c60c6646c885c478dc1cb676e13ef188ecadd542cb310015ed3eab41e5874f8f

Sharing

Copy URL Twitter E-mail

General

Target
c60c6646c885c478dc1cb676e13ef188ecadd542cb310015ed3eab41e5874f8f
Size 949KB
Sample240529-gvs2fscg7y
SHA256 c60c6646c885c478dc1cb676e13ef188ecadd542cb310015ed3eab41e5874f8f
MD5 415f4e5f26ebe98c2005067700ac8058
SHA1 946df2a963d26b7aaec666851017957cf410483a
SHA512 5d73b887e6656eb38943cd5672b1dbd6a205c1a5fc6617493ca098c4ca785451261f3824247375c41cb6bdeefa0d7a4de0aff9868c222e5cf38dba73d5f5b9d9
SSDEEP 24576:/UrlDUTEEp0nDkkl5lEzl7jCocrbZjQFnrEH72:MrlDUTKDkkPqZfCbbZjQFb
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

c60c6646c885c478dc1cb676e13ef188ecadd542cb310015ed3eab41e5874f8f

.dll 949KB

c60c6646c885c478dc1cb676e13ef188ecadd542cb310015ed3eab41e5874f8f

IMPHASH 24e31861b931e2ac6c23e8ef2317fcb8
SHA256 c60c6646c885c478dc1cb676e13ef188ecadd542cb310015ed3eab41e5874f8f
MD5 415f4e5f26ebe98c2005067700ac8058
SHA1 946df2a963d26b7aaec666851017957cf410483a
SHA512 5d73b887e6656eb38943cd5672b1dbd6a205c1a5fc6617493ca098c4ca785451261f3824247375c41cb6bdeefa0d7a4de0aff9868c222e5cf38dba73d5f5b9d9
SSDEEP 24576:/UrlDUTEEp0nDkkl5lEzl7jCocrbZjQFnrEH72:MrlDUTKDkkPqZfCbbZjQFb
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

a4:76:27:01:3b:93:82:49:9d:1c:5d:e3:19:93:9c:9a:07:42:25:6e:e4:bc:28:4e:26:06:35:83:c5:2f:8c:a7

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Adobe Inc.,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Mar 31, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0c:a5:3a:80:73:82:6e:b3:78:4a:5e:d4:d0:41:14:94

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2022 - May 1, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

361136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\cruser\workspace\CR-Windows-x86-Client-Builder\Win32\Release_MT\CRClient.pdb

dbghelp

SymFromAddr StackWalk64 SymGetModuleBase64 SymFunctionTableAccess64 SymGetModuleInfo64 SymInitialize

kernel32

GetProcessHeap SetUnhandledExceptionFilter VirtualProtect WriteProcessMemory GetCurrentProcess MultiByteToWideChar GetModuleHandleW CloseHandle CreateThread WaitForSingleObject GetModuleFileNameW FreeLibrary ReadFile GetCurrentThreadId ReadProcessMemory TerminateProcess GetCurrentProcessId TerminateThread OpenThread ConnectNamedPipe GetProcessId GetThreadId K32GetModuleFileNameExW SuspendThread GetThreadContext ResumeThread LocaleNameToLCID LoadLibraryW WerRegisterRuntimeExceptionModule WerUnregisterRuntimeExceptionModule GetSystemDirectoryW VerSetConditionMask VerifyVersionInfoW GetTimeZoneInformation CreateProcessW WideCharToMultiByte CreateFileW FindFirstFileW FindNextFileW FindClose CreateNamedPipeW WriteFile FlushFileBuffers DisconnectNamedPipe GetFileAttributesExW GetSystemInfo HeapReAlloc GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW ReadConsoleW GetConsoleMode GetConsoleCP GetFileSizeEx GetFileType GetStdHandle ExitProcess SetEnvironmentVariableW GetModuleHandleExW ExitThread SetConsoleCtrlHandler DeleteFileW RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualAlloc GetVersionExW LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority HeapFree HeapAlloc HeapDestroy DecodePointer GetProcAddress FindResourceExW FindResourceW SizeofResource LockResource HeapSize LoadResource DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WriteConsoleW GetOEMCP SignalObjectAndWait CreateTimerQueue InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter ResetEvent SetEvent OutputDebugStringW IsDebuggerPresent GetLocaleInfoW LCMapStringW CompareStringW GetStringTypeW DuplicateHandle WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThread GetExitCodeThread EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection QueryPerformanceCounter QueryPerformanceFrequency FindFirstFileExW SetEndOfFile SetFilePointerEx EncodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetCPInfo

user32

DialogBoxIndirectParamW SetPropW EndDialog GetPropW EnumWindows GetWindowThreadProcessId IsWindowVisible IsHungAppWindow DisableProcessWindowsGhosting MessageBoxW GetWindowTextW GetWindowTextLengthW ReleaseDC DrawIconEx GetSysColor GetDC SetFocus GetDlgCtrlID IsDlgButtonChecked PostMessageW ShowWindow GetSystemMenu EnableMenuItem EnableWindow CheckDlgButton GetSysColorBrush CallWindowProcW GetWindow SetWindowTextW SetDlgItemTextW SetWindowPos OffsetRect CopyRect GetDesktopWindow GetKeyState GetDlgItem GetWindowLongW GetParent SetCursor LoadCursorW ReleaseCapture PtInRect ClientToScreen GetWindowRect SetCapture InvalidateRect GetCapture SendMessageW SetWindowLongW RemovePropW

gdi32

CreateSolidBrush CreateCompatibleBitmap CreateCompatibleDC SelectObject SetBkMode CreateFontIndirectW GetObjectW DeleteObject SetTextColor DeleteDC

advapi32

RegDeleteValueW RegSetValueExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegOpenKeyExW

shell32

SHCreateDirectoryExW SHGetKnownFolderPath ord6

ole32

CoCreateGuid CoTaskMemFree

shlwapi

PathAppendW PathFileExistsW

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

c60c6646c885c478dc1cb676e13ef188ecadd542cb310015ed3eab41e5874f8f

PE Signature issue

dbghelp

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

wintrust

generic