2164b8ba92d8bf2c05e59189c45a4d0e56303542cb97e3dfea5f6385f41f5844

Sharing

Copy URL Twitter E-mail

General

Target
2164b8ba92d8bf2c05e59189c45a4d0e56303542cb97e3dfea5f6385f41f5844
Size 409KB
Sample221031-14sa3aeeal
SHA256 2164b8ba92d8bf2c05e59189c45a4d0e56303542cb97e3dfea5f6385f41f5844
MD5 82f4b81451fe3856254e6ca1a1247eb2
SHA1 81553252a3dbdac5aca348d526b116d95eaea97d
SHA512 350a6dd4b6016d461e1742fd1b6dd3054eaacd6ca752f67370a7b9c353f0fe37c2379ad21fe314caa14d0421315581155e21c74199221deb965a310943f33796
SSDEEP 6144:Vo7deOc+vQqs6rY7dyZGZGzLI2hXWaBn4GgmRhXjxS6fgALAo4pg+dFu121Gvo:O9cMQYrYUZdzE2lBFr5zpNQ
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

2164b8ba92d8bf2c05e59189c45a4d0e56303542cb97e3dfea5f6385f41f5844

.exe 409KB

2164b8ba92d8bf2c05e59189c45a4d0e56303542cb97e3dfea5f6385f41f5844

IMPHASH de26c763312295b50f6ad716d08fe2da
SHA256 2164b8ba92d8bf2c05e59189c45a4d0e56303542cb97e3dfea5f6385f41f5844
MD5 82f4b81451fe3856254e6ca1a1247eb2
SHA1 81553252a3dbdac5aca348d526b116d95eaea97d
SHA512 350a6dd4b6016d461e1742fd1b6dd3054eaacd6ca752f67370a7b9c353f0fe37c2379ad21fe314caa14d0421315581155e21c74199221deb965a310943f33796
SSDEEP 6144:Vo7deOc+vQqs6rY7dyZGZGzLI2hXWaBn4GgmRhXjxS6fgALAo4pg+dFu121Gvo:O9cMQYrYUZdzE2lBFr5zpNQ
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

e4:53:63:04:a0:90:41:77:c3:d1:ea:0f:3d:f6:ec:58:91:0a:ab:ab

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Serial Number

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Timespan

May 12, 1997 - Jan 7, 2004

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Serial Number

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 28, 2001 - Jan 6, 2004

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 10, 2000 - Nov 12, 2005

Subject

Serial Number

61:07:11:43:00:00:00:00:00:34

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2002 - Nov 25, 2003

Minor OS version

Major OS version

Entry point

129619

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

gdi32

GetStockObject

kernel32

LocalFree lstrlenW lstrcmpiW GetLastError LocalAlloc LocalReAlloc FormatMessageW GetFileAttributesW FindClose FindFirstFileW GetSystemDirectoryW GetFullPathNameW ExpandEnvironmentStringsW CreateDirectoryW CloseHandle FindNextFileW GetTempPathW HeapFree HeapAlloc GetProcessHeap lstrcmpW WriteFile lstrlenA WideCharToMultiByte SetFilePointer CreateFileW DeleteFileW FormatMessageA MultiByteToWideChar GetProcAddress GetModuleHandleA GetPrivateProfileStringW GetVersionExA GetCurrentProcess FreeLibrary LoadLibraryW CreateProcessW GetWindowsDirectoryW GetPrivateProfileSectionW GetPrivateProfileIntW SetCurrentDirectoryW GetModuleFileNameW IsValidLocale CopyFileW ReleaseMutex OpenMutexW CreateMutexW SetLastError GlobalFree GlobalAlloc GetTimeFormatW GetDateFormatW GetCommandLineW WaitForSingleObject Sleep GetDriveTypeW GetDiskFreeSpaceExW GetExitCodeProcess ReadFile GetVolumeInformationW GetLogicalDriveStringsW QueryDosDeviceW InterlockedDecrement GetCurrentDirectoryW InterlockedIncrement DeviceIoControl RaiseException LoadLibraryA InterlockedExchange OpenEventW GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoA HeapSize HeapReAlloc

ole32

CoInitialize CoCreateInstance CoUninitialize CLSIDFromProgID

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

shell32

ShellExecuteW

user32

KillTimer MessageBoxW MessageBeep MessageBoxIndirectW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW UpdateWindow PostQuitMessage DefWindowProcW PeekMessageW MsgWaitForMultipleObjects GetWindowLongW CheckDlgButton CreateDialogParamW SetWindowTextW GetDlgItem SetDlgItemTextW SetWindowLongW DestroyWindow ShowWindow SetTimer CharPrevW MessageBoxA LoadStringA GetMessageW IsDialogMessageW TranslateMessage DispatchMessageW SendMessageW CharNextW FindWindowW SetForegroundWindow GetKeyboardType

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

msvcrt

_adjust_fdiv memmove _vsnwprintf wcschr iswprint _vsnprintf wcsstr wcstol _wtoi _wcsnicmp wcsncmp _c_exit _exit _XcptFilter _ismbblead _cexit exit _acmdln _amsg_exit __getmainargs _initterm __setusermatherr _controlfp __p__commode __p__fmode __set_app_type _except_handler3 __dllonexit _onexit

rpcrt4

RpcServerUnregisterIf RpcMgmtWaitServerListen RpcMgmtStopServerListening RpcStringBindingComposeW NdrClientCall2 NdrServerCall2 RpcBindingFree RpcStringFreeW RpcBindingFromStringBindingW