18bd6b80c064ecf021bff737c2f48ec4[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
18bd6b80c064ecf021bff737c2f48ec4.exe
Size 690KB
Sample230902-tj267sed45
SHA256 1cc7feaee823df0807c49341b9f4f0e58a4c021e8bc974af7bf5eb02fe09731e
MD5 18bd6b80c064ecf021bff737c2f48ec4
SHA1 7388f3d30f22b27243b6851f702189757cd29f06
SHA512 38dbc23989af37132a2f3bf462ed2c8591b3018fa96faf20a11d308e6bd820700ef456929ec338efd542ccf69d78ab36fbc2d76eeacfd09ac5cbc401e4d4d977
SSDEEP 12288:mA+lX8n+122WJVjgF/tCZqqe+OK+EkJrMo8CquJCLv2v30N1sb1:M/An0F0DhmJF8g30N1sZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

18bd6b80c064ecf021bff737c2f48ec4.exe

.exe 690KB

18bd6b80c064ecf021bff737c2f48ec4.exe

IMPHASH e88a529caf2666acedc4a4b0f2baa386
SHA256 1cc7feaee823df0807c49341b9f4f0e58a4c021e8bc974af7bf5eb02fe09731e
MD5 18bd6b80c064ecf021bff737c2f48ec4
SHA1 7388f3d30f22b27243b6851f702189757cd29f06
SHA512 38dbc23989af37132a2f3bf462ed2c8591b3018fa96faf20a11d308e6bd820700ef456929ec338efd542ccf69d78ab36fbc2d76eeacfd09ac5cbc401e4d4d977
SSDEEP 12288:mA+lX8n+122WJVjgF/tCZqqe+OK+EkJrMo8CquJCLv2v30N1sb1:M/An0F0DhmJF8g30N1sZ
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

f2:0d:6d:8e:cb:36:0c:8e:61:05:4c:82:c5:d2:41:ff:4c:35:57:78:df:b1:f5:a9:90:83:48:89:1b:b6:c0:1c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,ST=Mahe,C=SC

Chains

Dec 6, 2022

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,ST=Mahe,C=SC

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

CN=SecureTrust CA,O=SecureTrust Corporation,C=US

PE Signature issue

Digest

39:22:89:29:63:39:ec:41:b2:3a:80:27:d5:d6:ae:eb:47:ba:5c:cd

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,ST=Mahe,C=SC

Chains

Dec 6, 2022

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,ST=Mahe,C=SC

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

CN=SecureTrust CA,O=SecureTrust Corporation,C=US

Subject

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Serial Number

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54

Issuer

CN=SecureTrust CA,O=SecureTrust Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 1, 2016 - Sep 29, 2024

Subject

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,ST=Mahe,C=SC

Serial Number

07:16:9b:8d:9c:b0:85:e5:27:53:79:2f:f9:f6:c5:6a:44:3a:10

Issuer

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 3, 2020 - Feb 2, 2023

Subject

CN=Viking Cloud TWG Timestamping Responder 2022,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c2:62:80:b4:da:77:02:03:13:ab:bc:fa:a3:ff:ed:8b:2a

Issuer

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 10, 2022 - Nov 6, 2033

Subject

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c1:bc:fc:08:5f:97:f1:8c:6a:6a:23:c8:d3:7f:08:7d:f9

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 10, 2022 - Aug 10, 2037

Subject

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Serial Number

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54

Issuer

CN=SecureTrust CA,O=SecureTrust Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 1, 2016 - Sep 29, 2024

Subject

CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,ST=Mahe,C=SC

Serial Number

07:16:9b:8d:9c:b0:85:e5:27:53:79:2f:f9:f6:c5:6a:44:3a:10

Issuer

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 3, 2020 - Feb 2, 2023

Subject

CN=Viking Cloud TWG Timestamping Responder 2022,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c2:62:80:b4:da:77:02:03:13:ab:bc:fa:a3:ff:ed:8b:2a

Issuer

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 10, 2022 - Nov 6, 2033

Subject

CN=Viking Cloud TWG Timestamping CA\, Level 1,O=Viking Cloud\, Inc.,C=US

Serial Number

07:71:c1:bc:fc:08:5f:97:f1:8c:6a:6a:23:c8:d3:7f:08:7d:f9

Issuer

CN=Trustwave Global Certification Authority,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 10, 2022 - Aug 10, 2037

Minor OS version

Major OS version

Entry point

23151

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW CreateFileW RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW

Name

.text

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Nomm

Size

500KB

Virtual Size

500KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Home

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ