Spotify[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Spotify.exe
Size

33.0MB
MD5

6c55b811c6d48c0602097cda54bf3c3f
SHA1

2f7176fd8e03e790c3cfa62d836081a4832398d3
SHA256

3c6e679d176889435fb0d4db861d8649a577425704a2f1380077ab127973b111
SHA512

02469f09b361f3d517aead3b8abf2fafbcfd214522650db91e4e8168bdd206ad29d3694612093269620ff4db8c67fc70ddeeaf2298b1fb0020e5b5a3b6a14ef5
SSDEEP

393216:Y6AeXjfBReI3RH1sbhcbE7kzUVwqlzIR+h3FYu/uu:Y6DTN3Osq5nFYu/uu

Score

1^/10

Malware Config

Signatures

Files

Spotify.exe
.exe windows:6 windows x64 arch:x64

4308179fe9f41353d444b25ca9f251b0

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:ab:67:0a:61:bf:4b:7d:af:d5:59:35:6b:5b:cc:ff
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2023, 00:00

Not After

03/10/2024, 23:59

Subject

SERIALNUMBER=556703-7485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:d4:ca:36:c9:a1:93:bd:4d:ed:61:90:04:4b:31:ac:5c:6f:4e:fd:0e:8e:62:4c:44:49:27:fb:69:8e:c8:9b
Signer

Actual PE Digest

82:d4:ca:36:c9:a1:93:bd:4d:ed:61:90:04:4b:31:ac:5c:6f:4e:fd:0e:8e:62:4c:44:49:27:fb:69:8e:c8:9b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\src\desktop\shell\build\desktop\Release\Spotify.pdb

Imports

ws2_32

gethostbyname
getprotobyname
WSACreateEvent
WSACloseEvent
WSASetEvent
sendto
send
recvfrom
recv
freeaddrinfo
getaddrinfo
getpeername
WSARecvFrom
WSARecv
WSAEventSelect
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
socket
WSASetLastError
WSACleanup
inet_addr
ioctlsocket
WSAStartup
WSAIoctl
WSAGetLastError
inet_ntoa
gethostbyaddr
listen
getsockopt
getservbyport
WSASend
WSASendTo
WSASocketW
WSAAddressToStringW
getservbyname
htonl
htons
ntohl
WSAStringToAddressW
closesocket
ntohs
select
setsockopt
shutdown
getsockname
connect
bind
accept
__WSAFDIsSet

gdiplus

GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipFillEllipse
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateHICONFromBitmap
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStream
GdipCreateSolidFill
GdipDeleteFont
GdipStringFormatGetGenericDefault
GdipFree
GdipDeleteStringFormat
GdipDeleteBrush
GdipCloneStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateBitmapFromStream
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipSetInterpolationMode
GdipDrawImageRectRectI
GdipCloneBrush
GdipAlloc
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdiplusShutdown
GdiplusStartup
GdipDrawString

dbghelp

SymSetSearchPathW
SymSetOptions
SymCleanup
SymInitialize
SymFromAddr
SymGetLineFromAddr64
SymGetSearchPathW

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind
VerSetConditionMask
RtlInitUnicodeString
RtlCaptureStackBackTrace

oleaut32

SysFreeString
SysAllocString
VariantClear
SysStringLen
SysAllocStringByteLen
SetErrorInfo
GetErrorInfo

userenv

CreateAppContainerProfile
DeriveAppContainerSidFromAppContainerName

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

QueueUserAPC
GetCurrentProcessId
GetCurrentThreadId
CreateRemoteThread
TerminateThread
GetExitCodeProcess
CreateThread
SetThreadPriority
GetStartupInfoW
CreateProcessW
UpdateProcThreadAttribute
ExitThread
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
ResumeThread
GetCurrentThread
GetThreadId
TerminateProcess
ExitProcess
GetCurrentProcess
GetExitCodeThread
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcessTimes

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetVersion
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
GetVersionExW
GetSystemInfo
GetLocalTime
GetWindowsDirectoryW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-1

SetProcessMitigationPolicy
GetCurrentProcessorNumber
GetProcessHandleCount
OpenProcess
GetProcessMitigationPolicy
IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
FreeLibraryAndExitThread
SetDefaultDllDirectories
LoadLibraryExA
GetModuleHandleExW
GetModuleHandleA
LoadResource
LockResource
SizeofResource
GetModuleFileNameW
LoadLibraryExW
LoadStringW
GetProcAddress
FreeLibrary

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
InitializeCriticalSectionEx
ReleaseMutex
DeleteCriticalSection
OpenMutexW
LeaveCriticalSection
SleepEx
CreateEventExW
OpenEventA
CreateMutexW
ResetEvent
CreateEventA
SetWaitableTimer
CreateMutexA
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
TryAcquireSRWLockExclusive
CreateEventW
EnterCriticalSection
SetEvent
WaitForSingleObject
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSemaphore
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
InitializeCriticalSection

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
ExpandEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineA
GetStdHandle
SetEnvironmentVariableW
SetStdHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW

api-ms-win-core-file-l1-1-0

GetVolumePathNameW
FindNextFileW
GetFileType
LockFile
GetDiskFreeSpaceExW
GetFullPathNameW
GetFileInformationByHandle
GetFileTime
FindFirstFileExW
FindClose
FindFirstFileW
WriteFile
SetEndOfFile
SetFileAttributesW
UnlockFile
RemoveDirectoryW
GetFileAttributesW
FlushFileBuffers
GetLongPathNameW
GetFileAttributesExW
GetFileSizeEx
SetFilePointerEx
ReadFile
GetDriveTypeW
CreateFileW
GetFileSize
CreateDirectoryW
DeleteFileW
GetTempFileNameW

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapSize
HeapDestroy
HeapSetInformation
GetProcessHeap
HeapFree
HeapAlloc
GetProcessHeaps

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
GetUserDefaultLCID
GetUserDefaultLangID
LCMapStringEx
LCMapStringW
GetUserDefaultLocaleName
GetACP
IsValidLocale
GetOEMCP
GetCPInfo
FormatMessageA
GetLocaleInfoW
FormatMessageW
IsValidCodePage
EnumSystemLocalesW

api-ms-win-core-string-l1-1-0

CompareStringEx
GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsGetValue
FlsAlloc
FlsSetValue

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleA
WriteConsoleW
SetConsoleMode
ReadConsoleW
WriteConsoleA
AllocConsole

api-ms-win-core-handle-l1-1-0

SetHandleInformation
DuplicateHandle
CloseHandle

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalAlloc
LocalFree
GlobalFree

api-ms-win-core-file-l2-1-0

CreateDirectoryExW
MoveFileExW
ReplaceFileW
CopyFileExW
ReadDirectoryChangesW

api-ms-win-core-com-l1-1-0

StringFromGUID2
CoTaskMemFree
CoUninitialize
CoSetProxyBlanket
PropVariantClear
CoInitializeEx
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoGetObjectContext
StringFromCLSID
CoGetApartmentType
CLSIDFromString
CoInitializeSecurity
CoCreateInstance

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-io-l1-1-0

DeviceIoControl
CancelIoEx
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatus

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW
WaitForMultipleObjects

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW
LoadLibraryA

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo
SetConsoleTextAttribute

api-ms-win-core-synch-l1-2-0

InitializeConditionVariable
SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
InitOnceComplete
InitOnceBeginInitialize
WakeConditionVariable

mswsock

GetAcceptExSockaddrs
AcceptEx

api-ms-win-core-io-l1-1-1

CancelIo

bcrypt

BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot
Process32NextW
Process32FirstW

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject
MoveFileW
UnregisterWait
CreateFileMappingA
GetSystemPowerStatus
GetComputerNameW

api-ms-win-core-psapi-l1-1-0

K32GetModuleInformation
QueryFullProcessImageNameW
K32GetModuleFileNameExW
K32GetProcessMemoryInfo

iphlpapi

GetExtendedTcpTable
GetAdaptersAddresses

api-ms-win-ntuser-sysparams-l1-1-0

SystemParametersInfoW
GetSystemMetrics

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock
GlobalSize

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo
GetNativeSystemInfo

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-file-l1-2-2

AreFileApisANSI
GetTempPathA

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
VirtualProtectEx
MapViewOfFile
UnmapViewOfFile
VirtualFree
VirtualProtect
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
VirtualQuery
ReadProcessMemory

api-ms-win-core-synch-ansi-l1-1-0

CreateSemaphoreA
OpenMutexA

api-ms-win-core-kernel32-legacy-l1-1-2

OpenFileMappingA

api-ms-win-core-console-l1-2-0

AttachConsole

api-ms-win-core-console-l3-2-0

GetCurrentConsoleFont

api-ms-win-core-job-l2-1-0

CreateJobObjectW
SetInformationJobObject
AssignProcessToJobObject

crypt32

CertCloseStore
CertOpenStore
CertGetNameStringA
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain

api-ms-win-core-fibers-l2-1-0

DeleteFiber
ConvertFiberToThread
SwitchToFiber

api-ms-win-core-fibers-l2-1-1

ConvertThreadToFiberEx
CreateFiberEx

winhttp

WinHttpGetProxyForUrl
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpSetTimeouts

api-ms-win-core-processthreads-l1-1-3

SetThreadDescription

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-processthreads-l1-1-2

SetThreadInformation

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask

api-ms-win-core-localization-l1-2-1

EnumSystemLocalesEx

api-ms-win-mm-time-l1-1-0

timeGetTime

kernel32

RegisterApplicationRestart
QueryDosDeviceW
TerminateJobObject
K32EnumProcessModules
QueryInformationJobObject
PowerCreateRequest
PowerSetRequest
PowerClearRequest

dsound

ord2
ord11

avrt

AvRevertMmThreadCharacteristics
AvSetMmThreadPriority
AvSetMmThreadCharacteristicsW

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork

Exports

Exports

GetHandleVerifier
IsSandboxedProcess

Sections

.text
Size: 19.4MB - Virtual size: 19.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7.5MB - Virtual size: 7.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1021KB - Virtual size: 1021KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 267KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4308179fe9f41353d444b25ca9f251b0

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0f:ab:67:0a:61:bf:4b:7d:af:d5:59:35:6b:5b:cc:ffCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

82:d4:ca:36:c9:a1:93:bd:4d:ed:61:90:04:4b:31:ac:5c:6f:4e:fd:0e:8e:62:4c:44:49:27:fb:69:8e:c8:9bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

gdiplus

dbghelp

ntdll

oleaut32

userenv

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-console-l2-1-0

api-ms-win-core-synch-l1-2-0

mswsock

api-ms-win-core-io-l1-1-1

bcrypt

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-psapi-l1-1-0

iphlpapi

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-file-l1-2-2

api-ms-win-core-memory-l1-1-0

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-2

api-ms-win-core-console-l1-2-0

api-ms-win-core-console-l3-2-0

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0f:ab:67:0a:61:bf:4b:7d:af:d5:59:35:6b:5b:cc:ff
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

82:d4:ca:36:c9:a1:93:bd:4d:ed:61:90:04:4b:31:ac:5c:6f:4e:fd:0e:8e:62:4c:44:49:27:fb:69:8e:c8:9b
Signer

.text
Size: 19.4MB - Virtual size: 19.4MB

.rdata
Size: 4.8MB - Virtual size: 4.8MB

.data
Size: 7.5MB - Virtual size: 7.7MB

.pdata
Size: 1021KB - Virtual size: 1021KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 72KB - Virtual size: 71KB

.reloc
Size: 267KB - Virtual size: 266KB