final-windows-sign (2)[.]exe

Resubmissions

25/06/2024, 15:54

240625-tb657asbkp7

25/06/2024, 15:53

25/06/2024, 15:44

25/06/2024, 15:40

02/04/2024, 14:29

Sharing

Copy URL Twitter E-mail

General

Target
final-windows-sign (2).exe
Size 25.2MB
Sample240402-rtkc2adb64
SHA256 ddc63974ae0d40f205c9260cb191e54fec3804659427a7f8184543495e66946c
MD5 4a9cfff3e3291632882c4c74696f984e
SHA1 c35bcd9c752b4a9d03f31162f4499aa9d00c5d55
SHA512 a0bfbc53a88a37d06cf8d632e6e4af1c0b4d720c9b4b2eb0f91bc96ed4ad00bb837f73ba60082342be514d1486adba2ddb92cda2c11d2d1e001ad4c773dc58c3
SSDEEP 393216:gRkAHpSlMdyiQhJE4wS/JVywizWb+sCLvSkI7Wb3k7+FAWdwzf5NpckWWh:gDHpciCJhxPiz2+xKktbJFzdqFck
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

final-windows-sign (2).exe

.exe 25.2MB

final-windows-sign (2).exe

IMPHASH 4968a00e8017740306d0d35ab4f23b4c
SHA256 ddc63974ae0d40f205c9260cb191e54fec3804659427a7f8184543495e66946c
MD5 4a9cfff3e3291632882c4c74696f984e
SHA1 c35bcd9c752b4a9d03f31162f4499aa9d00c5d55
SHA512 a0bfbc53a88a37d06cf8d632e6e4af1c0b4d720c9b4b2eb0f91bc96ed4ad00bb837f73ba60082342be514d1486adba2ddb92cda2c11d2d1e001ad4c773dc58c3
SSDEEP 393216:gRkAHpSlMdyiQhJE4wS/JVywizWb+sCLvSkI7Wb3k7+FAWdwzf5NpckWWh:gDHpciCJhxPiz2+xKktbJFzdqFck
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

6c:f4:55:d3:9a:68:ca:18:85:72:b5:9d:23:50:84:6b:a7:08:50:81:1a:9d:34:e7:3e:8e:cc:41:bf:6b:31:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Pinauten PWN Cert,OU=Pinauten,O=Pinauten GmbH,L=Boppard,ST=Germany,C=DE,1.2.840.113549.1.9.1=#0c13636f6e746163744070696e617574656e2e6465

Chains

Mar 29, 2024

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CheckRemoteDebuggerPresent CloseHandle CompareStringOrdinal CreateFileW CreateNamedPipeW CreateProcessW CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteProcThreadAttributeList DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileW FreeEnvironmentStringsW FreeLibrary GetComputerNameExW GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThread GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetProcessIoCounters GetProcessTimes GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimes GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeProcThreadAttributeList K32GetPerformanceInfo LeaveCriticalSection LoadLibraryA LoadLibraryExA LocalFree MultiByteToWideChar OpenProcess QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFileEx ReadProcessMemory ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetLastError SetThreadExecutionState SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UpdateProcThreadAttribute VirtualProtect VirtualQuery VirtualQueryEx WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WriteConsoleW WriteFileEx __C_specific_handler

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf wcslen

ntdll

NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

advapi32

CopySid GetLengthSid GetTokenInformation IsValidSid OpenProcessToken SystemFunction036

bcrypt

BCryptGenRandom

oleaut32

GetErrorInfo SysFreeString SysStringLen

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW GetProcessMemoryInfo

shell32

CommandLineToArgvW

bcryptprimitives

ProcessPrng

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

24.1MB

Virtual Size

24.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

640B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

final-windows-sign (2).exe

PE Signature issue

kernel32

msvcrt

ntdll

advapi32

bcrypt

oleaut32

pdh

powrprof

psapi

shell32

bcryptprimitives

generic