SecuriteInfo[.]com[.]Trojan[.]Siggen10[.]59370[.]11705[.]17039[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Trojan.Siggen10.59370.11705.17039.exe
Size 1.2MB
Sample240331-ctkapsca6z
SHA256 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3
MD5 5096bea0badb422849e9306cf9a8da9c
SHA1 770afbd27b0062f0587f70a4c5363a28e6a54063
SHA512 38c47cdae26648db03847141d38461357657c4144595e4a03c3d6c1fb1378b287cb29048bb1f7732f1625ac3d056aa9e4ab85607a7c89fc551b60683e4f041cd
SSDEEP 24576:chEbagUZYxiornbB2RXoBn7DNXSBDCCdMUQMMn5STkhC+:KEbnxiornbsRXoZNSBDAUQZ5TR
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Trojan.Siggen10.59370.11705.17039.exe

.exe 1.2MB

SecuriteInfo.com.Trojan.Siggen10.59370.11705.17039.exe

IMPHASH a2811931084b6dcda3f7edcb0d2009ac
SHA256 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3
MD5 5096bea0badb422849e9306cf9a8da9c
SHA1 770afbd27b0062f0587f70a4c5363a28e6a54063
SHA512 38c47cdae26648db03847141d38461357657c4144595e4a03c3d6c1fb1378b287cb29048bb1f7732f1625ac3d056aa9e4ab85607a7c89fc551b60683e4f041cd
SSDEEP 24576:chEbagUZYxiornbB2RXoBn7DNXSBDCCdMUQMMn5STkhC+:KEbnxiornbsRXoZNSBDAUQZ5TR
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

62:13:c0:86:9b:fa:32:7e:f7:f3:fd:12:82:d0:ad:42:81:84:70:fe

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=SimpleHelp Ltd,O=SimpleHelp Ltd,L=Burntisland,ST=Midlothian,C=GB

Chains

Nov 21, 2014

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=SimpleHelp Ltd,O=SimpleHelp Ltd,L=Burntisland,ST=Midlothian,C=GB

Serial Number

6e:48:2b:f8:48:a6:0c:84:94:77:f7:47:1b:54:23:10

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Nov 20, 2013 - Dec 20, 2015

Subject

Serial Number

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Dec 30, 2020

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 23, 2013 - Sep 23, 2024

Minor OS version

Major OS version

Entry point

113288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

timeGetTime

comctl32

InitCommonControlsEx

wininet

InternetQueryOptionA InternetCloseHandle InternetOpenA HttpSendRequestA InternetErrorDlg HttpOpenRequestA InternetReadFile InternetCrackUrlA InternetConnectA InternetOpenUrlA HttpQueryInfoA

winhttp

WinHttpGetProxyForUrl WinHttpOpen WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser

kernel32

CompareStringA GetStringTypeW GetStringTypeA CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA LCMapStringW LCMapStringA GetCurrentProcessId MoveFileExA FreeLibrary GetCurrentProcess Sleep GetProcAddress LoadLibraryA GetModuleHandleA GetVersion WaitForSingleObject SetEvent TerminateThread CreateEventA GetLastError CloseHandle lstrlenA FormatMessageA LocalAlloc CreateMutexA CompareStringW LocalFree CreateThread SetCurrentDirectoryA GetCurrentDirectoryA GlobalFree DeleteFileA GetExitCodeProcess CreateProcessA GetShortPathNameA GetVersionExA GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapSize SetFilePointer GetOEMCP GetACP GetCPInfo ReadFile RtlUnwind FlushFileBuffers GetConsoleMode GetConsoleCP CreatePipe InitializeCriticalSection GetStartupInfoA GetFileType SetHandleCount InterlockedDecrement SetLastError InterlockedIncrement TlsFree ReleaseMutex FindNextFileA InterlockedExchange RaiseException HeapFree HeapAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA SetEndOfFile FindClose MoveFileA ExitProcess DuplicateHandle GetTimeFormatA GetDateFormatA GetDriveTypeA GetFullPathNameA GetTimeZoneInformation GetSystemTimeAsFileTime ExitThread GetCurrentThreadId MultiByteToWideChar EnterCriticalSection LeaveCriticalSection WideCharToMultiByte SetEnvironmentVariableA GetFileAttributesA CreateDirectoryA RemoveDirectoryA GetCommandLineA GetProcessHeap HeapReAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapDestroy HeapCreate VirtualFree DeleteCriticalSection VirtualAlloc WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue

user32

SetTimer GetWindowRect KillTimer SetWindowPos GetDesktopWindow DestroyWindow GetMessageA PostThreadMessageA MonitorFromPoint LoadIconA SendMessageA GetMonitorInfoA TranslateMessage SetWindowLongA GetWindowLongA CreateWindowExA PeekMessageA DefWindowProcA GetCursorPos ShowWindow DispatchMessageA SystemParametersInfoA LoadCursorA ValidateRect RegisterClassA

advapi32

GetUserNameA

Sharing

General

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Trojan.Siggen10.59370.11705.17039.exe

PE Signature issue

winmm

comctl32

wininet

winhttp

kernel32

user32

advapi32

generic