061e14600a3666900fa283dbf83aeda7

Sharing

Copy URL Twitter E-mail

General

Target
061e14600a3666900fa283dbf83aeda7
Size 250KB
Sample231224-t422yaebc5
SHA256 204e010e4182b7ffd035af0f398e496540017d8712ca0b2de21ba5dc024c8532
MD5 061e14600a3666900fa283dbf83aeda7
SHA1 171e39ce729259d5d6a0c94d1516aade3f8d9604
SHA512 0074a9c7cff605f70279fa4a8e2b5a318a8ad2dd86b7e8a1ea3a2abf11117750cf8771e064440f36d8cc1d4a79adfdb6c2a25d6ce711a677d21c64a7b25c99fa
SSDEEP 6144:4r72S8iPKc/27KjT/ZwnNBTVOTBBUy3wqqwkMsWI:a72+Kc/XjT6jGAqqP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

061e14600a3666900fa283dbf83aeda7

.dll 250KB

061e14600a3666900fa283dbf83aeda7

IMPHASH 3da5902a4d91ae6e6919e3a669eb1d6a
SHA256 204e010e4182b7ffd035af0f398e496540017d8712ca0b2de21ba5dc024c8532
MD5 061e14600a3666900fa283dbf83aeda7
SHA1 171e39ce729259d5d6a0c94d1516aade3f8d9604
SHA512 0074a9c7cff605f70279fa4a8e2b5a318a8ad2dd86b7e8a1ea3a2abf11117750cf8771e064440f36d8cc1d4a79adfdb6c2a25d6ce711a677d21c64a7b25c99fa
SSDEEP 6144:4r72S8iPKc/27KjT/ZwnNBTVOTBBUy3wqqwkMsWI:a72+Kc/XjT6jGAqqP
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x64 arch:x64

PE Signature issue

Digest

ce:d3:d2:a1:01:93:ca:f3:1b:ec:cd:c4:3e:3e:44:f7:04:1d:4c:f2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=melondrea,O=melondrea,L=San Diego,ST=California,C=US

Chains

Jun 6, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=melondrea,O=melondrea,L=San Diego,ST=California,C=US

Serial Number

23:1d:7d:8e:bd:f7:b4:6c:48:24:d8:21:38:41:dd:70

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 4, 2014 - Jan 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

106640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

psapi

EnumProcessModules GetModuleBaseNameW

kernel32

GetThreadLocale WriteProfileStringW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection CloseHandle OpenProcess FlushInstructionCache GetCurrentProcess WideCharToMultiByte lstrlenA SetLastError lstrcmpW MulDiv GlobalUnlock GlobalLock GlobalAlloc GetProfileStringW LoadLibraryW HeapAlloc FlushFileBuffers CreateFileW WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer GetVolumeInformationW GetCurrentProcessId GetTickCount SetThreadLocale GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP HeapCreate GetVersion HeapSetInformation GetStdHandle WriteFile ExitProcess FlsAlloc FlsFree FlsGetValue TerminateProcess RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW GetCPInfo GetCommandLineA FlsSetValue GetSystemTimeAsFileTime RtlUnwindEx LoadLibraryExW FreeLibrary GetModuleFileNameW MultiByteToWideChar lstrcmpiW GetModuleHandleW GetProcAddress DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException FindResourceExW FindResourceW LoadResource LockResource SizeofResource QueryPerformanceCounter lstrlenW GetStringTypeW HeapFree RtlLookupFunctionEntry RtlPcToFileHeader DecodePointer EncodePointer InitializeCriticalSection Sleep LocalFree InterlockedPopEntrySList VirtualAlloc VirtualFree InterlockedPushEntrySList GetProcessHeap HeapSize HeapReAlloc HeapDestroy

user32

CharNextW UnregisterClassA GetParent GetWindowTextW GetWindowLongW GetWindowThreadProcessId GetClassNameW GetWindow CreateWindowExW SetTimer KillTimer IsWindow SendMessageW GetClassInfoExW CallNextHookEx GetForegroundWindow RegisterWindowMessageW GetWindowTextLengthW SetWindowTextW CreateAcceleratorTableW SetFocus GetFocus DestroyAcceleratorTable GetDesktopWindow BeginPaint EndPaint GetWindowLongPtrW CallWindowProcW FillRect ReleaseCapture GetDlgItem IsChild SetCapture RedrawWindow InvalidateRgn InvalidateRect ReleaseDC GetDC ScreenToClient ClientToScreen GetClientRect SetWindowPos MoveWindow SetWindowLongW GetSysColor SetWindowLongPtrW RegisterClassExW DefWindowProcW DestroyWindow LoadCursorW

gdi32

BitBlt GetStockObject GetObjectW CreateSolidBrush GetDeviceCaps DeleteObject CreateCompatibleDC CreateCompatibleBitmap DeleteDC SelectObject

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoCreateInstance OleRun CLSIDFromProgID CLSIDFromString StringFromGUID2 CoGetClassObject CreateStreamOnHGlobal OleInitialize OleUninitialize CoTaskMemFree CoTaskMemRealloc OleLockRunning CoTaskMemAlloc

oleaut32

SysFreeString SysAllocStringLen SysAllocString LoadTypeLi UnRegisterTypeLi RegisterTypeLi VarUI4FromStr VarBstrCmp VariantClear VariantCopy SysAllocStringByteLen SysStringByteLen LoadRegTypeLi VariantInit OleCreateFontIndirect SysStringLen

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.shared

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

061e14600a3666900fa283dbf83aeda7

PE Signature issue

psapi

kernel32

user32

gdi32

advapi32

ole32

oleaut32

iphlpapi

version

generic