00ef6c222a46ee8038da0783c67926a8

Sharing

Copy URL Twitter E-mail

General

Target
00ef6c222a46ee8038da0783c67926a8
Size 381KB
Sample231225-dax8wsdcek
SHA256 e7d084a2b1342a0f93de8e44a4d7292fa39e0ea8eb72a4bacc7acb0e1dcc5f15
MD5 00ef6c222a46ee8038da0783c67926a8
SHA1 534fd700bc0a24af32756317bb79258825afa084
SHA512 34ea9cf4139b3f71b01c3b9b95badd2b82d9ccb8035b035cfdeeb347a062add6093c69eff50b71ff126824592a83dc67027c54cd79eb09b967ffb6921848d890
SSDEEP 6144:O7lHHkK6zwKlRoDbxJv4R07DMSb4g/2taVz:OBnkHEKKbxJv4CfMSM02tU
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

00ef6c222a46ee8038da0783c67926a8

.exe 381KB

00ef6c222a46ee8038da0783c67926a8

IMPHASH 88abcbd1a51141f0301cfd296d17116b
SHA256 e7d084a2b1342a0f93de8e44a4d7292fa39e0ea8eb72a4bacc7acb0e1dcc5f15
MD5 00ef6c222a46ee8038da0783c67926a8
SHA1 534fd700bc0a24af32756317bb79258825afa084
SHA512 34ea9cf4139b3f71b01c3b9b95badd2b82d9ccb8035b035cfdeeb347a062add6093c69eff50b71ff126824592a83dc67027c54cd79eb09b967ffb6921848d890
SSDEEP 6144:O7lHHkK6zwKlRoDbxJv4R07DMSb4g/2taVz:OBnkHEKKbxJv4CfMSM02tU
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

07:3f:fb:87:6a:fa:34:33:91:1b:a4:b5:51:43:56:d1

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 3, 2007 - Jul 2, 2008

Minor OS version

Major OS version

Entry point

112390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

imm32

ImmDisableIME

kernel32

CreateFileMappingW OpenFileMappingW LocalFree FindFirstFileW FindClose OpenMutexW GetCurrentThreadId ReleaseMutex CreateMutexW WaitForSingleObject MoveFileExW GetVersionExW GetModuleFileNameW ReadFile GetTickCount QueryPerformanceFrequency InterlockedExchangeAdd Sleep CreateThread InterlockedExchange GetFileSize GetProcAddress InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree GetSystemTimeAsFileTime GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoW RtlUnwind RaiseException GetTimeZoneInformation GetCPInfo LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetFullPathNameW GetCurrentDirectoryA UnmapViewOfFile SetHandleCount GetStdHandle GetFileType GetStartupInfoA WriteFile GetConsoleCP GetConsoleMode SetFilePointer GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc FlushFileBuffers GetACP GetOEMCP IsValidCodePage ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW QueryPerformanceCounter GetCurrentProcessId HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LoadLibraryA GetLocaleInfoW CreateFileA GetDriveTypeA SetEndOfFile CompareStringA CompareStringW SetEnvironmentVariableA MapViewOfFile CreateFileW CloseHandle WideCharToMultiByte MultiByteToWideChar CopyFileW CreateDirectoryW DeleteFileW GetLastError

user32

MessageBoxW

advapi32

RegQueryValueW SetEntriesInAclW SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW GetNamedSecurityInfoW GetSecurityInfo SetNamedSecurityInfoW BuildExplicitAccessWithNameW GetSecurityDescriptorSacl RegOpenKeyExW RegCloseKey

shell32

SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

00ef6c222a46ee8038da0783c67926a8

PE Signature issue

imm32

kernel32

user32

advapi32

shell32

generic