576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2

Resubmissions

02/03/2024, 23:44

240302-3rekjsah777

02/03/2024, 23:44

02/03/2024, 23:41

02/03/2024, 23:40

02/03/2024, 23:33

Sharing

Copy URL Twitter E-mail

General

Target
576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2
Size 807KB
Sample240302-3rekjsah77
SHA256 576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2
MD5 878778e2e88e75490dbb137bb293e742
SHA1 a5b965521405ab351d07c91299d8a99d113b9491
SHA512 998728261ac8e3f81a1cbbfe4fb25d655f867727b7395118be5fd1ff72848c2d5a668cc6177d3473ec576e0e9eddd67c0fe022b5bc85d6c1fefaeee4f6e38e9a
SSDEEP 24576:+lF7wSx6dH/hR6rLEMRxonoLq3FimRrEH7mB:8uSQvR6xrooLqVimXB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2

.exe 807KB

576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2

IMPHASH 0f0a1d367a8f61d34f6d094373fd00e0
SHA256 576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2
MD5 878778e2e88e75490dbb137bb293e742
SHA1 a5b965521405ab351d07c91299d8a99d113b9491
SHA512 998728261ac8e3f81a1cbbfe4fb25d655f867727b7395118be5fd1ff72848c2d5a668cc6177d3473ec576e0e9eddd67c0fe022b5bc85d6c1fefaeee4f6e38e9a
SSDEEP 24576:+lF7wSx6dH/hR6rLEMRxonoLq3FimRrEH7mB:8uSQvR6xrooLqVimXB
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

4d:81:43:13:94:4e:b7:da:ed:ff:27:e6:8f:fb:a5:5c:ca:c0:d2:b4:6f:34:3f:11:e8:0f:f6:72:27:59:19:10

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Chains

Oct 4, 2023

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Serial Number

06:0e:2f:8f:9e:1b:8b:e5:18:d5:fe:2b:69:cf:cc:b1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 9, 2023 - Mar 11, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

266966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CLSIDFromString StringFromGUID2 IIDFromString OleRun CoUninitialize CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance

shell32

Shell_NotifyIconA ShellExecuteA SHGetFolderPathW

wininet

InternetTimeFromSystemTime InternetTimeToSystemTime InternetCrackUrlA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetErrorDlg

user32

MessageBoxW GetDesktopWindow IsWindowUnicode MsgWaitForMultipleObjectsEx ShowWindow DestroyWindow GetSystemMetrics wsprintfA CharNextA LoadStringA GetMessageA GetMessageW TranslateMessage DispatchMessageA DispatchMessageW PeekMessageA PostMessageA DefWindowProcA PostQuitMessage RegisterClassA LoadImageA SetWindowLongA GetWindowLongA GetCursorPos SetForegroundWindow TrackPopupMenu AppendMenuA CreatePopupMenu CreateWindowExA

version

GetFileVersionInfoA VerQueryValueW GetFileVersionInfoSizeA

kernel32

VirtualAlloc GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind InitializeSListHead GetSystemTimeAsFileTime VirtualQuery GetModuleHandleW GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringEx EncodePointer InitializeCriticalSectionEx GetStringTypeW GetConsoleOutputCP GetConsoleMode GetFileType GetDriveTypeW VirtualProtect GetFullPathNameW CreateDirectoryW QueryPerformanceCounter GetFileInformationByHandle SetStdHandle GetModuleFileNameW GetStdHandle GetCommandLineA DecodePointer CloseHandle RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection WaitForSingleObject CreateMutexA CreateEventA WaitForMultipleObjects FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryExA LoadResource SizeofResource lstrcmpA lstrcmpiA lstrcatA lstrlenA HeapFree SetDllDirectoryA SystemTimeToTzSpecificLocalTime MultiByteToWideChar WideCharToMultiByte IsDBCSLeadByte SetEvent ResetEvent CreateThread lstrcpyA lstrcpynA CreateFileA WriteFile OpenEventA Sleep DeleteFileA GetTempPathA GetCurrentProcess GetVersionExA LocalFree ReadFile FileTimeToSystemTime GetCurrentProcessId GetCurrentThreadId GetLocalTime FormatMessageW GetEnvironmentVariableA FindClose ExitProcess TerminateProcess GetSystemDirectoryA LockResource LoadLibraryA LocalAlloc FormatMessageA GetCommandLineW SetLastError GetNativeSystemInfo GetModuleHandleExW SetHandleInformation CreatePipe PeekNamedPipe GetExitCodeProcess CreateProcessA SetEndOfFile SetFilePointerEx GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage GetFileAttributesA HeapAlloc GetModuleHandleExA LoadLibraryW LoadLibraryExW OpenMutexA CreateFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection IsDebuggerPresent OutputDebugStringW HeapSize HeapReAlloc GetTimeZoneInformation CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetFileSizeEx ReadConsoleW GetCurrentDirectoryW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW FindResourceA

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyA CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegQueryValueExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExA RegQueryInfoKeyW RegOpenKeyExA RegNotifyChangeKeyValue RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegCloseKey

oleaut32

VariantClear VariantChangeType GetErrorInfo VariantInit SysFreeString VarUI4FromStr SysAllocString SysStringByteLen SysAllocStringByteLen

shlwapi

ord12

gdi32

GetStockObject

crypt32

CryptUnprotectData CryptProtectData CryptStringToBinaryA CryptBinaryToStringA

msi

ord189 ord31 ord159 ord158 ord91 ord117 ord115 ord160 ord44 ord204 ord168 ord137 ord141 ord8 ord67

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2

PE Signature issue

ole32

shell32

wininet

user32

version

kernel32

advapi32

oleaut32

shlwapi

gdi32

crypt32

msi

generic