6bdb7716047c883698f4e4e14a6e47fe79d6e8c610b9f8400c8b01d3c071b065
- SHA256 6bdb7716047c883698f4e4e14a6e47fe79d6e8c610b9f8400c8b01d3c071b065
Password
infected
Behavioral task
behavioral1
Sample
1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 6bdb7716047c883698f4e4e14a6e47fe79d6e8c610b9f8400c8b01d3c071b065
- Size 46KB
- Sample230511-b83j6abb45
- SHA256 6bdb7716047c883698f4e4e14a6e47fe79d6e8c610b9f8400c8b01d3c071b065
- MD5 050e72a56eca357ea9043a009d583278
- SHA1 4c9b7fee625832faf6fc60f1a15f132d9fa7ba4f
- SHA512 c2ff5a0ae510e9649eafeb9329d5a5d316294ac8f0ddf2868d914788000ed60b353ad2cd3fbb79afa527a219f678989594c3c2d5590d74de42b4b59ff21a3681
- SSDEEP 768:2vzux++dur3WAaLx+R/m8085hdYOd979sLTx8JKxnal/yVC+dgjpGnUPXlbVv:2ixbMaL0w+DjzKg5iCknOR
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591 family_hermeticwiper - Hermeticwiper family
File Explorer
-
6bdb7716047c883698f4e4e14a6e47fe79d6e8c610b9f8400c8b01d3c071b065.7z 46KB
-
1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.exe 114KB
1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591
- IMPHASH fe4a2284122da348258c83ef437fbd7b
- SHA256 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591
- MD5 3f4a16b29f2f0532b7ce3e7656799125
- SHA1 61b25d11392172e587d8da3045812a66c3385451
- SHA512 32acaceda42128ef9e0a9f36ee2678d2fc296fda2df38629eb223939c8a9352b3bb2b7021bb84e9f223a4a26df57b528a711447b1451213a013fe00f9b971d80
- SSDEEP 1536:sBOoa7Nn52wurilmw9BgjKu1sPPxaSLyqC:sBOoa7P2wxlPwV1qPkSuqC
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
23:b5:b2:b7:f6:44:0d:92:ef:ac:4a:28:5d:66:3b:2a:f5:8d:f6:88
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Subject
SERIALNUMBER=HE 419469,CN=Hermetica Digital Ltd,O=Hermetica Digital Ltd,L=Nicosia,C=CY,1.3.6.1.4.1.311.60.2.1.3=#13024359,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:48:73:28:73:ac:8c:ce:ba:f8:f0:e1:e8:32:9c:ec
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 13, 2021 - Apr 14, 2022
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
Major OS version
Entry point
15232
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
StrStrW
StrRChrW
StrChrW
StrToIntW
PathAddExtensionW
PathFindExtensionW
PathFileExistsW
StrCatBuffW
PathAddBackslashW
PathAppendW
StrStrIW
StrCmpNW
wnsprintfW
StrStrA
lz32
LZClose
LZCopy
LZOpenFileW
msvcrt
towupper
wcsncpy
memcpy
_except_handler3
memset
kernel32
HeapAlloc
GetProcessHeap
DeviceIoControl
GetLastError
HeapReAlloc
HeapFree
lstrcmpA
GetSystemTimeAsFileTime
CreateFileW
CloseHandle
SetFilePointerEx
ReadFile
GetDiskFreeSpaceW
lstrlenW
WriteFile
FlushFileBuffers
CreateThread
WaitForMultipleObjects
GetModuleHandleW
GetProcAddress
GetCurrentProcess
VerSetConditionMask
VerifyVersionInfoW
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemDirectoryW
DeleteFileW
WaitForSingleObject
SetThreadPriority
FindFirstFileW
FindNextFileW
FindClose
GetLogicalDriveStringsW
SetLastError
GetCommandLineW
GetModuleFileNameW
GetFileAttributesW
CreateEventW
SetEvent
ExitProcess
GetCurrentProcessId
GetFileInformationByHandle
Sleep
user32
wsprintfW
CharLowerW
advapi32
InitiateSystemShutdownExW
ControlService
CloseServiceHandle
DeleteService
StartServiceW
ChangeServiceConfigW
QueryServiceStatus
CreateServiceW
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteKeyW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyW
RegCloseKey
RegSetValueExW
shell32
CommandLineToArgvW
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ