00c906d0d6994e9d0dfc5b7b3dad5a56

General

Target
00c906d0d6994e9d0dfc5b7b3dad5a56
Size 348KB
Sample231229-xcaedscegn
SHA256 33d742eb4befb411b0ce2be7f7de5850792f7f57ce3c7b1fdaab9ceb68a8f633
MD5 00c906d0d6994e9d0dfc5b7b3dad5a56
SHA1 1af3e52d75d1889999df479a0241342b13e10b63
SHA512 6270044b5c540743d4c4b91cd3bb3fd1c6118cbadfdc38334cd0e43ff079ba71feddfee77648bc71d5d469feb10a6999f6efe34384a0c0b04f9e31287ef6049a
SSDEEP 6144:gOr4eNG1j6/IPXsHuYHZXtvyyh9j2f9+zRVr4er3x5q5WNmWOZv5Mp2Rwe:hXij6APX3YHZXt6yLaA3rPYWgWsv57Rf
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

00c906d0d6994e9d0dfc5b7b3dad5a56

.exe 348KB

00c906d0d6994e9d0dfc5b7b3dad5a56

IMPHASH 61341387e3ce2ad06f049c03ebf5f67d
SHA256 33d742eb4befb411b0ce2be7f7de5850792f7f57ce3c7b1fdaab9ceb68a8f633
MD5 00c906d0d6994e9d0dfc5b7b3dad5a56
SHA1 1af3e52d75d1889999df479a0241342b13e10b63
SHA512 6270044b5c540743d4c4b91cd3bb3fd1c6118cbadfdc38334cd0e43ff079ba71feddfee77648bc71d5d469feb10a6999f6efe34384a0c0b04f9e31287ef6049a
SSDEEP 6144:gOr4eNG1j6/IPXsHuYHZXtvyyh9j2f9+zRVr4er3x5q5WNmWOZv5Mp2Rwe:hXij6APX3YHZXt6yLaA3rPYWgWsv57Rf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

39:34:52:31:cb:d0:01:7b:2b:ae:9f:95:c1:a0:c9:62:0c:85:45:78

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=LTD „ATAS”,O=LTD „ATAS”,L=Riga,C=LV

Chains

Feb 12, 2020

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=LTD „ATAS”,O=LTD „ATAS”,L=Riga,C=LV

Serial Number

4e:82:45:62:9f:54:9d:53:b1:61:fa:29:f3:25:f8:4e

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 6, 2020 - Feb 5, 2022

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - May 30, 2020

Minor OS version

0

Major OS version

5

Entry point

8416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCommandLineW GetThreadContext FileTimeToDosDateTime EnumResourceNamesW GetNativeSystemInfo lstrlenA GetConsoleAliasesLengthW CopyFileExW TlsGetValue GetDriveTypeW SetEndOfFile InterlockedIncrement GetCommState InterlockedDecrement GetSystemWindowsDirectoryW GetNamedPipeHandleStateA WaitForSingleObject SetEvent FreeEnvironmentStringsA GetModuleHandleW GetTickCount GetSystemTimeAsFileTime GetPrivateProfileStringW WriteFile GetPriorityClass FindResourceExA GetPrivateProfileIntA LoadLibraryW GetConsoleMode CopyFileW GetVersionExW SetConsoleMode SetConsoleCursorPosition IsDBCSLeadByte GetOverlappedResult GetStartupInfoW GlobalUnlock LCMapStringA GetFileSizeEx GetCPInfoExW GetLastError SetLastError GetProcAddress VirtualAlloc OpenMutexA LocalAlloc IsSystemResumeAutomatic SetCurrentDirectoryW WriteProfileSectionW HeapWalk FindAtomA Process32NextW CreateIoCompletionPort FindFirstChangeNotificationA FreeEnvironmentStringsW CompareStringA FatalAppExitA GetCurrentThreadId SetThreadAffinityMask OpenSemaphoreW DeleteFileW ReadConsoleOutputCharacterW GetSystemTime FlushFileBuffers UnhandledExceptionFilter SetUnhandledExceptionFilter MultiByteToWideChar HeapValidate IsBadReadPtr RaiseException Sleep ExitProcess GetModuleFileNameA GetStdHandle TlsAlloc TlsSetValue TlsFree TerminateProcess GetCurrentProcess IsDebuggerPresent GetModuleFileNameW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetACP GetOEMCP GetCPInfo IsValidCodePage QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate HeapFree VirtualFree HeapAlloc HeapSize HeapReAlloc LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind SetFilePointer WideCharToMultiByte GetConsoleCP DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP CreateFileA CloseHandle GetModuleHandleA

user32

GetTitleBarInfo

winhttp

WinHttpReadData

Sharing

General

Malware Config

Signatures

File Explorer

00c906d0d6994e9d0dfc5b7b3dad5a56

PE Signature issue

kernel32

user32

winhttp

generic