av_sec[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
av_sec.exe
Size 11.2MB
Sample240422-ntgqcsag69
SHA256 3bcf561a6a414a306a3196ca7174fd99b966faacb8f0ce4fae4bc72d32a4aebf
MD5 ab2c5633a45550670bca99f5cb82310c
SHA1 1b41983e38999ab3dcbad4a74cf2c7bf6ef9711e
SHA512 80c7f67c87aebabbaef79828d5f269229d6218ba12abb8473e71c95d9fe9e967ca288c1dcb97d2d97f67946b9350923318e298c2d7a276b25877b2c092bc7ec9
SSDEEP 196608:cz97cMnvqx44EpYRPY4jTrcWrYdTjBI/TY0rA1q:k9wIvqx4xYRPYirxkZ6/j
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

av_sec.exe

.exe 11.2MB

av_sec.exe

IMPHASH 28bb62c97c13ef5bcaf475de7ca26a5f
SHA256 3bcf561a6a414a306a3196ca7174fd99b966faacb8f0ce4fae4bc72d32a4aebf
MD5 ab2c5633a45550670bca99f5cb82310c
SHA1 1b41983e38999ab3dcbad4a74cf2c7bf6ef9711e
SHA512 80c7f67c87aebabbaef79828d5f269229d6218ba12abb8473e71c95d9fe9e967ca288c1dcb97d2d97f67946b9350923318e298c2d7a276b25877b2c092bc7ec9
SSDEEP 196608:cz97cMnvqx44EpYRPY4jTrcWrYdTjBI/TY0rA1q:k9wIvqx4xYRPYirxkZ6/j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

b0:b4:1e:57:1b:b7:8e:64:4a:19:ca:9b:70:b3:3e:d6:26:65:1c:07:73:56:e4:18:f2:2b:9c:93:98:b3:09:78

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 6, 2022

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2021 - Dec 29, 2040

Subject

Serial Number

7b:d6:c4:fa:c6:e9:ae:f2:48:e4:9a:b3:0b:6f:bc:81

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 21, 2021 - Dec 21, 2024

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Time Stamping CA - TS2,O=Entrust\, Inc.,C=US

Serial Number

25:bc:2b:f3:29:ca:10:7f:1e:a9:ba:88:85:d4:9d:3b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Dec 29, 2040

Subject

CN=Entrust Timestamp Authority - TSA2,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

74:d9:f2:db:51:3c:22:67:fd:47:9c:36:07:3f:7b:1d

Issuer

CN=Entrust Time Stamping CA - TS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 14, 2021 - Aug 14, 2032

Minor OS version

Major OS version

Entry point

4513824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW GetDefaultPrinterW EnumPrintersW

comdlg32

FindTextW

comctl32

ImageList_GetImageInfo FlatSB_SetScrollInfo InitCommonControls ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB ImageList_Copy FlatSB_GetScrollInfo ImageList_Write ImageList_DrawIndirect ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_Replace ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_LoadImageW ImageList_Draw ImageList_Remove ImageList_ReplaceIcon ImageList_SetOverlayImage

shell32

SHGetMalloc SHGetSpecialFolderLocation Shell_NotifyIconW SHAppBarMessage ShellExecuteW SHGetPathFromIDListW

user32

MoveWindow CopyImage SetMenuItemInfoW GetMenuItemInfoW DefFrameProcW GetDlgCtrlID FrameRect RegisterWindowMessageW GetMenuStringW FillRect SendMessageA IsClipboardFormatAvailable EnumWindows ShowOwnedPopups GetClassInfoExW GetClassInfoW GetScrollRange SetActiveWindow GetActiveWindow DrawEdge GetKeyboardLayoutList LoadBitmapW EnumChildWindows GetScrollBarInfo UnhookWindowsHookEx SetCapture GetCapture ShowCaret CreatePopupMenu GetMenuItemID CharLowerBuffW PostMessageW IsZoomed SetParent DrawMenuBar GetClientRect IsChild IsIconic CallNextHookEx ShowWindow SetForegroundWindow GetWindowTextW IsDialogMessageW DestroyWindow RegisterClassW EndMenu CharNextW GetFocus GetDC SetFocus ChangeClipboardChain ReleaseDC SetScrollRange DrawTextW PeekMessageA MessageBeep RegisterHotKey RemovePropW GetSubMenu DestroyIcon IsWindowVisible FlashWindow PtInRect DispatchMessageA UnregisterClassW GetTopWindow SendMessageW GetMessageTime GetComboBoxInfo GetWindowLongPtrW SetWindowLongPtrW LoadStringW CreateMenu CharLowerW SetWindowRgn SetWindowPos GetMenuItemCount GetSysColorBrush GetWindowDC DrawTextExW EnumClipboardFormats GetScrollInfo SetWindowTextW GetMessageExtraInfo GetSysColor EnableScrollBar TrackPopupMenu DrawIconEx GetClassNameW GetMessagePos GetIconInfo SetScrollInfo GetKeyNameTextW GetDesktopWindow SetCursorPos GetCursorPos SetMenu GetMenuState GetMenu UnregisterHotKey SetRect GetKeyState IsRectEmpty ValidateRect IsCharAlphaW GetCursor KillTimer BeginDeferWindowPos WaitMessage TranslateMDISysAccel GetWindowPlacement GetMenuItemRect CreateIconIndirect CreateWindowExW ChildWindowFromPoint GetDCEx PeekMessageW MonitorFromWindow GetUpdateRect SetTimer WindowFromPoint BeginPaint RegisterClipboardFormatW MapVirtualKeyW OffsetRect IsWindowUnicode DispatchMessageW CreateAcceleratorTableW DefMDIChildProcW GetSystemMenu SetScrollPos GetScrollPos InflateRect DrawFocusRect ReleaseCapture LoadCursorW ScrollWindow GetLastActivePopup GetSystemMetrics CharUpperBuffW SetClassLongPtrW GetClassLongPtrW ClientToScreen SetClipboardData GetClipboardData SetWindowPlacement GetMonitorInfoW CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow EnableWindow GetWindowThreadProcessId RedrawWindow EndPaint MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW ActivateKeyboardLayout SetClipboardViewer GetParent MonitorFromRect InsertMenuItemW GetPropW MessageBoxW SetPropW UpdateWindow MsgWaitForMultipleObjects DestroyMenu SetWindowsHookExW EmptyClipboard GetDlgItem AdjustWindowRectEx IsWindow DrawIcon EnumThreadWindows InvalidateRect SetKeyboardState GetKeyboardState ScreenToClient DrawFrameControl IsCharAlphaNumericW BringWindowToTop SetCursor CreateIcon RemoveMenu GetKeyboardLayoutNameW OpenClipboard TranslateMessage MapWindowPoints EnumDisplayMonitors CallWindowProcW CountClipboardFormats CloseClipboard DestroyCursor CopyIcon PostQuitMessage ShowScrollBar EnableMenuItem DeferWindowPos HideCaret EndDeferWindowPos FindWindowExW MonitorFromPoint LoadIconW SystemParametersInfoW GetWindow GetWindowRect InsertMenuW IsWindowEnabled IsDialogMessageA FindWindowW GetKeyboardLayout DeleteMenu

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

SafeArrayPutElement GetErrorInfo VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement GetActiveObject SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantChangeType

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

advapi32

RegSetValueExW RegConnectRegistryW RegEnumKeyExW RegLoadKeyW RegDeleteKeyW RegOpenKeyExW RegQueryInfoKeyW RegUnLoadKeyW RegSaveKeyW RegDeleteValueW RegReplaceKeyW RegFlushKey RegQueryValueExW RegEnumValueW RegCloseKey RegCreateKeyExW RegRestoreKeyW

kernel32

GetFileType RtlUnwindEx GetACP CloseHandle LocalFree GetCurrentProcessId SizeofResource QueryPerformanceFrequency IsDebuggerPresent GetFullPathNameW VirtualFree GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW GlobalSize GetLongPathNameW RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy ReadFile GetUserDefaultLCID GetLastError GetModuleFileNameW SetLastError GlobalAlloc GlobalUnlock FindResourceW CreateThread CompareStringW CreateMutexW LoadLibraryA ResetEvent MulDiv FreeResource GetDriveTypeW GetVersion RaiseException GlobalAddAtomW FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery GlobalFindAtomW VirtualQueryEx GlobalFree Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetFileSize GetStartupInfoW GlobalDeleteAtom GetFileAttributesW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority GlobalLock VirtualAlloc GetTempPathW GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage GetConsoleOutputCP GetConsoleCP lstrlenW QueryPerformanceCounter SetEndOfFile lstrcmpW HeapFree WideCharToMultiByte MultiByteToWideChar FindClose LoadLibraryW SetEvent GetLocaleInfoW CreateFileW EnumResourceNamesW IsDBCSLeadByteEx GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc CreateEventW WaitForMultipleObjectsEx GetThreadLocale SetThreadLocale

ole32

OleRegEnumVerbs IsAccelerator CoCreateInstance CoUninitialize IsEqualGUID CreateStreamOnHGlobal OleInitialize ProgIDFromCLSID OleUninitialize CoGetClassObject CoInitialize CoTaskMemFree OleDraw CoTaskMemAlloc OleSetMenuDescriptor StringFromCLSID

api-ms-win-crt-string-l1-1-0

memset

gdi32

Pie SetBkMode CreateCompatibleBitmap GetEnhMetaFileHeader CloseEnhMetaFile RectVisible AngleArc SetAbortProc SetTextColor GetTextColor StretchBlt RoundRect SelectClipRgn RestoreDC SetRectRgn GetTextMetricsW GetWindowOrgEx CreatePalette CreateDCW PolyBezierTo CreateICW GetStockObject CreateSolidBrush GetBkMode Polygon MoveToEx PlayEnhMetaFile Ellipse StartPage GetBitmapBits StartDocW AbortDoc GetSystemPaletteEntries GetEnhMetaFileBits GetEnhMetaFilePaletteEntries CreatePenIndirect SetMapMode CreateFontIndirectW PolyBezier LPtoDP EndDoc GetObjectW GetCurrentObject GetWinMetaFileBits SetROP2 GetEnhMetaFileDescriptionW ArcTo CreateEnhMetaFileW Arc SelectPalette SetGraphicsMode ExcludeClipRect MaskBlt SetWindowOrgEx EndPage DeleteEnhMetaFile Chord SetDIBits GetViewportOrgEx SetViewportOrgEx CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable CreateBrushIndirect PatBlt SetEnhMetaFileBits Rectangle SaveDC DeleteDC BitBlt SetWorldTransform FrameRgn GetDeviceCaps GetTextExtentPoint32W GetClipBox IntersectClipRect Polyline CreateBitmap CombineRgn SetWinMetaFileBits GetStretchBltMode CreateDIBitmap CreateDIBSection SetStretchBltMode GetDIBits ExtCreateRegion LineTo GetRgnBox EnumFontsW CreateHalftonePalette SelectObject DeleteObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW SetBkColor CreateCompatibleDC GetBrushOrgEx GetCurrentPositionEx SetDCPenColor CreateRoundRectRgn GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel GdiFlush SetPixel EnumFontFamiliesExW StretchDIBits GetPaletteEntries

Name

.text

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

384KB

Virtual Size

383KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

134KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

640B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

109B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

228KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pdata

Size

238KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

av_sec.exe

PE Signature issue

winspool.drv

comdlg32

comctl32

shell32

user32

version

oleaut32

wtsapi32

advapi32

kernel32

ole32

api-ms-win-crt-string-l1-1-0

gdi32

generic