime
FindFirstFileA

user32

MessageBoxW
IsDialogMessageA
wsprintfA
GetMessageA
DestroyWindow
ShowWindow
SetWindowPos
IsWindowVisible
CreateDialogParamA
GetDlgItem
UpdateWindow
SendDlgItemMessageA
MsgWaitForMultipleObjects
GetSystemMetrics
SetForegroundWindow
SetWindowTextA
GetWindowRect
MessageBoxA
PeekMessageA
DispatchMessageA
TranslateMessage
LoadStringW
LoadStringA
IsWindow
PostMessageA
SetDlgItemTextA
SendMessageA

advapi32

AllocateAndInitializeSid
EqualSid
FreeSid
GetTokenInformation
OpenProcessToken

shell32

ShellExecuteExA
SHGetSpecialFolderLocation
SHGetPathFromIDListA

ole32

CoGetMalloc

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5355231b73e3ac21d456975a0f2fac4

Code Sign

65:87:eb:33:5b:02:2c:8e:8f:44:c2:a7:3a:23:1e:6cCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

bb:7a:04:44:9d:99:51:91:42:db:81:a9:d8:5f:6a:f4:e2:af:68:0a:ed:78:7d:a9:c2:7e:35:fb:7f:eb:ee:d4Signer

Signature Validations

Verification

01/07/2019, 08:54 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 19KB - Virtual size: 19KB

65:87:eb:33:5b:02:2c:8e:8f:44:c2:a7:3a:23:1e:6c
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

bb:7a:04:44:9d:99:51:91:42:db:81:a9:d8:5f:6a:f4:e2:af:68:0a:ed:78:7d:a9:c2:7e:35:fb:7f:eb:ee:d4
Signer

01/07/2019, 08:54
Valid: false

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 19KB - Virtual size: 19KB