free-heic-converter[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
free-heic-converter.exe
Size 13.4MB
Sample230417-srnhcaeg84
SHA256 f3edf34bbcf130a6fb8e2683b6f849511b15d48015f1bc0bd3d68cc36fd28f7c
MD5 7b0cf22cd697f52f254a6b048b8cee8f
SHA1 588a9c6d8f34ae1aa8826725567024bf165eb178
SHA512 47e910927ffe9bac98c07a4a65553192e24537f36690e7550ece474f5c8549ac3380ffc502af45a9661439339adb0cf667fd70be296e280424c6be71a1cbbf67
SSDEEP 196608:N5VLHyumViiMOt+WeLHG+lNW32yR/SZ19dWT5Brxcqpb/NySOJeuVh:NTHEVjMPWeLG+ORS70rVbhOJeUh
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

free-heic-converter.exe

.exe 13.4MB

free-heic-converter.exe

IMPHASH 930db5550fff70a7cb029d279548a28b
SHA256 f3edf34bbcf130a6fb8e2683b6f849511b15d48015f1bc0bd3d68cc36fd28f7c
MD5 7b0cf22cd697f52f254a6b048b8cee8f
SHA1 588a9c6d8f34ae1aa8826725567024bf165eb178
SHA512 47e910927ffe9bac98c07a4a65553192e24537f36690e7550ece474f5c8549ac3380ffc502af45a9661439339adb0cf667fd70be296e280424c6be71a1cbbf67
SSDEEP 196608:N5VLHyumViiMOt+WeLHG+lNW32yR/SZ19dWT5Brxcqpb/NySOJeuVh:NTHEVjMPWeLG+ORS70rVbhOJeUh
MD5 SHA1 SHA512 SSDEEP

windows x86

Digest

be:da:ee:98:68:a1:e4:bc:a7:be:2e:37:c3:1b:1e:8a:67:1e:cf:ec:4b:46:fc:e1:19:4d:1b:fc:5a:4f:ef:e5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=Keysun Software Co.\,Ltd,O=Keysun Software Co.\,Ltd,L=Nanjing,ST=Jiangsu,C=CN,1.2.840.113549.1.9.1=#0c1a636f64657369676e696e67406b657973756e736f66742e636f6d

Serial Number

25:78:07:ff:3e:0f:d7:55:3d:46:d1:b8

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 29, 2020 - Mar 29, 2024

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

96244

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

user32

LoadStringW MessageBoxA CharNextW CreateWindowExW TranslateMessage SetWindowLongW PeekMessageW MsgWaitForMultipleObjects MessageBoxW LoadStringW GetSystemMetrics ExitWindowsEx DispatchMessageW DestroyWindow CharUpperBuffW CallWindowProcW

kernel32

lstrcmpiA LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW WriteFile WideCharToMultiByte WaitForSingleObject VirtualQuery VirtualProtect VirtualFree VirtualAlloc SizeofResource SignalObjectAndWait SetLastError SetFilePointer SetEvent SetErrorMode SetEndOfFile ResetEvent RemoveDirectoryW ReadFile MultiByteToWideChar LockResource LoadResource LoadLibraryW GetWindowsDirectoryW GetVersionExW GetVersion GetUserDefaultLangID GetThreadLocale GetSystemInfo GetSystemDirectoryW GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLastError GetFullPathNameW GetFileSize GetFileAttributesW GetExitCodeProcess GetEnvironmentVariableW GetDiskFreeSpaceW GetCurrentProcess GetCommandLineW GetCPInfo InterlockedExchange InterlockedCompareExchange FreeLibrary FormatMessageW FindResourceW EnumCalendarInfoW DeleteFileW CreateProcessW CreateFileW CreateEventW CreateDirectoryW CloseHandle Sleep

comctl32

InitCommonControls

Name

.text

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

21KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ