260966803c8614ea174bb98629e5bdaf

Sharing

Copy URL Twitter E-mail

General

Target
260966803c8614ea174bb98629e5bdaf
Size 250KB
Sample231231-dscpxafgfp
SHA256 06107f240e7e41c14455d3d8913ecf30e03e1eace20a84da939d8f72d87a1f35
MD5 260966803c8614ea174bb98629e5bdaf
SHA1 2e44ddc92c957a1e1d3982d38c155e810a02f3d0
SHA512 ac9ce2c6d627b2aa2e63d310866e44e278a65d9a0d17e3c6846b76e94c751e577d093ab667895646b38a537fbad81735fa472b7abb5a58eb87f13af72a636019
SSDEEP 6144:mr72S8iPKc/27KjT/ZwnNBTVOTBBUy3wqqwkMsB:472+Kc/XjT6jGAqqj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

260966803c8614ea174bb98629e5bdaf

.dll 250KB

260966803c8614ea174bb98629e5bdaf

IMPHASH 3da5902a4d91ae6e6919e3a669eb1d6a
SHA256 06107f240e7e41c14455d3d8913ecf30e03e1eace20a84da939d8f72d87a1f35
MD5 260966803c8614ea174bb98629e5bdaf
SHA1 2e44ddc92c957a1e1d3982d38c155e810a02f3d0
SHA512 ac9ce2c6d627b2aa2e63d310866e44e278a65d9a0d17e3c6846b76e94c751e577d093ab667895646b38a537fbad81735fa472b7abb5a58eb87f13af72a636019
SSDEEP 6144:mr72S8iPKc/27KjT/ZwnNBTVOTBBUy3wqqwkMsB:472+Kc/XjT6jGAqqj
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x64 arch:x64

PE Signature issue

Digest

ce:d3:d2:a1:01:93:ca:f3:1b:ec:cd:c4:3e:3e:44:f7:04:1d:4c:f2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Air Globe,O=Air Globe,L=San Diego,ST=California,C=US

Chains

Jul 10, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Air Globe,O=Air Globe,L=San Diego,ST=California,C=US

Serial Number

0c:68:ef:a7:25:db:81:10:ce:80:74:89:da:c0:35:53

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 11, 2015 - Jan 11, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

106640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

psapi

EnumProcessModules GetModuleBaseNameW

kernel32

GetThreadLocale WriteProfileStringW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection CloseHandle OpenProcess FlushInstructionCache GetCurrentProcess WideCharToMultiByte lstrlenA SetLastError lstrcmpW MulDiv GlobalUnlock GlobalLock GlobalAlloc GetProfileStringW LoadLibraryW HeapAlloc FlushFileBuffers CreateFileW WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer GetVolumeInformationW GetCurrentProcessId GetTickCount SetThreadLocale GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP HeapCreate GetVersion HeapSetInformation GetStdHandle WriteFile ExitProcess FlsAlloc FlsFree FlsGetValue TerminateProcess RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW GetCPInfo GetCommandLineA FlsSetValue GetSystemTimeAsFileTime RtlUnwindEx LoadLibraryExW FreeLibrary GetModuleFileNameW MultiByteToWideChar lstrcmpiW GetModuleHandleW GetProcAddress DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException FindResourceExW FindResourceW LoadResource LockResource SizeofResource QueryPerformanceCounter lstrlenW GetStringTypeW HeapFree RtlLookupFunctionEntry RtlPcToFileHeader DecodePointer EncodePointer InitializeCriticalSection Sleep LocalFree InterlockedPopEntrySList VirtualAlloc VirtualFree InterlockedPushEntrySList GetProcessHeap HeapSize HeapReAlloc HeapDestroy

user32

CharNextW UnregisterClassA GetParent GetWindowTextW GetWindowLongW GetWindowThreadProcessId GetClassNameW GetWindow CreateWindowExW SetTimer KillTimer IsWindow SendMessageW GetClassInfoExW CallNextHookEx GetForegroundWindow RegisterWindowMessageW GetWindowTextLengthW SetWindowTextW CreateAcceleratorTableW SetFocus GetFocus DestroyAcceleratorTable GetDesktopWindow BeginPaint EndPaint GetWindowLongPtrW CallWindowProcW FillRect ReleaseCapture GetDlgItem IsChild SetCapture RedrawWindow InvalidateRgn InvalidateRect ReleaseDC GetDC ScreenToClient ClientToScreen GetClientRect SetWindowPos MoveWindow SetWindowLongW GetSysColor SetWindowLongPtrW RegisterClassExW DefWindowProcW DestroyWindow LoadCursorW

gdi32

BitBlt GetStockObject GetObjectW CreateSolidBrush GetDeviceCaps DeleteObject CreateCompatibleDC CreateCompatibleBitmap DeleteDC SelectObject

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoCreateInstance OleRun CLSIDFromProgID CLSIDFromString StringFromGUID2 CoGetClassObject CreateStreamOnHGlobal OleInitialize OleUninitialize CoTaskMemFree CoTaskMemRealloc OleLockRunning CoTaskMemAlloc

oleaut32

SysFreeString SysAllocStringLen SysAllocString LoadTypeLi UnRegisterTypeLi RegisterTypeLi VarUI4FromStr VarBstrCmp VariantClear VariantCopy SysAllocStringByteLen SysStringByteLen LoadRegTypeLi VariantInit OleCreateFontIndirect SysStringLen

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.shared

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

260966803c8614ea174bb98629e5bdaf

PE Signature issue

psapi

kernel32

user32

gdi32

advapi32

ole32

oleaut32

iphlpapi

version

generic