9120ce3b64b1eea0eccc343744f4e8ff3bdc88b8a79743e07a975c6c313789ee

Sharing

Copy URL Twitter E-mail

General

Target
9120ce3b64b1eea0eccc343744f4e8ff3bdc88b8a79743e07a975c6c313789ee
Size 1.4MB
Sample240205-fw642abdh3
SHA256 9120ce3b64b1eea0eccc343744f4e8ff3bdc88b8a79743e07a975c6c313789ee
MD5 03c73bc08888500180c5dcc50dc51e74
SHA1 62081edc64c1d5aeb50811eae52b1804c7d25eec
SHA512 5214f6db8fef63ce9c5ef79eaa24716a1a57fd7142a5d297f0db843d6505d3229bf4422e4c3e5a6be72fadf72ac46228e9a4faa8fff232c7d824c30fdc8cd403
SSDEEP 24576:DD3s67L8bARsomDACvfJtSqmWnJqqCKoedFSKRUsxVttY/0CnjI/HXi:PX7M1AgJ0WJ+69RxVbY/0ij2Hy
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

9120ce3b64b1eea0eccc343744f4e8ff3bdc88b8a79743e07a975c6c313789ee

.exe 1.4MB

9120ce3b64b1eea0eccc343744f4e8ff3bdc88b8a79743e07a975c6c313789ee

IMPHASH 714858d86af7839c838d9f014dd17886
SHA256 9120ce3b64b1eea0eccc343744f4e8ff3bdc88b8a79743e07a975c6c313789ee
MD5 03c73bc08888500180c5dcc50dc51e74
SHA1 62081edc64c1d5aeb50811eae52b1804c7d25eec
SHA512 5214f6db8fef63ce9c5ef79eaa24716a1a57fd7142a5d297f0db843d6505d3229bf4422e4c3e5a6be72fadf72ac46228e9a4faa8fff232c7d824c30fdc8cd403
SSDEEP 24576:DD3s67L8bARsomDACvfJtSqmWnJqqCKoedFSKRUsxVttY/0CnjI/HXi:PX7M1AgJ0WJ+69RxVbY/0ij2Hy
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

b2:b0:67:d7:e8:2b:ff:82:9c:a4:bf:e7:8c:12:49:ec:53:54:df:f9:9d:80:e8:65:58:29:33:c5:78:3f:18:33

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=6703101,CN=Signal Messenger\, LLC,O=Signal Messenger\, LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Dec 22, 2023

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

Serial Number

40:4c:4c:82:ec:36:cb:93:79:60:06:88:51:7f:3d:c7

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 24, 2023 - Oct 24, 2024

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2021 - Dec 29, 2040

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Minor OS version

Major OS version

Entry point

106662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\7zsfxmm-51139022f6d790da60884077b63b2f265052be0b\Output\Win32\7ZSfxMod.pdb

comctl32

ord17

kernel32

GetProcAddress GetDiskFreeSpaceExW SetFileAttributesW Sleep CreateThread GetExitCodeThread GetLocalTime SystemTimeToFileTime GetStdHandle GetEnvironmentVariableW ExpandEnvironmentStringsW SetCurrentDirectoryW GetCurrentDirectoryW CompareFileTime CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW WriteFile GetTempPathW GetSystemTimeAsFileTime GetModuleHandleW LoadResource LockResource SizeofResource LoadLibraryA GlobalAlloc GlobalFree MulDiv lstrcmpW lstrcmpiA lstrcmpiW lstrlenA FindResourceExA MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetSystemDefaultLCID SetEnvironmentVariableW CreateFileA CreateFileW GetDriveTypeW GetCurrentProcess GetVersionExW VirtualProtect CreateFileMappingW MapViewOfFile FreeLibrary GetModuleFileNameW GetModuleHandleA SetProcessWorkingSetSize FreeConsole InitializeCriticalSection SetEvent ResetEvent CreateEventW GetCurrentThreadId TerminateThread SuspendThread GetSystemDirectoryW LocalFree FormatMessageW AssignProcessToJobObject IsBadReadPtr EnterCriticalSection LeaveCriticalSection DeleteCriticalSection VirtualAlloc VirtualFree GetFileSize ReadFile SetEndOfFile SetFilePointer SetFileTime GetFileInformationByHandle WaitForMultipleObjects RtlUnwind RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentProcessId InitializeSListHead TerminateProcess DecodePointer SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize GetStringTypeW WriteConsoleW SetStdHandle GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetFileType HeapReAlloc LCMapStringW CompareStringW HeapFree HeapAlloc GetACP GetCommandLineA GetModuleFileNameA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateJobObjectW GetStartupInfoW CreateProcessW ResumeThread SetInformationJobObject GetExitCodeProcess WaitForSingleObject GetQueuedCompletionStatus CreateIoCompletionPort SetLastError GetLastError CloseHandle GetCommandLineW lstrlenW GetTickCount lstrcpyW

user32

EnableMenuItem GetSystemMenu GetDC GetClientRect MessageBeep ClientToScreen PtInRect SetWindowLongW GetWindow DrawTextW EndDialog ShowWindow BringWindowToTop SendMessageW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx LoadIconW LoadImageW DrawIconEx SystemParametersInfoW GetSystemMetrics EnableWindow SetFocus GetDlgItem DialogBoxIndirectParamW IsWindow CreateWindowExA CallWindowProcW DefWindowProcW wvsprintfW MessageBoxA GetKeyState CopyImage GetClassNameA GetParent GetDesktopWindow GetWindowLongW GetSysColor ScreenToClient GetWindowRect GetWindowTextLengthW GetWindowTextW SetWindowTextW ReleaseDC GetWindowDC GetMenu KillTimer SetTimer CharUpperW SetWindowPos DestroyWindow CreateWindowExW DispatchMessageW wsprintfW wsprintfA GetMessageW

gdi32

SelectObject StretchBlt GetCurrentObject GetObjectW CreateFontIndirectW DeleteObject DeleteDC CreateCompatibleDC GetDeviceCaps SetStretchBltMode CreateCompatibleBitmap

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid

shell32

SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc ShellExecuteW SHGetSpecialFolderPathW ShellExecuteExW

ole32

CreateStreamOnHGlobal CoCreateInstance CoInitialize

oleaut32

SysAllocStringLen VariantClear SysAllocString SysFreeString OleLoadPicture

Sharing

General

Malware Config

Signatures

File Explorer

9120ce3b64b1eea0eccc343744f4e8ff3bdc88b8a79743e07a975c6c313789ee

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic