ad27c002c314717f78cadab27bf049cf[.]exe

resource
unpack001/$TEMP/Prev

ad27c002c314717f78cadab27bf049cf.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 ceb6b3d9b2ae0430495caaecedbdd494ff5cd44cb24780cbbb2863efa9386182
MD5 ad27c002c314717f78cadab27bf049cf
SHA1 8467513920df45cc742760f05fef909b54a95261
SHA512 a691790f69341f28173e6a83200480af952ca35af0724d670d8b4a52264c991cfb61ee6cc513615414a2864071244753b84122d493a67f2f73d47a2395e5255e
SSDEEP 24576:gbGdMU29P/8RLgad7P3BeJlDff4WGVF9kkzB:qG+xsZgg7fMJlDIVFTzB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

2c:dc:1f:ee:76:c4:d8:5e:aa:93:53:a5:e0:24:5c:65:0b:45:4c:a3:f9:fb:0c:82:44:78:2e:fb:ef:f8:99:e7

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Skype Software Sarl,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 11, 2024

CN=Skype Software Sarl,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

13613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$TEMP/Chorus

SHA256 68c92d709cd12a0decce387d841e41519f68979ff305aff68738a81e538c2434
MD5 6289f0044be469e5cc5d78425de1ecd2
SHA1 1633cbe5c9c79ff74cef4ef8d44221d16dc7c674
SHA512 256d3016d615d47f71f762b339ef842d1da613323aa8beb3b67afbb3271b5a5001e470d9331039fbf5600b87e49d40fe41af29dd96cdaef8af37dfee37c83f70
SSDEEP 6144:OFq/MnH4PQY8wNmtxjGdcFMk/IpyYaiu4:1yVGdv84
MD5 SHA1 SHA512 SSDEEP

$TEMP/Designation

SHA256 5ff84c86bbb50331fb0a8dda84591ff259d236aa54fb1c7e14e420e916d340cc
MD5 c1cc1aa18b9007c18d77d379897ca025
SHA1 64c85a49243812f66e0dd819129cb99ee10ef763
SHA512 791c7cdc14c4947460327d9cb4b9a524dcf948ece3f96446a0d8da8cd938922dcb5695a16b011ab7910581341ca1b0088dc1df7f45712dfdcb78a2058d56c310
SSDEEP 3072:J8NRCzqq/gNDCFPqWvMh5h92CjBf8QUnxoBVp:J8NRCzE9CY3h5h92QWQUxGp
MD5 SHA1 SHA512 SSDEEP

$TEMP/Eight

SHA256 d38464b74940765c78bf06478029f2366bfbca7c9b965c164efb2886e98c3d6a
MD5 521f2aed387524bdd7052bb4f23c0018
SHA1 7c57b9c934705f1ba9418840afef2f0af8e69168
SHA512 73366414419bb41c192a74f56a94c867d50187c24e07cc9ac33f4dbab31ea756671dc879a9bf78735596f8c96976fd595dd987702daadd9b8b25ea543a12c474
SSDEEP 1536:YWyu0uZo2+9BkxXiblenlJJyIE2UWb/hoQZ2OE3:YWy4ZNogXJ3i2Umb2Oq
MD5 SHA1 SHA512 SSDEEP

$TEMP/Latter

SHA256 dfab3a6b7e63339e8a23e9270cbbd49fa5d9efe42512339e1a7a915bd04d7b10
MD5 202cd0ed4d5a42ef36c223e2e041bae9
SHA1 814d8e675a6c57811052f1f116e51605f11c5c7a
SHA512 e66ab9d35dbc6cb593f90b31d739fd361bb2426f8137121b6f297663b970ba8e2ffd0e53e72d3137ce705ebee3f254646fc6d350b0fcb432276761b664f7cb60
SSDEEP 384:OcIIiDCEhU1Lav5FH5JHFGVVM0nOqrhp0njsJXjJHWn6VV2Nv6TXW:OcRY361GrH5BFGVO0nrrX0nj8XjBWn6S
MD5 SHA1 SHA512 SSDEEP

$TEMP/Objectives

SHA256 21cc51aee34eef0c66dbc4c633bedc390dba87482289b7a31e15806b9dfb60ad
MD5 93fc6d378cf9f3e4bd856b24e758032b
SHA1 23509fad0ad1dc5cead9b4f8e0efe2b1a52c2536
SHA512 e8304645ae862af43af2d8596626764420a4c6acaa4cb1a4a1eacab231a0351a04b1130609c34e8b2c58e13b97f048af5f97bcbcee8ace3eef9955228b57285e
SSDEEP 3072:n/33SrF7etHufKE5Kmqd1UhlqRWO/9EAehuqCB:/3mFygyE4mqd12lqlEAehuqe
MD5 SHA1 SHA512 SSDEEP

$TEMP/Place

SHA256 5db649df3c48e3e7e47f9bfa222fc229b4a000dadd9d12b83fde569ed2ee81a3
MD5 9ea9a13f6966bda0647d6f83f6d257fb
SHA1 36d5c6d95368508c5878bf08e2a2bc753aaf7aec
SHA512 4c3a3359777a16c190973eefd001e166f76dee32482493b0da2c635b90a143aef35a36101ff66daa1b60eeaec945c3d93a8d82b51cc8a70e48bc6b9c3199db2a
SSDEEP 384:7GllELAN54L8RD1APZpwk5AG8n7uiQalnvfrfGNp3zuDGS:2IEkHZ5ATdlnijut
MD5 SHA1 SHA512 SSDEEP

$TEMP/Planning

SHA256 fb7337b18c69464c4c84b9ecb69d62f6f693460c86d0e5ab3586c315c59cac97
MD5 9bb02422262416ba9e804e520ab576be
SHA1 3d6b62a8f9d8d846c8e05495819b5320ada507c6
SHA512 febc9d3221329aa1150dc3b1b81afe858634bb3a096939ae5cbef87d9c7dc3613265baf1e40befac34798ac186802d17437f04cadff4b3ade71332647ece10e9
SSDEEP 6144:HHPOGUWLhxjRYmFqZvEAOz04pmdV364EgarxU8:HHPOGNnlMZce4wdV5Egae8
MD5 SHA1 SHA512 SSDEEP

$TEMP/Prev

SHA256 d4dce3c852197709b13ad7a426d2e515d3d7d0d52d79d4b1de7f3c8e5f881ff3
MD5 8d019b45973901b4854eec33096d05c0
SHA1 1dfb37a78659ba3917c6479ead9c9f645bbb8331
SHA512 9e23a4d76c707476e0c342dc6468c153571a5e1a106397d80c8ade95682119bd3bfe45ba803521327d61d926c14bcb3b61fd1869de4881956453a53183e98af1
SSDEEP 3072:pPpU08BjlWTPJth26X7Sn4UfpLUNN9t68cCWlrss4M5iRq3U0Pe3vHU4Sm:LQBk7JjX74cN0lrztgwU0Wym
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.