ba7f2e5474dcf373fe5a109792db2c844768cdef44ed92a0a7224373357422cd[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ba7f2e5474dcf373fe5a109792db2c844768cdef44ed92a0a7224373357422cd.exe
Size 358KB
Sample230706-npv27aad29
SHA256 ba7f2e5474dcf373fe5a109792db2c844768cdef44ed92a0a7224373357422cd
MD5 8b0f95d5e60bfeaa4e003ca5cab610b9
SHA1 632828165c5ee00d24024dea4195fbf020958607
SHA512 37677873ec851026ed4165f765f2ea3988f3ae8f9c87d3c9b5beaad62b568856508f459ee49ae2aa82facf2f29a8e00e78c275adede9491eb71bcc80c121716e
SSDEEP 6144:soShfxPZVheNA+ff0n+bU/p+AUDa/GhNtYOUEqC:VqJnhe2eQmAUW/ggEX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

ba7f2e5474dcf373fe5a109792db2c844768cdef44ed92a0a7224373357422cd.exe

.exe 358KB

ba7f2e5474dcf373fe5a109792db2c844768cdef44ed92a0a7224373357422cd.exe

IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
SHA256 ba7f2e5474dcf373fe5a109792db2c844768cdef44ed92a0a7224373357422cd
MD5 8b0f95d5e60bfeaa4e003ca5cab610b9
SHA1 632828165c5ee00d24024dea4195fbf020958607
SHA512 37677873ec851026ed4165f765f2ea3988f3ae8f9c87d3c9b5beaad62b568856508f459ee49ae2aa82facf2f29a8e00e78c275adede9491eb71bcc80c121716e
SSDEEP 6144:soShfxPZVheNA+ff0n+bU/p+AUDa/GhNtYOUEqC:VqJnhe2eQmAUW/ggEX
MD5 SHA1 SHA512 SSDEEP

windows x86

NSIS installer

installer

PE Signature issue

Digest

60:20:4a:9b:ad:bb:0f:98:e3:2e:a5:9b:e0:96:9b:b4:ff:5e:9b:53:54:aa:5e:4d:b0:85:d4:46:01:fc:5c:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

OU=Pipgras Buklende\ ,O=Dispersity,L=Carmel,ST=California,C=US,1.2.840.113549.1.9.1=#0c1d506572696f65736f7068616765616c404679676e696e676572732e556e

Chains

Jul 5, 2023

PE Signature issue

Digest

1b:84:d8:81:01:b0:b0:46:81:c9:b4:89:64:60:38:88:a0:9f:25:47

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

OU=Pipgras Buklende\ ,O=Dispersity,L=Carmel,ST=California,C=US,1.2.840.113549.1.9.1=#0c1d506572696f65736f7068616765616c404679676e696e676572732e556e

Chains

Jul 3, 2023

Subject

OU=Pipgras Buklende\ ,O=Dispersity,L=Carmel,ST=California,C=US,1.2.840.113549.1.9.1=#0c1d506572696f65736f7068616765616c404679676e696e676572732e556e

Serial Number

4b:1d:a6:a8:2d:cc:67:e0:6e:f4:3b:16:41:24:ad:50:91:c4:59:01

Issuer

OU=Pipgras Buklende\ ,O=Dispersity,L=Carmel,ST=California,C=US,1.2.840.113549.1.9.1=#0c1d506572696f65736f7068616765616c404679676e696e676572732e556e

Timespan

Nov 8, 2022 - Nov 7, 2025

Subject

OU=Pipgras Buklende\ ,O=Dispersity,L=Carmel,ST=California,C=US,1.2.840.113549.1.9.1=#0c1d506572696f65736f7068616765616c404679676e696e676572732e556e

Serial Number

4b:1d:a6:a8:2d:cc:67:e0:6e:f4:3b:16:41:24:ad:50:91:c4:59:01

Issuer

OU=Pipgras Buklende\ ,O=Dispersity,L=Carmel,ST=California,C=US,1.2.840.113549.1.9.1=#0c1d506572696f65736f7068616765616c404679676e696e676572732e556e

Timespan

Nov 8, 2022 - Nov 7, 2025

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

12508

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA CompareFileTime SearchPathA GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA SetFileAttributesA lstrcmpiA SetErrorMode LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetModuleHandleA LoadLibraryExA GetCommandLineA GetTempPathA FreeLibrary FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA MulDiv WriteFile MultiByteToWideChar

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA