0242b16d15e0d3e087be37fb4d1a4f0f08f1c737774488dc943c6599d0307278[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
0242b16d15e0d3e087be37fb4d1a4f0f08f1c737774488dc943c6599d0307278.exe
Size 1.3MB
Sample240410-bdkqvsbc38
SHA256 0242b16d15e0d3e087be37fb4d1a4f0f08f1c737774488dc943c6599d0307278
MD5 cbfc0d493896d95afc54d0e15ed6f03d
SHA1 f0789962c1fea2b597466c24e5ac3f61f7bdd5f4
SHA512 43ce9346c2711c3c8d01017383691486384a775158497fa467e272fd120425ae8211144e91417a73e246448dbb8a6c1ee46d5fdf1f210f849c8911b493dd990f
SSDEEP 12288:33FxpE2JEBvhVP3dUgJJpWtCKIPJuWRXNdMTNHWsSPtWKHEpr7PTUCIDg/41i2:3j2BJuCXPMhH/iGprzAC3/41i2
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

0242b16d15e0d3e087be37fb4d1a4f0f08f1c737774488dc943c6599d0307278.exe

.exe 1.3MB

0242b16d15e0d3e087be37fb4d1a4f0f08f1c737774488dc943c6599d0307278.exe

IMPHASH 5be5c0729ba1156c48a7f08a7314848c
SHA256 0242b16d15e0d3e087be37fb4d1a4f0f08f1c737774488dc943c6599d0307278
MD5 cbfc0d493896d95afc54d0e15ed6f03d
SHA1 f0789962c1fea2b597466c24e5ac3f61f7bdd5f4
SHA512 43ce9346c2711c3c8d01017383691486384a775158497fa467e272fd120425ae8211144e91417a73e246448dbb8a6c1ee46d5fdf1f210f849c8911b493dd990f
SSDEEP 12288:33FxpE2JEBvhVP3dUgJJpWtCKIPJuWRXNdMTNHWsSPtWKHEpr7PTUCIDg/41i2:3j2BJuCXPMhH/iGprzAC3/41i2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

43:07:3e:db:e5:16:b0:69:b6:ca:45:78:51:b1:29:5a:29:ab:09:93:92:a1:e1:44:74:c8:d5:d4:69:98:bf:08

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=LetsGo Network Incorporated,O=LetsGo Network Incorporated,ST=Ontario,C=CA

Chains

Nov 27, 2023

CN=LetsGo Network Incorporated,O=LetsGo Network Incorporated,ST=Ontario,C=CA

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=LetsGo Network Incorporated,O=LetsGo Network Incorporated,ST=Ontario,C=CA

Serial Number

a6:25:99:b7:3b:8e:19:8d:7a:ba:99:1a:a1:a9:bf:3e

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 29, 2023 - Mar 28, 2026

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Minor OS version

Major OS version

Entry point

17381

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Users\Administrator\Desktop\免杀工具70\PayloadInResources\none

kernel32

GetModuleFileNameA FindResourceA LoadResource SizeofResource LockResource GetCurrentProcessId OpenProcess VirtualAllocEx WriteProcessMemory CreateRemoteThread CloseHandle WaitForSingleObject WriteConsoleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CompareStringEx MultiByteToWideChar GetCPInfo WideCharToMultiByte LCMapStringEx FormatMessageA GetLocaleInfoEx GetStringTypeW LocalFree RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetCurrentProcess TerminateProcess GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCurrentThread HeapFree HeapReAlloc HeapAlloc OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetProcessHeap SetConsoleCtrlHandler GetTimeZoneInformation HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW CreateFileW RtlUnwind

Name

.text

Size

937KB

Virtual Size

936KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

memcpy_

Size

1024B

Virtual Size

828B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1024B

Virtual Size

863B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

126KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0242b16d15e0d3e087be37fb4d1a4f0f08f1c737774488dc943c6599d0307278.exe

PE Signature issue

kernel32

generic