f341d4321a45a7e65d27658d1fc197aca8bb6eeff13f0142726472970ea44d32

Resubmissions

26/12/2022, 00:14

221226-ajqcvscc837

25/12/2022, 22:20

221225-19d1mafd3v7

Sharing

Copy URL Twitter E-mail

General

Target
f341d4321a45a7e65d27658d1fc197aca8bb6eeff13f0142726472970ea44d32
Size 643KB
Sample221226-ajqcvscc83
SHA256 f341d4321a45a7e65d27658d1fc197aca8bb6eeff13f0142726472970ea44d32
MD5 3f7e56e9f2e0371568840accc78adaa3
SHA1 4bcc71c7b6ce7d5a3b8d854001e9320bc20f646d
SHA512 110182314ce0a29f7422f09edae567791d81480e89e9e15811388f001d0e99ed2a34bd71da31bf6a77db4a7bccca154d5aa56a04ea3fb52a036f94db8ee4126d
SSDEEP 12288:gIVVVFGVFYFGVFYFGVFed24WA2J5PfYRPBpFHkxGh:BVHIF0IF0IFedaJ53YR5HHkU
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

f341d4321a45a7e65d27658d1fc197aca8bb6eeff13f0142726472970ea44d32

.exe 643KB

f341d4321a45a7e65d27658d1fc197aca8bb6eeff13f0142726472970ea44d32

IMPHASH c4d010441c17e8245adced7fdcad59f4
SHA256 f341d4321a45a7e65d27658d1fc197aca8bb6eeff13f0142726472970ea44d32
MD5 3f7e56e9f2e0371568840accc78adaa3
SHA1 4bcc71c7b6ce7d5a3b8d854001e9320bc20f646d
SHA512 110182314ce0a29f7422f09edae567791d81480e89e9e15811388f001d0e99ed2a34bd71da31bf6a77db4a7bccca154d5aa56a04ea3fb52a036f94db8ee4126d
SSDEEP 12288:gIVVVFGVFYFGVFYFGVFed24WA2J5PfYRPBpFHkxGh:BVHIF0IF0IFedaJ53YR5HHkU
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

5c:cb:8a:ea:8f:7f:6c:3b:8b:fc:0a:9d:a4:a8:a2:8a:8d:ca:6b:e1:58:ca:e1:2e:40:02:14:6a:9f:6d:11:45

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=94349,CN=Telegram FZ-LLC,O=Telegram FZ-LLC,L=Dubai,ST=Dubai,C=AE,1.2.840.113549.1.9.1=#0c11696e666f4074656c656772616d2e6f7267,1.3.6.1.4.1.311.60.2.1.2=#13054475626169,1.3.6.1.4.1.311.60.2.1.3=#13024145,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

7a:e2:b5:02:13:71:f0:92:a9:04:b6:fa

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 29, 2022 - Jul 29, 2025

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

12574

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FreeLibrary GetProcAddress GetLastError LoadLibraryExW CreateFileA SetEndOfFile GetModuleFileNameW WideCharToMultiByte GetFileAttributesW ExpandEnvironmentStringsW MultiByteToWideChar HeapFree GetVersionExA HeapAlloc GetProcessHeap GetFullPathNameW EnterCriticalSection LeaveCriticalSection GetFullPathNameA GetCurrentProcess SetUnhandledExceptionFilter GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep VirtualAlloc HeapReAlloc RtlUnwind CloseHandle RaiseException GetDriveTypeA ReadFile SetFilePointer SetStdHandle LoadLibraryA InitializeCriticalSection GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetCurrentDirectoryA FlushFileBuffers CompareStringA CompareStringW SetEnvironmentVariableA CreateFileW HeapSize WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableW

user32

MessageBoxW

advapi32

RegQueryValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW

Name

.text

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

��8

Size

310KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.amant

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.brunhil

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.audra

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.hoang

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ