46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe
Size 9.9MB
Sample240603-rewgraha3w
SHA256 46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb
MD5 711e1fcfc587eee41a187abd9091bfea
SHA1 cb1e234580935af2f597d9e667f8d2599368abe3
SHA512 bb0f540acf5e0e9f5044e3c2868f8aec88199ae5e9007a6df2a904a60b33079cd4d94e66ff195b898c6fe0d91075fb77a789a5e64769b6b4cba81232dc91fdb5
SSDEEP 196608:tYohctfEFaaf+vApItM1rf/c3y+OykakmBaREv12zsE1EyamEVgwNzYtdeu8T:tYictfEFv+vHC1b/cXcyGE92h1om3oYS
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe

.exe 9.9MB

46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe

IMPHASH 657e40fb09b2c5e277b865a7cf2b8089
SHA256 46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb
MD5 711e1fcfc587eee41a187abd9091bfea
SHA1 cb1e234580935af2f597d9e667f8d2599368abe3
SHA512 bb0f540acf5e0e9f5044e3c2868f8aec88199ae5e9007a6df2a904a60b33079cd4d94e66ff195b898c6fe0d91075fb77a789a5e64769b6b4cba81232dc91fdb5
SSDEEP 196608:tYohctfEFaaf+vApItM1rf/c3y+OykakmBaREv12zsE1EyamEVgwNzYtdeu8T:tYictfEFv+vHC1b/cXcyGE92h1om3oYS
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

52:07:d7:4d:37:2d:6d:7f:79:12:64:63:d7:d3:39:dd:c1:21:1f:f8:20:db:aa:83:81:82:3b:e6:1e:47:57:e5

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US

Chains

Oct 18, 2023

CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US

Serial Number

06:c3:e3:0f:10:1b:62:fe:0a:49:9e:b1:18:90:12:ea

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 26, 2022 - Feb 26, 2025

Minor OS version

Major OS version

Entry point

289392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

D:\a\wix\wix\build\burn\Release\x86\burn.pdb

kernel32

GetUserDefaultUILanguage GetUserDefaultLangID GetSystemDefaultLangID GetStringTypeW ReadFile SetFilePointerEx CreateProcessW DuplicateHandle FreeLibrary ProcessIdToSessionId ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW OpenProcess GetProcessId SetProcessShutdownParameters LocalFileTimeToFileTime SetEndOfFile SetFileTime GetExitCodeThread DosDateTimeToFileTime CompareStringA SetThreadExecutionState ReleaseSemaphore CreateMutexW GetExitCodeProcess CreateFileMappingW MapViewOfFile UnmapViewOfFile UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException GetStdHandle ExitProcess GetModuleHandleExW VerifyVersionInfoW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileSizeEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode DecodePointer WriteConsoleW GetComputerNameW GetSystemTime VerSetConditionMask CompareStringW GetNativeSystemInfo CreateThread GetCurrentProcess CreateSemaphoreW CreateEventW ReleaseMutex ResetEvent SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection MoveFileExW SetFileAttributesW RemoveDirectoryW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW GetCurrentDirectoryW ExpandEnvironmentStringsW GetProcessHeap HeapSize HeapFree GetDateFormatW HeapReAlloc HeapAlloc GetModuleFileNameW GetSystemWow64DirectoryW GetSystemDirectoryW GetLocalTime Sleep SetLastError GetTempPathW GetVolumePathNameW GetTempFileNameW GetFullPathNameW CreateDirectoryW LCMapStringW WideCharToMultiByte MultiByteToWideChar lstrlenW FormatMessageW LocalFree LoadLibraryExW GetProcAddress GetModuleHandleW WaitForMultipleObjects WaitForSingleObject HeapSetInformation GetLastError lstrlenA GetCurrentProcessId GetModuleHandleA MulDiv CompareStringOrdinal GetSystemWindowsDirectoryW GlobalAlloc GlobalFree CopyFileW LoadResource LockResource SizeofResource FindResourceExA VirtualAlloc VirtualFree SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetTimeZoneInformation GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA WriteFile SetFilePointer CreateFileA CloseHandle CreateFileW

user32

ReleaseDC MonitorFromPoint MonitorFromWindow GetDC GetMonitorInfoW ShowWindow IsDialogMessageW LoadCursorW LoadBitmapW SetWindowLongW GetWindowLongW GetCursorPos MessageBoxW SetWindowPos CreateWindowExW UnregisterClassW RegisterClassW PostQuitMessage DefWindowProcW DispatchMessageW TranslateMessage GetMessageW WaitForInputIdle IsWindow PostMessageW

gdi32

SelectObject StretchBlt GetObjectW DeleteObject DeleteDC GetDeviceCaps CreateCompatibleDC CreateDCW

advapi32

CryptHashData CryptDestroyHash CryptReleaseContext OpenProcessToken AllocateAndInitializeSid CheckTokenMembership GetTokenInformation AdjustTokenPrivileges IsWellKnownSid LookupPrivilegeValueW CryptCreateHash RegCreateKeyExW RegDeleteKeyW RegEnumKeyExW RegEnumValueW RegSetValueExW CryptGetHashParam QueryServiceStatus OpenServiceW OpenSCManagerW ControlService CloseServiceHandle ChangeServiceConfigW SetEntriesInAclW DecryptFileW InitializeAcl CreateWellKnownSid ConvertStringSecurityDescriptorToSecurityDescriptorW ReportEventW OpenEventLogW CloseEventLog RegQueryInfoKeyW RegDeleteValueW RegQueryValueExW GetUserNameW InitiateSystemShutdownExW RegOpenKeyExW RegCloseKey QueryServiceConfigW SetNamedSecurityInfoW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetEntriesInAclA CryptAcquireContextW

ole32

CoInitializeEx CoInitialize CoInitializeSecurity CoUninitialize CLSIDFromProgID CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

VariantInit SysAllocString VariantClear SysFreeString

rpcrt4

UuidCreate

shell32

SHGetFolderPathW CommandLineToArgvW ShellExecuteExW

Name

.text

Size

432KB

Virtual Size

432KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

184KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

204B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

275KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

46514a81626d3c58a48f0bdd17c9bdb2352004ae4ab79af1ca50ff285bcb68cb.exe

PE Signature issue

kernel32

user32

gdi32

advapi32

ole32

oleaut32

rpcrt4

shell32

generic