999dad39fb145b82c731b5ac3b792c65fffd576effd972e8ab3f34423028269f

General

Target
999dad39fb145b82c731b5ac3b792c65fffd576effd972e8ab3f34423028269f
Size 4.5MB
Sample231016-n69a5seb3y
SHA256 999dad39fb145b82c731b5ac3b792c65fffd576effd972e8ab3f34423028269f
MD5 ec08caac100457549df732d910ceeafe
SHA1 c64e6b90ef7aef2ee949aa6a79023813e9dc2586
SHA512 934176fc92d3dad424f008fc70f9140e73eac1e9650f16e7a6d506821fa82bcaff7325ff83d43be56e993eac26c57e36139c2593851ef861a0c36cc774333f7b
SSDEEP 49152:MPAgND8Flm7oSzW/j8LmN0XyZZwDzoNPmbR5Dkw7keLc349LzbuGHoLlMHVWb/dz:AKWQwi0PANP03y/Ll2WxoSMCCXQBcfG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

999dad39fb145b82c731b5ac3b792c65fffd576effd972e8ab3f34423028269f

.exe 4.5MB

999dad39fb145b82c731b5ac3b792c65fffd576effd972e8ab3f34423028269f

IMPHASH 6320642039f12dbb303e73fd505a08c4
SHA256 999dad39fb145b82c731b5ac3b792c65fffd576effd972e8ab3f34423028269f
MD5 ec08caac100457549df732d910ceeafe
SHA1 c64e6b90ef7aef2ee949aa6a79023813e9dc2586
SHA512 934176fc92d3dad424f008fc70f9140e73eac1e9650f16e7a6d506821fa82bcaff7325ff83d43be56e993eac26c57e36139c2593851ef861a0c36cc774333f7b
SSDEEP 49152:MPAgND8Flm7oSzW/j8LmN0XyZZwDzoNPmbR5Dkw7keLc349LzbuGHoLlMHVWb/dz:AKWQwi0PANP03y/Ll2WxoSMCCXQBcfG
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

74:13:3d:73:63:86:b4:8f:6a:5b:94:d8:5f:e3:3f:88:86:c4:1f:e2:55:49:24:d1:2b:b5:51:45:65:d2:58:09

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Seaga Manufacturing Inc,OU=Marketing,O=Seaga Manufacturing Inc,POSTALCODE=61032,STREET=700 Seaga Drive,L=Freeport,ST=Illinois,C=US

Chains

Aug 9, 2019

CN=Seaga Manufacturing Inc,OU=Marketing,O=Seaga Manufacturing Inc,POSTALCODE=61032,STREET=700 Seaga Drive,L=Freeport,ST=Illinois,C=US

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Seaga Manufacturing Inc,OU=Marketing,O=Seaga Manufacturing Inc,POSTALCODE=61032,STREET=700 Seaga Drive,L=Freeport,ST=Illinois,C=US

Serial Number

38:35:0a:b5:5e:c1:a1:06:8c:b1:f7:50:37:f5:c0:f2

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 14, 2019 - Jun 13, 2020

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

1066398

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Process32Next CloseHandle HeapAlloc Beep ExitProcess GetComputerNameW GetProcessHeap lstrcmpiA CreateProcessA CreateFileA GetLastError GetTickCount64 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree SetThreadExecutionState Sleep VerSetConditionMask FreeLibrary GetModuleHandleExW GetProcAddress LoadLibraryA FormatMessageW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount LoadLibraryExW GetModuleFileNameW GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType SetStdHandle GetConsoleOutputCP GetConsoleMode CreateDirectoryW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc CreateFileW HeapSize WriteConsoleW SetEndOfFile CreateToolhelp32Snapshot SetCurrentDirectoryA GetEnvironmentVariableA CreateMutexW WriteFile HeapFree Process32First QueryPerformanceFrequency RtlUnwind

user32

SetWindowPos GetWindowPlacement SetWindowPlacement BringWindowToTop SetFocus GetKeyState MapVirtualKeyW SetCapture ReleaseCapture SetForegroundWindow GetDC ReleaseDC SetPropW GetPropW RemovePropW GetClientRect AdjustWindowRectEx SetCursorPos SetCursor GetCursorPos ClientToScreen ScreenToClient WindowFromPoint SetRect OffsetRect PtInRect GetWindowLongW SetWindowLongW LoadCursorW DestroyIcon LoadImageW SystemParametersInfoW MonitorFromWindow GetMonitorInfoW GetRawInputData RegisterRawInputDevices GetRawInputDeviceInfoA GetRawInputDeviceList ChangeDisplaySettingsExW EnumDisplaySettingsW EnumDisplayDevicesW EnumDisplayMonitors RegisterDeviceNotificationW UnregisterDeviceNotification ToUnicode RegisterClassExW UnregisterClassW DefWindowProcW GetMessageTime PeekMessageW DispatchMessageW TranslateMessage TrackMouseEvent MessageBoxA ShowWindow DestroyWindow ClipCursor CreateWindowExW

gdi32

DeleteObject CreateDCW DeleteDC GetDeviceCaps SetDeviceGammaRamp ChoosePixelFormat DescribePixelFormat CreateRectRgn SetPixelFormat SwapBuffers

shell32

DragQueryFileW DragQueryPoint DragFinish DragAcceptFiles

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.5MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

172KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

999dad39fb145b82c731b5ac3b792c65fffd576effd972e8ab3f34423028269f

PE Signature issue

kernel32

user32

gdi32

shell32