1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be

Sharing

Copy URL Twitter E-mail

General

Target
1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be
Size 437KB
Sample230307-saa6paae45
SHA256 1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be
MD5 8594de05d204f0e762c151d92fc4acad
SHA1 fe6e938b126501d02f335984417186117bf9299d
SHA512 c3166a294904eb1a6d20ef283252d96344cacaddb6b6cddc80d671fb95f8165112597fc6d628ed6193a8ec61a3995f92afbe37c372fd6668768d69e8c2e1db03
SSDEEP 12288:2CycsYglaQRM4+dR2FNvnPmK4+xkbTZO4LniP:27laQRi0Hec0fniP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be

.exe 437KB

1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 1be4f2bf836682f0e55f1b8d01df92e0e82d34b1ea032d0958860a03daa349be
MD5 8594de05d204f0e762c151d92fc4acad
SHA1 fe6e938b126501d02f335984417186117bf9299d
SHA512 c3166a294904eb1a6d20ef283252d96344cacaddb6b6cddc80d671fb95f8165112597fc6d628ed6193a8ec61a3995f92afbe37c372fd6668768d69e8c2e1db03
SSDEEP 12288:2CycsYglaQRM4+dR2FNvnPmK4+xkbTZO4LniP:27laQRi0Hec0fniP
MD5 SHA1 SHA512 SSDEEP

windows x86

NSIS installer

installer

PE Signature issue

Digest

46:f3:a4:a3:96:60:3a:f5:01:1e:06:f6:9d:42:54:ce:1b:a3:04:b5:a0:07:19:31:95:4a:d2:43:49:6e:c2:d3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

PE Signature issue

Digest

da:20:48:2e:8a:fd:9c:97:2a:11:30:92:29:c3:d8:a4:30:e2:20:09

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Subject

OU=Unpitying Scappler\ ,O=Camouflager,L=Huntington,ST=Texas,C=US,1.2.840.113549.1.9.1=#0c1654726162656140536869706d616e736869702e706f79

Serial Number

6e:8f:d1:76:99:7d:c9:c7:8d:67:ed:57:f6:c2:8e:8f:73:ea:5b:79

Issuer

OU=Unpitying Scappler\ ,O=Camouflager,L=Huntington,ST=Texas,C=US,1.2.840.113549.1.9.1=#0c1654726162656140536869706d616e736869702e706f79

Timespan

Mar 25, 2022 - Mar 24, 2025

Subject

OU=Unpitying Scappler\ ,O=Camouflager,L=Huntington,ST=Texas,C=US,1.2.840.113549.1.9.1=#0c1654726162656140536869706d616e736869702e706f79

Serial Number

6e:8f:d1:76:99:7d:c9:c7:8d:67:ed:57:f6:c2:8e:8f:73:ea:5b:79

Issuer

OU=Unpitying Scappler\ ,O=Camouflager,L=Huntington,ST=Texas,C=US,1.2.840.113549.1.9.1=#0c1654726162656140536869706d616e736869702e706f79

Timespan

Mar 25, 2022 - Mar 24, 2025

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

12491

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA