b779e93f5e9960ac870dadb8e8e69de7b6694f366c7c40b2f11d2b840dff92cb

General

Target
b779e93f5e9960ac870dadb8e8e69de7b6694f366c7c40b2f11d2b840dff92cb
Size 891KB
Sample240516-3xnemsfd79
SHA256 b779e93f5e9960ac870dadb8e8e69de7b6694f366c7c40b2f11d2b840dff92cb
MD5 120d3314cf0079c9023f51c1825685c4
SHA1 bd4cc388c5d622baa3712aca81c7df3bd6191f96
SHA512 fa1006daafb1ed581a6e9841a6a28915751e17766dee871c3503581a135d5e431ffa9b12adde129cdc4fd747f88732bfed5daa002b87a01c3674af2abc3a4c91
SSDEEP 12288:pn+dZr0bzuKlW5nkTzukTUwdLlSGZD4L9pXdCcClpnx6lBMe:pnm0bzNlgGZkjxClRx6lX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

b779e93f5e9960ac870dadb8e8e69de7b6694f366c7c40b2f11d2b840dff92cb

.exe 891KB

b779e93f5e9960ac870dadb8e8e69de7b6694f366c7c40b2f11d2b840dff92cb

IMPHASH 95d4ce459e6811e2e3f41a0dd12abced
SHA256 b779e93f5e9960ac870dadb8e8e69de7b6694f366c7c40b2f11d2b840dff92cb
MD5 120d3314cf0079c9023f51c1825685c4
SHA1 bd4cc388c5d622baa3712aca81c7df3bd6191f96
SHA512 fa1006daafb1ed581a6e9841a6a28915751e17766dee871c3503581a135d5e431ffa9b12adde129cdc4fd747f88732bfed5daa002b87a01c3674af2abc3a4c91
SSDEEP 12288:pn+dZr0bzuKlW5nkTzukTUwdLlSGZD4L9pXdCcClpnx6lBMe:pnm0bzNlgGZkjxClRx6lX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

0c:30:c8:d1:5c:b7:c9:f9:c8:97:cf:4c:7c:67:3e:dd:fa:25:7b:6c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Chains

Jun 20, 2017

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Serial Number

08:4c:af:4d:f4:99:14:1d:40:4b:71:99:aa:2c:21:31

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 25, 2015 - Oct 3, 2018

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Minor OS version

0

Major OS version

6

Entry point

4446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dtht2v9p8ue0\First.pdb

kernel32

WaitForSingleObject CreateThread VirtualAlloc GetModuleHandleA GetProcAddress FreeConsole CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA SetFileInformationByHandle GetTempPathW InitializeCriticalSectionEx InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetFileInformationByHandleEx CreateSymbolicLinkW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LocalFree GetLocaleInfoEx GetCurrentProcessId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess WriteConsoleW RaiseException RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW GetCurrentThread HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler GetFileType GetFileSizeEx SetFilePointerEx OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc ReadFile ReadConsoleW CreateFileW DecodePointer

Sharing

General

Malware Config

Signatures

File Explorer

b779e93f5e9960ac870dadb8e8e69de7b6694f366c7c40b2f11d2b840dff92cb

PE Signature issue

kernel32

generic