3cc606fe81fc547459587cc217b3ea6c

Sharing

Copy URL Twitter E-mail

General

Target
3cc606fe81fc547459587cc217b3ea6c
Size 388KB
Sample231225-zyfveacdbk
SHA256 2064f93a1a6177c68c6d2c50c8fdaf26d1b3b62650aca9bc20bad8121d55367f
MD5 3cc606fe81fc547459587cc217b3ea6c
SHA1 d631f8b6349bcd96ad179d5ef1eb106659623e5e
SHA512 634868c0abb9ff1dcce2f8c96651da11fd29dfa4a8c170601e4ef048f55f9614d54ec979b18c535b9d3b51479fdc4a87c8b47a64d57d132fe6b942685b9c0104
SSDEEP 6144:KQ3/9nM3DoFFjuvf/toNQ8dqLuJoU0U7Hd8CntQOHHM+HFFTjXdpNnT2wdQ3/nQd:X9nM3D0Fw/tN8dkmLtpHHHrh7kC1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

3cc606fe81fc547459587cc217b3ea6c

.exe 388KB

3cc606fe81fc547459587cc217b3ea6c

IMPHASH e42c0ba5350d48c9fb666ff52855f8ec
SHA256 2064f93a1a6177c68c6d2c50c8fdaf26d1b3b62650aca9bc20bad8121d55367f
MD5 3cc606fe81fc547459587cc217b3ea6c
SHA1 d631f8b6349bcd96ad179d5ef1eb106659623e5e
SHA512 634868c0abb9ff1dcce2f8c96651da11fd29dfa4a8c170601e4ef048f55f9614d54ec979b18c535b9d3b51479fdc4a87c8b47a64d57d132fe6b942685b9c0104
SSDEEP 6144:KQ3/9nM3DoFFjuvf/toNQ8dqLuJoU0U7Hd8CntQOHHM+HFFTjXdpNnT2wdQ3/nQd:X9nM3D0Fw/tN8dkmLtpHHHrh7kC1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e4:52:48:3a:a1:f5:c0:f9:60:c6:2a:b9:81:f7:85:da:62:2d:26:51

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Positive Finds,O=Positive Finds,L=San Diego,ST=California,C=US

Chains

Feb 12, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Positive Finds,O=Positive Finds,L=San Diego,ST=California,C=US

Serial Number

36:c4:7a:2c:ba:b8:82:a6:50:f1:e1:b7:d4:be:3a:45

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 5, 2014 - Nov 5, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

12772

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread LoadLibraryA CreateProcessA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion RemoveDirectoryA CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

ScreenToClient GetMessagePos CallWindowProcA IsWindowVisible LoadBitmapA CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuA CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos CheckDlgButton GetClassInfoA CreateWindowExA SystemParametersInfoA RegisterClassA SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA LoadCursorA SetCursor GetWindowLongA GetSysColor CharNextA DialogBoxParamA ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderA SHGetPathFromIDListA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegEnumKeyA RegOpenKeyExA RegCloseKey RegDeleteKeyA RegDeleteValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumValueA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

3cc606fe81fc547459587cc217b3ea6c

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic