ca70689089743ce8155264da577210df[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ca70689089743ce8155264da577210df.exe
Size 1.1MB
Sample240225-l7cmfsaa7v
SHA256 6d4114742eb27a4e99c398904607bbfb07f91c2f2d25c921d888c0879f22d646
MD5 ca70689089743ce8155264da577210df
SHA1 e24d68e375625ab0eb59845272ed71088bc1de6f
SHA512 633528df5b92d985f5425a43ccb439b610d417aed26a4e547e00171e9a78472f7f015a0376db07e23d0cb5bcc07a32856ad8129a17658b4d2afa51f537604329
SSDEEP 24576:Cus8z4PUzQUbrnbqcnomja9g3hG3DzkvRMOApY3hw2mw:lsOZzFbqi/a9gmD4vR+Y3hwn
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

ca70689089743ce8155264da577210df.exe

.exe 1.1MB

ca70689089743ce8155264da577210df.exe

IMPHASH 2e838409987529c95afc2990bcd62f7c
SHA256 6d4114742eb27a4e99c398904607bbfb07f91c2f2d25c921d888c0879f22d646
MD5 ca70689089743ce8155264da577210df
SHA1 e24d68e375625ab0eb59845272ed71088bc1de6f
SHA512 633528df5b92d985f5425a43ccb439b610d417aed26a4e547e00171e9a78472f7f015a0376db07e23d0cb5bcc07a32856ad8129a17658b4d2afa51f537604329
SSDEEP 24576:Cus8z4PUzQUbrnbqcnomja9g3hG3DzkvRMOApY3hw2mw:lsOZzFbqi/a9gmD4vR+Y3hwn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

28:67:49:09:f4:d9:11:02:24:08:d4:6e:79:48:47:a8:5d:e0:04:5a:79:56:6f:f4:01:2a:c4:9c:9c:27:6c:0f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=08235567,CN=Piriform Software Ltd,O=Piriform Software Ltd,L=London,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 11, 2024

SERIALNUMBER=08235567,CN=Piriform Software Ltd,O=Piriform Software Ltd,L=London,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=08235567,CN=Piriform Software Ltd,O=Piriform Software Ltd,L=London,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=08235567,CN=Piriform Software Ltd,O=Piriform Software Ltd,L=London,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

06:80:33:ee:73:6c:dd:f1:7b:24:1b:41:e6:5e:f9:35

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 3, 2021 - Dec 4, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

122573

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

kernel32

SetLastError GetDiskFreeSpaceExW SetFileAttributesW Sleep GetExitCodeThread CreateThread SystemTimeToFileTime GetLocalTime GetFileAttributesW CreateDirectoryW lstrlenA WriteFile GetStdHandle GetModuleHandleW LockResource LoadResource SizeofResource FindResourceExA MulDiv GlobalFree GlobalAlloc lstrcmpiA GetSystemDefaultLCID GetSystemDefaultUILanguage GetUserDefaultUILanguage MultiByteToWideChar GetLocaleInfoW lstrcmpiW GetEnvironmentVariableW SetCurrentDirectoryW lstrcmpW RemoveDirectoryW FindClose FindNextFileW DeleteFileW FindFirstFileW GetCurrentDirectoryW GetTempPathW WideCharToMultiByte CompareFileTime ExpandEnvironmentStringsW GetSystemTimeAsFileTime SetThreadLocale LoadLibraryA SetEnvironmentVariableW CreateFileW GetDriveTypeW SetProcessWorkingSetSize GetCurrentProcess GetModuleFileNameW GetVersionExW LoadLibraryW CreateEventW SetEvent ResetEvent InitializeCriticalSection GetCurrentThreadId GetSystemDirectoryW TerminateThread SuspendThread GetCommandLineW LocalFree lstrcpyW FormatMessageW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection VirtualAlloc VirtualFree GetFileSize SetFilePointer ReadFile SetFileTime SetEndOfFile GetFileInformationByHandle WaitForMultipleObjects DecodePointer EncodePointer ExitThread RtlUnwind RaiseException HeapAlloc HeapFree HeapReAlloc GetCommandLineA HeapSetInformation HeapSize ExitProcess IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess InitializeCriticalSectionAndSpinCount HeapCreate GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetStringTypeW LCMapStringW GetStartupInfoW CreateProcessW GetLastError CreateJobObjectW ResumeThread AssignProcessToJobObject CreateIoCompletionPort SetInformationJobObject GetQueuedCompletionStatus WaitForSingleObject CloseHandle GetExitCodeProcess GetProcAddress lstrlenW GetTickCount IsBadReadPtr

user32

GetClientRect SetWindowLongW UnhookWindowsHookEx SetFocus GetSystemMetrics SystemParametersInfoW DrawTextW GetDC ClientToScreen GetWindow DialogBoxIndirectParamW DrawIconEx CallWindowProcW DefWindowProcW CallNextHookEx PtInRect SetWindowsHookExW LoadImageW LoadIconW MessageBeep EnableWindow GetDlgItem GetSystemMenu CreateWindowExA wvsprintfW wsprintfW GetParent ScreenToClient CreateWindowExW GetDesktopWindow GetWindowRect SetWindowPos SetTimer GetMessageW DispatchMessageW KillTimer CharUpperW SendMessageW ShowWindow BringWindowToTop EndDialog IsWindow GetKeyState MessageBoxA DestroyWindow GetSysColor SetWindowTextW GetWindowTextW GetWindowTextLengthW wsprintfA GetClassNameA GetWindowLongW GetMenu GetWindowDC ReleaseDC EnableMenuItem CopyImage

gdi32

SelectObject CreateCompatibleDC CreateCompatibleBitmap GetDeviceCaps DeleteObject CreateFontIndirectW SetStretchBltMode StretchBlt GetCurrentObject GetObjectW DeleteDC

advapi32

FreeSid AllocateAndInitializeSid CheckTokenMembership

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc ShellExecuteW SHGetSpecialFolderPathW ShellExecuteExW SHGetFileInfoW

ole32

CoInitialize CreateStreamOnHGlobal CoCreateInstance

oleaut32

OleLoadPicture SysAllocString SysAllocStringLen VariantClear SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

ca70689089743ce8155264da577210df.exe

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic