cf78a3bb1b9513d9c31bde6e6e36860570cd7d192f1a862c8545ea2d2df11c38[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
cf78a3bb1b9513d9c31bde6e6e36860570cd7d192f1a862c8545ea2d2df11c38.exe
Size 27.1MB
Sample240421-bndejafe3v
SHA256 cf78a3bb1b9513d9c31bde6e6e36860570cd7d192f1a862c8545ea2d2df11c38
MD5 f02aaaf0d308cf00b19cd2ee4f389ac5
SHA1 dd2fa4b5d4b10a33551ba682b5e9d1dddbe127c5
SHA512 f974bca69fa1b01014c35d8889c08e6fa771cab03c12723414e99a4a7bbc392710e81a506ff36f114ca4154663bee0002f346dca3a9c40dc061ed2ea8a4a1e09
SSDEEP 393216:3x5vAtM900k3ClwrwsWE3RaKGYeq9cwFE0dMPx+vGMeO36we3FwQJwN2GEE3WyxB:bDAwDE7elaEtyG7O36we3F+N2x+pGaR
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

cf78a3bb1b9513d9c31bde6e6e36860570cd7d192f1a862c8545ea2d2df11c38.exe

.exe 27.1MB

cf78a3bb1b9513d9c31bde6e6e36860570cd7d192f1a862c8545ea2d2df11c38.exe

IMPHASH a0722f4d4407b49f848f72fd4df721d0
SHA256 cf78a3bb1b9513d9c31bde6e6e36860570cd7d192f1a862c8545ea2d2df11c38
MD5 f02aaaf0d308cf00b19cd2ee4f389ac5
SHA1 dd2fa4b5d4b10a33551ba682b5e9d1dddbe127c5
SHA512 f974bca69fa1b01014c35d8889c08e6fa771cab03c12723414e99a4a7bbc392710e81a506ff36f114ca4154663bee0002f346dca3a9c40dc061ed2ea8a4a1e09
SSDEEP 393216:3x5vAtM900k3ClwrwsWE3RaKGYeq9cwFE0dMPx+vGMeO36we3FwQJwN2GEE3WyxB:bDAwDE7elaEtyG7O36we3F+N2x+pGaR
MD5 SHA1 SHA512 SSDEEP

Digest

6b:67:2d:6c:4d:9a:60:ce:c3:c1:62:db:8d:6b:64:a8:e9:0f:cf:10:9f:01:21:84:d2:be:30:cf:e6:a9:2c:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=SC331902,CN=SimpleHelp Ltd,O=SimpleHelp Ltd,POSTALCODE=ML12 6HQ,STREET=Galavale,L=Broughton,ST=Scottish Borders,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 10, 2023

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

d4:61:10:f1:0c:e0:27:49:34:fd:13:c2:75:fa:b8:0d:53:e5:cc:02

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Oct 10, 2023

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

67:de:f4:3e:f1:7b:da:e2:4f:f5:94:06:06:d2:c0:84

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Subject

Serial Number

c7:4f:79:c7:83:93:eb:f2:28:58:e9:ad:39:14:56:7f

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 25, 2021 - Feb 25, 2024

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:48:90:3d:c2:8a:bc:a7:a1:19:4d:0c:1c:57:b8:29

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

67:de:f4:3e:f1:7b:da:e2:4f:f5:94:06:06:d2:c0:84

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Subject

Serial Number

c7:4f:79:c7:83:93:eb:f2:28:58:e9:ad:39:14:56:7f

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 25, 2021 - Feb 25, 2024

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:48:90:3d:c2:8a:bc:a7:a1:19:4d:0c:1c:57:b8:29

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Minor OS version

Major OS version

Entry point

125920

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

timeGetTime

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

comctl32

InitCommonControlsEx

wininet

HttpSendRequestA InternetErrorDlg InternetOpenA InternetSetOptionA InternetReadFile InternetCrackUrlA InternetConnectA InternetOpenUrlA HttpQueryInfoA InternetCloseHandle InternetQueryOptionA HttpOpenRequestA

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpOpen WinHttpGetProxyForUrl

kernel32

GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings MoveFileExA FreeLibrary GetCurrentProcess Sleep GetProcAddress LoadLibraryA GetModuleHandleA GetVersion GetTempPathA WaitForSingleObject SetEvent TerminateThread CreateEventA GetLastError CloseHandle CreateMutexA ReleaseMutex CreateThread SetEnvironmentVariableA GlobalFree DeleteFileA InitializeCriticalSection SetStdHandle EnterCriticalSection DeleteCriticalSection GetExitCodeProcess CreateProcessA GetCurrentDirectoryA lstrlenA FormatMessageA GetShortPathNameA SetCurrentDirectoryA LocalAlloc GetVersionExA LocalFree FreeEnvironmentStringsA SetFilePointer HeapSize ReadFile RtlUnwind FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount GetOEMCP GetACP GetCPInfo InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle WriteFile WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEndOfFile CompareStringA CompareStringW LeaveCriticalSection InterlockedExchange RaiseException HeapFree HeapAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA FindNextFileA FindClose MoveFileA ExitProcess GetTimeFormatA GetDateFormatA GetDriveTypeA GetFullPathNameA GetTimeZoneInformation GetSystemTimeAsFileTime ExitThread GetCurrentThreadId MultiByteToWideChar WideCharToMultiByte GetFileAttributesA CreateDirectoryA RemoveDirectoryA GetCommandLineA GetProcessHeap HeapReAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapDestroy HeapCreate VirtualFree VirtualAlloc

user32

SetTimer GetWindowRect KillTimer SetWindowPos GetDesktopWindow DestroyWindow GetMessageA PostThreadMessageA MonitorFromPoint LoadIconA SendMessageA GetMonitorInfoA TranslateMessage SetWindowLongA GetWindowLongA CreateWindowExA PeekMessageA DefWindowProcA GetCursorPos ShowWindow DispatchMessageA SystemParametersInfoA LoadCursorA ValidateRect RegisterClassA

advapi32

GetUserNameA GetExplicitEntriesFromAclA GetNamedSecurityInfoA EqualSid ConvertStringSidToSidA SetNamedSecurityInfoA SetEntriesInAclA

Sharing

General

Malware Config

Signatures

File Explorer

cf78a3bb1b9513d9c31bde6e6e36860570cd7d192f1a862c8545ea2d2df11c38.exe

winmm

version

comctl32

wininet

winhttp

kernel32

user32

advapi32

generic