file

Sharing

Copy URL Twitter E-mail

General

Target
file
Size 1.2MB
Sample230725-wdsfxsef39
SHA256 696808a3a7971c3af2b8a5e69803fd45c7480da8fa42711491c608d583ff4f56
MD5 36d4a7ec6a9ad04aa447dda96ed21611
SHA1 0b1e924be77688d3f2171bf36bd420f5c60d5805
SHA512 407e3ac77fac97cebb89aa2f99af807c9edd91aca1fbc3523aea63a60adf4d37056889dbfeae7a072a96066d11bd695f6e1001452376a9aa15fe4b9671ffe1b3
SSDEEP 24576:sDWv+KX/VnxU/wcXbtmRodFpVjv27dTtNcbORbRt648:8WRFxkwcp1VgdsbybR8F
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file

.exe 1.2MB

SHA256 696808a3a7971c3af2b8a5e69803fd45c7480da8fa42711491c608d583ff4f56
MD5 36d4a7ec6a9ad04aa447dda96ed21611
SHA1 0b1e924be77688d3f2171bf36bd420f5c60d5805
SHA512 407e3ac77fac97cebb89aa2f99af807c9edd91aca1fbc3523aea63a60adf4d37056889dbfeae7a072a96066d11bd695f6e1001452376a9aa15fe4b9671ffe1b3
SSDEEP 24576:sDWv+KX/VnxU/wcXbtmRodFpVjv27dTtNcbORbRt648:8WRFxkwcp1VgdsbybR8F
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

47:48:5a:48:a4:80:19:00:d1:8c:c8:81:0b:92:c9:b6:c0:7f:ad:4b

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 15, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0f:78:4d:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 23, 2007 - Feb 23, 2009

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:47:52:ba:00:00:00:00:00:04

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 16, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Minor OS version

Major OS version

Entry point

400848

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

388KB

Virtual Size

387KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

780KB

Virtual Size

780KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ