N360-ESD-22[.]20[.]5[.]39-EN[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
N360-ESD-22.20.5.39-EN.exe
Size 182.6MB
Sample240323-h924caee78
SHA256 bb25d8e75f97ec0040a30361fade5f5fb17cb282502928f5e4344b7193490974
MD5 c179f7d042f45101ff3a198004514cf4
SHA1 94ae03eedcfb23fcebbee53f6120d601d6e5a9fe
SHA512 a39976e86735c266a6d7e7a22d7b1762c8f03dfa2e95528f9cda46de96e889594f327efd1a23717058d16e549ba4abb1f13f7765cafcc662969ac8dbacaaedaa
SSDEEP 3145728:OX39GeVIqEhI3o4dwuG2Z/0peaElPssxz9jzPhfl7DotpZbY8GClJsgWCZ2QCptW:G3EYIE5dG0iFvEz9JFDupZbIe9WCZ2QN
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

N360-ESD-22.20.5.39-EN.exe

.exe 182.6MB

N360-ESD-22.20.5.39-EN.exe

IMPHASH 087816dc41b684e89380905ce933b772
SHA256 bb25d8e75f97ec0040a30361fade5f5fb17cb282502928f5e4344b7193490974
MD5 c179f7d042f45101ff3a198004514cf4
SHA1 94ae03eedcfb23fcebbee53f6120d601d6e5a9fe
SHA512 a39976e86735c266a6d7e7a22d7b1762c8f03dfa2e95528f9cda46de96e889594f327efd1a23717058d16e549ba4abb1f13f7765cafcc662969ac8dbacaaedaa
SSDEEP 3145728:OX39GeVIqEhI3o4dwuG2Z/0peaElPssxz9jzPhfl7DotpZbY8GClJsgWCZ2QCptW:G3EYIE5dG0iFvEz9JFDupZbIe9WCZ2QN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

3c:b2:79:53:39:c6:ca:c4:1b:bc:d8:b9:90:77:37:20:a9:ee:70:45:a9:48:ad:ef:a2:66:3a:ac:85:a5:52:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Symantec Corporation,OU=CBU,O=Symantec Corporation,L=Mountain View,ST=California,C=US

Chains

Jul 24, 2020

CN=Symantec Corporation,OU=CBU,O=Symantec Corporation,L=Mountain View,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

35:ba:e6:0f:32:6f:c3:c8:a4:36:bf:72:40:35:5e:03:2c:71:93:08

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Symantec Corporation,OU=CBU,O=Symantec Corporation,L=Mountain View,ST=California,C=US

Chains

Jul 24, 2020

Subject

CN=Symantec Corporation,OU=CBU,O=Symantec Corporation,L=Mountain View,ST=California,C=US

Serial Number

04:00:36:d3:e2:d9:6c:76:6a:1c:65:a0:0d:54:04:3d

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 26, 2019 - Oct 27, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Symantec Corporation,OU=CBU,O=Symantec Corporation,L=Mountain View,ST=California,C=US

Serial Number

3d:71:93:85:96:ca:86:6e:22:65:79:7a:fc:f0:f2:4f

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 27, 2019 - Oct 27, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2014 - Jul 21, 2024

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

Major OS version

Entry point

557201

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\bld_area\InstallToolBox_r11.25.0_60\VS141\Bin\Win32\Release\MiniStub.pdb

secur32

LsaGetLogonSessionData LsaFreeReturnBuffer LsaEnumerateLogonSessions

kernel32

InitializeCriticalSectionAndSpinCount QueryDosDeviceW ReadFile GetFileSize SetFilePointer SetLastError SetDllDirectoryW DecodePointer GetCurrentThreadId SetErrorMode InitializeCriticalSectionEx RaiseException IsProcessorFeaturePresent CreateDirectoryW GetCurrentProcessId GetSystemDefaultLangID GetUserDefaultLangID GetCommandLineW MoveFileW SetCurrentDirectoryW GetModuleFileNameW lstrcmpW lstrcpyW GetSystemDirectoryW Process32NextW Process32FirstW CreateToolhelp32Snapshot CopyFileW FindNextFileW FindFirstFileW MoveFileExW RemoveDirectoryW SetFileAttributesW CreateProcessW FindClose GetLocalTime Sleep GetTickCount DeleteFileW GetCurrentProcess DuplicateHandle SetPriorityClass GetPriorityClass GetModuleHandleW LocalFree GetShortPathNameW GetTempPathW lstrcmpiW lstrlenW WideCharToMultiByte LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection ProcessIdToSessionId FormatMessageW LocalAlloc ExpandEnvironmentStringsW OpenProcess GetExitCodeProcess WaitForSingleObject WTSGetActiveConsoleSessionId CloseHandle FindResourceExW FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar GetProcessHeap HeapAlloc WriteConsoleW HeapFree HeapReAlloc HeapSize HeapDestroy GetLastError CreateFileW GetFileAttributesW GetProcAddress FreeLibrary LoadLibraryExW CancelWaitableTimer GlobalFree SetFilePointerEx GetConsoleMode GetConsoleCP FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetFileAttributesExW SetFileTime VirtualFree VirtualAlloc GetProcessAffinityMask GlobalMemoryStatus ReleaseSemaphore CreateEventW SetEvent ResetEvent CreateSemaphoreW WaitForMultipleObjects QueryPerformanceCounter GetStringTypeW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent OutputDebugStringW VerSetConditionMask VerifyVersionInfoW GetCurrentThread GetProcessTimes GetLongPathNameW WriteFile FlushFileBuffers SetEndOfFile LoadLibraryW CreateThread ResumeThread TerminateThread ExitThread WaitForMultipleObjectsEx ReadProcessMemory lstrlenA GetSystemDefaultUILanguage GetUserDefaultUILanguage TerminateProcess GetThreadContext FileTimeToSystemTime SetUnhandledExceptionFilter GetSystemTime lstrcmpA UnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlUnwind GetFileType FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle FindFirstFileExW IsValidCodePage

advapi32

CreateProcessAsUserW AllocateAndInitializeSid LsaNtStatusToWinError OpenProcessToken DuplicateTokenEx SetTokenInformation GetTokenInformation EqualSid TraceMessage GetNamedSecurityInfoW ConvertStringSidToSidW SetEntriesInAclW SetNamedSecurityInfoW GetSidLengthRequired InitializeSid GetSidSubAuthority OpenThreadToken RegQueryValueExW RegEnumValueW SetSecurityDescriptorDacl MakeAbsoluteSD InitializeSecurityDescriptor QueryServiceStatusEx LookupPrivilegeNameW ConvertSidToStringSidW CopySid GetLengthSid IsValidSid InitializeAcl AddAce GetAclInformation GetAce ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorOwner CryptReleaseContext CryptDecrypt CryptAcquireContextW CryptDestroyKey CryptSetKeyParam CryptImportKey MapGenericMask SetSecurityInfo GetSecurityInfo DuplicateToken CheckTokenMembership AdjustTokenPrivileges LookupPrivilegeValueW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW StartServiceW RegGetValueW ConvertSecurityDescriptorToStringSecurityDescriptorW QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle GetSecurityDescriptorControl GetSecurityDescriptorLength MakeSelfRelativeSD GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup FreeSid

ole32

CoCreateInstance PropVariantClear CoInitializeEx CoUninitialize CoInitializeSecurity StringFromIID CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree StringFromGUID2 CoCreateGuid CLSIDFromString

oleaut32

SafeArrayCreate SafeArrayUnlock SysStringByteLen SysAllocStringByteLen VariantCopyInd VariantInit VariantClear SysAllocStringLen SafeArrayPtrOfIndex SafeArrayLock SafeArrayCreateVector SafeArrayUnaccessData SafeArrayAccessData VarUI4FromStr

shlwapi

PathRemoveFileSpecW UrlCanonicalizeW PathIsDirectoryW PathFindFileNameW PathIsUNCServerW PathAppendW PathAddBackslashW PathQuoteSpacesW SHDeleteKeyW PathIsUNCW PathSkipRootW PathFileExistsW

comctl32

InitCommonControlsEx

psapi

GetModuleFileNameExW

crypt32

CryptHashCertificate CertCompareIntegerBlob CertFreeCertificateChain CertGetCertificateChain CryptMsgGetParam CertFindCertificateInStore CertCloseStore CryptMsgClose CertGetEnhancedKeyUsage CryptQueryObject CertNameToStrW CertGetNameStringW CertFreeCertificateContext

wintrust

CryptCATAdminReleaseContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash CryptCATAdminAcquireContext CryptCATAdminReleaseCatalogContext CryptCATCatalogInfoFromContext WintrustGetRegPolicyFlags WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

N360-ESD-22.20.5.39-EN.exe

PE Signature issue

secur32

kernel32

advapi32

ole32

oleaut32

shlwapi

comctl32

psapi

crypt32

wintrust

generic