e1df905236760a0082c0878c2c5689237111255857e21b4651283529e0764298

Sharing

Copy URL Twitter E-mail

General

Target
e1df905236760a0082c0878c2c5689237111255857e21b4651283529e0764298
Size 192KB
Sample240530-errywaea6s
SHA256 e1df905236760a0082c0878c2c5689237111255857e21b4651283529e0764298
MD5 6565a56e53be7c4ce59b996e184b9f61
SHA1 b6f68545d64f26fab0a1975e471e9254c2e0dd01
SHA512 09c86697603786f826a459a4b3e88fca7a4f07d10e732308cfe52a49a7d5e24227b5306adc8e22c086d8fdc43a2ddb00770910e4a25bd183105d325d0253d840
SSDEEP 3072:epb2h5DwosEag8FD33weQnkLZsxksqFcpxtbs28isWz1D3VQyAC3cmg11/Ym4Ziv:aaUosEajFTw3kLvsacpxVOuFC+Xx79/a
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

e1df905236760a0082c0878c2c5689237111255857e21b4651283529e0764298

.exe 192KB

e1df905236760a0082c0878c2c5689237111255857e21b4651283529e0764298

IMPHASH 1147194ef02b355e02af1f49c57e76a8
SHA256 e1df905236760a0082c0878c2c5689237111255857e21b4651283529e0764298
MD5 6565a56e53be7c4ce59b996e184b9f61
SHA1 b6f68545d64f26fab0a1975e471e9254c2e0dd01
SHA512 09c86697603786f826a459a4b3e88fca7a4f07d10e732308cfe52a49a7d5e24227b5306adc8e22c086d8fdc43a2ddb00770910e4a25bd183105d325d0253d840
SSDEEP 3072:epb2h5DwosEag8FD33weQnkLZsxksqFcpxtbs28isWz1D3VQyAC3cmg11/Ym4Ziv:aaUosEajFTw3kLvsacpxVOuFC+Xx79/a
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

a2:11:f7:d1:5e:58:f4:0e:2a:6f:61:63:b0:8f:db:c5:67:e0:13:3a:64:35:ba:ba:ee:f2:1b:da:8d:6f:29:bb

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

Chains

Dec 19, 2023

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2021 - Dec 29, 2040

Subject

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

Serial Number

31:9d:9d:48:1a:b6:f5:e0:92:bc:c5:e3:4f:f7:3c:5b

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 11, 2022 - Oct 11, 2025

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Time Stamping CA - TS2,O=Entrust\, Inc.,C=US

Serial Number

25:bc:2b:f3:29:ca:10:7f:1e:a9:ba:88:85:d4:9d:3b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Dec 29, 2040

Subject

CN=Entrust Timestamp Authority - TSA2,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

4a:14:dd:b8:91:ab:9c:0f:99:f1:25:ed:c5:9a:b6:d5

Issuer

CN=Entrust Time Stamping CA - TS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 4, 2022 - Jan 1, 2029

Minor OS version

Major OS version

Entry point

67540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA CreateFileW GetDriveTypeA GetFileAttributesW QueryDosDeviceW GetVolumeNameForVolumeMountPointW CloseHandle SetErrorMode GetOverlappedResult InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject CreateEventA CreateThread SetThreadPriority GetModuleHandleW GetProcAddress WaitForMultipleObjects GetVolumeInformationA ReadDirectoryChangesW MultiByteToWideChar WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc CompareStringW LCMapStringW GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle GetStringTypeW GetProcessHeap SetFilePointerEx WriteConsoleW HeapSize HeapReAlloc ReadFile ReadConsoleW VirtualAlloc

Name

.text

Size

129KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e1df905236760a0082c0878c2c5689237111255857e21b4651283529e0764298

PE Signature issue

kernel32

generic