a92600401b2208365115b27e42e6cb0a[.]exe

General

Target
a92600401b2208365115b27e42e6cb0a.exe
Size 3.4MB
Sample231202-ya8d3sfd4t
SHA256 74261118be5c00855661ab511b8a029393a87bdeecdd28cf59e97f7afcbceac6
MD5 a92600401b2208365115b27e42e6cb0a
SHA1 34da5204b27075603fb440a98ab3bc87b00085a5
SHA512 182075e931c37ff94336bc37e3e9a39464ef07501a79f9bcfa272a27cc382e2a72dfe157afb1626ea36b3a0dab44dac7fb0a39aaaea047b768fa7bd4a49c0d09
SSDEEP 49152:7RwN/i6GkKHp6a3vsVajkb5xJ5JW6nAXeuJXM8aRHyaeZ1:VwaHQBVajkb5xJ5JW6nSeuJc8OHyaeZ1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

a92600401b2208365115b27e42e6cb0a.exe

.exe 3.4MB

a92600401b2208365115b27e42e6cb0a.exe

IMPHASH 95f14e754579ec74ea735751105f4371
SHA256 74261118be5c00855661ab511b8a029393a87bdeecdd28cf59e97f7afcbceac6
MD5 a92600401b2208365115b27e42e6cb0a
SHA1 34da5204b27075603fb440a98ab3bc87b00085a5
SHA512 182075e931c37ff94336bc37e3e9a39464ef07501a79f9bcfa272a27cc382e2a72dfe157afb1626ea36b3a0dab44dac7fb0a39aaaea047b768fa7bd4a49c0d09
SSDEEP 49152:7RwN/i6GkKHp6a3vsVajkb5xJ5JW6nAXeuJXM8aRHyaeZ1:VwaHQBVajkb5xJ5JW6nSeuJc8OHyaeZ1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

47:cb:db:64:2e:e0:9a:94:6d:d4:ef:02:c5:79:96:19:e7:7f:1c:a1

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Chains

Jun 20, 2017

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Serial Number

08:4c:af:4d:f4:99:14:1d:40:4b:71:99:aa:2c:21:31

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 25, 2015 - Oct 3, 2018

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Minor OS version

0

Major OS version

6

Entry point

4621

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoGetObjectContext CoGetApartmentType

advapi32

RegCloseKey

kernel32

HeapSize CreateFileW CompareStringEx RaiseException InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA WideCharToMultiByte MultiByteToWideChar GetStringTypeW InitOnceBeginInitialize InitOnceComplete GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW RtlCaptureStackBackTrace IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW WriteConsoleW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW GetCurrentProcessId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess GetProcessHeap RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW GetCurrentThread HeapFree SetConsoleCtrlHandler GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW HeapReAlloc GetTimeZoneInformation OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle

Name

.text

Size

755KB

Virtual Size

755KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

803KB

Virtual Size

803KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a92600401b2208365115b27e42e6cb0a.exe

PE Signature issue

ole32

advapi32

kernel32

generic