989ee5a9dfd78fc203161b3394e86f5c

General

Target
989ee5a9dfd78fc203161b3394e86f5c
Size 812KB
Sample240213-ge3kyshh57
SHA256 d53e9ef04a4700df76586787dab9692b2ff599d09ceb09ee93128edfe7876f4c
MD5 989ee5a9dfd78fc203161b3394e86f5c
SHA1 d25fae3b8c319b4b0f32f4c4dd9a82de70360bcb
SHA512 2b943a388a40f10d7ef0b3112661131ed3b4ddc23fc8c086d833a6b1351adf729f01b886a86a1af4e1f6e3fa61fd48462bad0023ba5ee09cacbbe4db3eb008bf
SSDEEP 12288:+0FGvMiMEW5rSCAmrA5o0FGvMiMEW5rSCAmrA5I0FGvMiMEW5rSCAmrA5:XiM75rtAtiM75rtAFiM75rtA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

989ee5a9dfd78fc203161b3394e86f5c

.dll 812KB

989ee5a9dfd78fc203161b3394e86f5c

IMPHASH 4f502593ca5fd63b006e08bf973901bf
SHA256 d53e9ef04a4700df76586787dab9692b2ff599d09ceb09ee93128edfe7876f4c
MD5 989ee5a9dfd78fc203161b3394e86f5c
SHA1 d25fae3b8c319b4b0f32f4c4dd9a82de70360bcb
SHA512 2b943a388a40f10d7ef0b3112661131ed3b4ddc23fc8c086d833a6b1351adf729f01b886a86a1af4e1f6e3fa61fd48462bad0023ba5ee09cacbbe4db3eb008bf
SSDEEP 12288:+0FGvMiMEW5rSCAmrA5o0FGvMiMEW5rSCAmrA5I0FGvMiMEW5rSCAmrA5:XiM75rtAtiM75rtAFiM75rtA
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

7d:27:32:24:4c:c0:f8:f8:b4:3e:47:54:91:8d:ad:79:21:b4:d2:3c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 12, 2024

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 23, 2002 - Sep 25, 2011

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:87:58:00:03:00:00:00:5a

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2005 - Apr 5, 2006

Minor OS version

2

Major OS version

5

Entry point

97622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

XactEngine2_0.pdb

msvcrt

??2@YAPAXI@Z floor wcslen _isnan _vsnwprintf _aligned_malloc _adjust_fdiv _aligned_free _initterm _CIpow _purecall free malloc ??3@YAXPAX@Z _except_handler3 wcscmp _controlfp

kernel32

HeapSize InterlockedDecrement InterlockedIncrement DisableThreadLibraryCalls GetLastError GetModuleFileNameA EnterCriticalSection LeaveCriticalSection GetTickCount HeapFree GetProcessHeap InterlockedCompareExchange GetCurrentThreadId HeapAlloc InitializeCriticalSection DeleteCriticalSection SetThreadPriority CreateSemaphoreW InterlockedExchange WaitForMultipleObjects CloseHandle WaitForSingleObject SetEvent CreateThread CreateEventA Sleep QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess IsProcessorFeaturePresent SetUnhandledExceptionFilter GetSystemInfo ReleaseSemaphore CreateEventW ReadFile SwitchToThread GetOverlappedResult UnhandledExceptionFilter

rpcrt4

RpcStringFreeA UuidToStringA

ole32

PropVariantCopy PropVariantClear CoTaskMemFree CoCreateInstance CoTaskMemAlloc CLSIDFromString

advapi32

RegCreateKeyExA RegEnumKeyA RegDeleteKeyA RegOpenKeyExA RegQueryValueExA RegCloseKey RegSetValueExA

user32

GetDesktopWindow

dsound

ord3 ord9 ord1

winmm

timeEndPeriod timeBeginPeriod

Sharing

General

Malware Config

Signatures

File Explorer

989ee5a9dfd78fc203161b3394e86f5c

PE Signature issue

msvcrt

kernel32

rpcrt4

ole32

advapi32

user32

dsound

winmm

generic