def454f0d1da69d6c01caed4c7c1894441ba72e8153a9b4058f4407007aaf578[.]exe

General

Target
def454f0d1da69d6c01caed4c7c1894441ba72e8153a9b4058f4407007aaf578.exe
Size 829KB
Sample240517-cflllsce92
SHA256 def454f0d1da69d6c01caed4c7c1894441ba72e8153a9b4058f4407007aaf578
MD5 589a60e0782a9d79f71102e03213392e
SHA1 48699baa16fc331a390536cad01cba0cd083b8da
SHA512 b395051eb11e2bb396a427f4896e0d80d4c8298e5a31b50193aee802d4123b32fad0ccf9fc69ac7cee53e5462ba81079355f14eac57baf7e42a91143dee7e088
SSDEEP 24576:WhLNAyNC5zV+QQtOidEbPsYmy6MmBa1QoUTw7c54zIBo6B93nUDR1/2:WhxCH+QQtOiGbPsYUa1FOw3kBo633UtU
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

def454f0d1da69d6c01caed4c7c1894441ba72e8153a9b4058f4407007aaf578.exe

.exe 829KB

def454f0d1da69d6c01caed4c7c1894441ba72e8153a9b4058f4407007aaf578.exe

IMPHASH 7dec55701c2e13edf19d56a39cee7be9
SHA256 def454f0d1da69d6c01caed4c7c1894441ba72e8153a9b4058f4407007aaf578
MD5 589a60e0782a9d79f71102e03213392e
SHA1 48699baa16fc331a390536cad01cba0cd083b8da
SHA512 b395051eb11e2bb396a427f4896e0d80d4c8298e5a31b50193aee802d4123b32fad0ccf9fc69ac7cee53e5462ba81079355f14eac57baf7e42a91143dee7e088
SSDEEP 24576:WhLNAyNC5zV+QQtOidEbPsYmy6MmBa1QoUTw7c54zIBo6B93nUDR1/2:WhxCH+QQtOiGbPsYUa1FOw3kBo633UtU
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

1f:cf:ee:24:bf:de:8f:47:25:4f:ca:be:ca:3b:d1:11:b5:18:a4:95

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Chains

Jun 20, 2017

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Serial Number

08:4c:af:4d:f4:99:14:1d:40:4b:71:99:aa:2c:21:31

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 25, 2015 - Oct 3, 2018

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Minor OS version

0

Major OS version

6

Entry point

171996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\wf2cqeyco4\output.pdb

gdi32

GetClipBox

user32

PostQuitMessage

kernel32

CreateFileW HeapSize VirtualAlloc WaitForSingleObject GetModuleHandleA FreeConsole CreateThread GetProcAddress MultiByteToWideChar FormatMessageA GetStringTypeW WideCharToMultiByte GetCurrentThreadId CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LocalFree GetLocaleInfoEx LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter QueryPerformanceFrequency SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetFileInformationByHandleEx CreateSymbolicLinkW CompareStringEx GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetProcessHeap RaiseException RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess HeapAlloc HeapFree GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc GetTimeZoneInformation OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

def454f0d1da69d6c01caed4c7c1894441ba72e8153a9b4058f4407007aaf578.exe

PE Signature issue

gdi32

user32

kernel32

generic