9fa60053165fb875d9c7a4b23c33bf13eeb3bfc414a284921bf07df60a4181c9exe_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
9fa60053165fb875d9c7a4b23c33bf13eeb3bfc414a284921bf07df60a4181c9exe_JC.exe
Size 244KB
Sample230808-wp2tqseh22
SHA256 9fa60053165fb875d9c7a4b23c33bf13eeb3bfc414a284921bf07df60a4181c9
MD5 6d4ffbfd1845ed88dbefa7adbb9c9abd
SHA1 95c1b62f6fb4cb6b1125629ce92a04f74761fe2a
SHA512 81b166f0e2c13bf5b367b872fe3e2d82761be618e582119d970ebda09a4c049234f95b5d4d119c90625bcf579d3dc44c3f82b67a31e5999272b6c6d684e3ce2d
SSDEEP 6144:wQLFhcP714PtsJe82/bOKcsGBBT6L96xcPiNmF7jaMLDTFwV:VFaPpFJe8XtBuKcPiU7jE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

9fa60053165fb875d9c7a4b23c33bf13eeb3bfc414a284921bf07df60a4181c9exe_JC.exe

.exe 244KB

9fa60053165fb875d9c7a4b23c33bf13eeb3bfc414a284921bf07df60a4181c9exe_JC.exe

IMPHASH 7c2c71dfce9a27650634dc8b1ca03bf0
SHA256 9fa60053165fb875d9c7a4b23c33bf13eeb3bfc414a284921bf07df60a4181c9
MD5 6d4ffbfd1845ed88dbefa7adbb9c9abd
SHA1 95c1b62f6fb4cb6b1125629ce92a04f74761fe2a
SHA512 81b166f0e2c13bf5b367b872fe3e2d82761be618e582119d970ebda09a4c049234f95b5d4d119c90625bcf579d3dc44c3f82b67a31e5999272b6c6d684e3ce2d
SSDEEP 6144:wQLFhcP714PtsJe82/bOKcsGBBT6L96xcPiNmF7jaMLDTFwV:VFaPpFJe8XtBuKcPiU7jE
MD5 SHA1 SHA512 SSDEEP

windows x86

NSIS installer

installer

PE Signature issue

Digest

f5:90:09:81:bb:33:84:82:8c:fb:e6:0a:b7:f6:25:04:81:01:99:c2:8c:52:c2:da:66:34:d5:0b:4b:d3:a7:70

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

OU=Sneglegangene Overfladeberegningen Brillanterne\ ,O=Hurrisome,L=Commerce,ST=Georgia,C=US,1.2.840.113549.1.9.1=#0c26466f7264656c696e6773706f6c6974696b6b656e4053746a65727468616765726e65732e5669

Chains

Jul 30, 2023

Subject

OU=Sneglegangene Overfladeberegningen Brillanterne\ ,O=Hurrisome,L=Commerce,ST=Georgia,C=US,1.2.840.113549.1.9.1=#0c26466f7264656c696e6773706f6c6974696b6b656e4053746a65727468616765726e65732e5669

Serial Number

51:d9:9d:fc:49:09:fd:8f:b0:b4:d9:f0:08:6a:b6:48:b6:98:18:df

Issuer

OU=Sneglegangene Overfladeberegningen Brillanterne\ ,O=Hurrisome,L=Commerce,ST=Georgia,C=US,1.2.840.113549.1.9.1=#0c26466f7264656c696e6773706f6c6974696b6b656e4053746a65727468616765726e65732e5669

Timespan

May 2, 2023 - May 1, 2026

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Serial Number

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 28, 2022 - Jul 27, 2033

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

13188

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetFileAttributesA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileTime GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer GetPrivateProfileStringA WritePrivateProfileStringA MulDiv MultiByteToWideChar FreeLibrary LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetForegroundWindow ShowWindow SetWindowLongA SendMessageTimeoutA FindWindowExA IsWindow AppendMenuA TrackPopupMenu CreatePopupMenu DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance