88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7

Sharing

Copy URL Twitter E-mail

General

Target
88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7
Size 2.3MB
Sample240410-pla4aafe35
SHA256 88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7
MD5 93f53bf0f3db53aebcad54a4aa8cc833
SHA1 1dfeb7e7f97c6ea5176eb6b761b46f98af52cacd
SHA512 a4e58ef1072a72158af4f25fc28074b2f66106144e1b098f04996b6720e4a439acec9943373356cfa157781b2044313ba79b2d9ed6d925af9304440629ee9949
SSDEEP 49152:CCjCsNiNMeQ1BK1u4v6ZPUHBPYJSQzt/BDtVK1h0KLF3ITc9qW:xYMx9OYJSQRRtw0KVd9F
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7

.exe 2.3MB

88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7

IMPHASH 3c98c11017e670673be70ad841ea9c37
SHA256 88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7
MD5 93f53bf0f3db53aebcad54a4aa8cc833
SHA1 1dfeb7e7f97c6ea5176eb6b761b46f98af52cacd
SHA512 a4e58ef1072a72158af4f25fc28074b2f66106144e1b098f04996b6720e4a439acec9943373356cfa157781b2044313ba79b2d9ed6d925af9304440629ee9949
SSDEEP 49152:CCjCsNiNMeQ1BK1u4v6ZPUHBPYJSQzt/BDtVK1h0KLF3ITc9qW:xYMx9OYJSQRRtw0KVd9F
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

5a:1d:a0:b4:a4:12:89:87:09:28:5a:80:5a:8d:86:41:b9:91:22:52:c4:c9:8f:24:6b:e8:50:0b:2d:cf:eb:1d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Chains

Apr 8, 2024

PE Signature issue

Digest

b8:04:84:9d:bd:dc:2d:34:14:26:49:22:4c:52:19:fb:0a:83:3d:bd

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Chains

May 23, 2018

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Serial Number

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2016 - Feb 13, 2019

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Serial Number

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2016 - Feb 13, 2019

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

44167

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

comctl32

InitCommonControlsEx

shlwapi

SHAutoComplete

kernel32

DeleteFileW DeleteFileA CreateDirectoryA CreateDirectoryW FindClose FindNextFileA FindFirstFileA FindNextFileW FindFirstFileW GetVersionExW GetFullPathNameA GetFullPathNameW MultiByteToWideChar GetModuleFileNameW FindResourceW GetModuleHandleW HeapAlloc GetProcessHeap HeapFree HeapReAlloc CompareStringA ExitProcess GetTickCount FreeLibrary GetProcAddress LoadLibraryW GetCurrentProcessId SetFileAttributesW GetNumberFormatW DosDateTimeToFileTime GetDateFormatW GetTimeFormatW FileTimeToSystemTime FileTimeToLocalFileTime ExpandEnvironmentStringsW WaitForSingleObject Sleep GetExitCodeProcess GetTempPathW MoveFileExW UnmapViewOfFile MapViewOfFile GetCommandLineW CreateFileMappingW SetEnvironmentVariableW OpenFileMappingW LocalFileTimeToFileTime SystemTimeToFileTime GetSystemTime WideCharToMultiByte CompareStringW IsDBCSLeadByte GetCPInfo GlobalAlloc SetCurrentDirectoryW SetFileAttributesA GetFileAttributesW GetFileAttributesA WriteFile GetStdHandle ReadFile GetCurrentDirectoryW CreateFileW CreateFileA GetFileType SetEndOfFile SetFilePointer FlushFileBuffers MoveFileW SetFileTime GetCurrentProcess CloseHandle SetLastError GetLastError GetLocaleInfoW

user32

GetClassNameW DialogBoxParamW IsWindowVisible WaitForInputIdle SetForegroundWindow GetSysColor PostMessageW LoadBitmapW LoadIconW CharToOemA OemToCharA IsWindow CopyRect DestroyWindow DefWindowProcW RegisterClassExW LoadCursorW UpdateWindow CreateWindowExW MapWindowPoints GetParent GetDlgItemTextW TranslateMessage DispatchMessageW wvsprintfW wvsprintfA CharUpperA CharToOemBuffA LoadStringW GetWindowRect GetClientRect SetWindowPos GetWindowTextW SetWindowTextW GetSystemMetrics GetWindow GetWindowLongW CharUpperW CharToOemBuffW MessageBoxW ShowWindow GetDlgItem EnableWindow OemToCharBuffA SendDlgItemMessageW DestroyIcon EndDialog SetFocus SetDlgItemTextW SendMessageW GetDC ReleaseDC PeekMessageW FindWindowExW GetMessageW SetWindowLongW

gdi32

GetDeviceCaps GetObjectW CreateCompatibleBitmap SelectObject StretchBlt CreateCompatibleDC DeleteObject DeleteDC

comdlg32

GetOpenFileNameW CommDlgExtendedError GetSaveFileNameW

advapi32

RegOpenKeyExW LookupPrivilegeValueW RegQueryValueExW RegCreateKeyExW RegSetValueExW RegCloseKey SetFileSecurityW SetFileSecurityA OpenProcessToken AdjustTokenPrivileges

shell32

SHChangeNotify ShellExecuteExW SHFileOperationW SHGetFileInfoW SHGetSpecialFolderLocation SHGetMalloc SHBrowseForFolderW SHGetPathFromIDListW

ole32

CLSIDFromString CreateStreamOnHGlobal OleUninitialize CoCreateInstance OleInitialize

oleaut32

VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7

PE Signature issue

PE Signature issue

comctl32

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic