4701fb2b7ecbf0601fffccd7e860a799[.]exe

General

Target
4701fb2b7ecbf0601fffccd7e860a799.exe
Size 3.4MB
Sample231202-vfpblseb93
SHA256 f315eea03e667be683a181c91b52bc6222c86ee321d95c3483cfe855f2565a2e
MD5 4701fb2b7ecbf0601fffccd7e860a799
SHA1 40f2ceeddce232ce896d8453137f8d8feffa8d8a
SHA512 f3fed0ef67a297d6858cdcd075cdfb2352d545c955f73d76b0ab7740e69f0d3cbc65812d013f6cf1e9ae6faa6c905c7faa107e4b49f5b91a2b7c0e2e5582ffb5
SSDEEP 49152:xSw8/CwGED3t6a3vfdGcqetKYcmeayjoEs:Mwg3EQYo+jzs
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

4701fb2b7ecbf0601fffccd7e860a799.exe

.exe 3.4MB

4701fb2b7ecbf0601fffccd7e860a799.exe

IMPHASH 95f14e754579ec74ea735751105f4371
SHA256 f315eea03e667be683a181c91b52bc6222c86ee321d95c3483cfe855f2565a2e
MD5 4701fb2b7ecbf0601fffccd7e860a799
SHA1 40f2ceeddce232ce896d8453137f8d8feffa8d8a
SHA512 f3fed0ef67a297d6858cdcd075cdfb2352d545c955f73d76b0ab7740e69f0d3cbc65812d013f6cf1e9ae6faa6c905c7faa107e4b49f5b91a2b7c0e2e5582ffb5
SSDEEP 49152:xSw8/CwGED3t6a3vfdGcqetKYcmeayjoEs:Mwg3EQYo+jzs
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

db:0d:a2:5e:5a:8b:63:a6:ab:98:59:42:fc:37:71:9d:c2:d8:6d:0c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Chains

Jun 20, 2017

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Serial Number

08:4c:af:4d:f4:99:14:1d:40:4b:71:99:aa:2c:21:31

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 25, 2015 - Oct 3, 2018

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Minor OS version

0

Major OS version

6

Entry point

4621

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoGetObjectContext CoGetApartmentType

advapi32

RegCloseKey

kernel32

HeapSize CreateFileW CompareStringEx RaiseException InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA WideCharToMultiByte MultiByteToWideChar GetStringTypeW InitOnceBeginInitialize InitOnceComplete GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW RtlCaptureStackBackTrace IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW WriteConsoleW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW GetCurrentProcessId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess GetProcessHeap RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW GetCurrentThread HeapFree SetConsoleCtrlHandler GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW HeapReAlloc GetTimeZoneInformation OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle

Name

.text

Size

755KB

Virtual Size

755KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

803KB

Virtual Size

803KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4701fb2b7ecbf0601fffccd7e860a799.exe

PE Signature issue

ole32

advapi32

kernel32

generic