2e353132fb63ea9056c83d9e7e030abb.bin
- SHA256 888cb943d04c0b3dcaf740640d7856f811d25e409371184b2d26bc598b8934c7
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
6cb35e6d5e3dc675d2b2fac2e86012d3da4134b213169ef26481c4eb2f90845a.exe
Resource
win7-20240508-en
windows7-x64
10 signatures
150 seconds
General
- Target 2e353132fb63ea9056c83d9e7e030abb.bin
- Size 1.7MB
- Sample240607-bnebtsgb48
- SHA256 888cb943d04c0b3dcaf740640d7856f811d25e409371184b2d26bc598b8934c7
- MD5 5ac007f3654d121e34682ab97f87c4a1
- SHA1 9bc3949a36a728ea3650ac6b00d6d52394689932
- SHA512 ac393442d580c45267e04753d1ef533abc4ca71cffba8510a596a6d3bc6d50dc8aea59ac550c29b3f9716a28205461f76af7e16576237ada4b5a3624965c878b
- SSDEEP 49152:3ZpjZ+ZQullaP7o/XZXcIvi7wUDG13zmm/XcN0sljoQ0:p/+ZJlUP7HIvDVYId5
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
2e353132fb63ea9056c83d9e7e030abb.bin.zip 1.7MB
-
6cb35e6d5e3dc675d2b2fac2e86012d3da4134b213169ef26481c4eb2f90845a.exe.exe 2.2MB
6cb35e6d5e3dc675d2b2fac2e86012d3da4134b213169ef26481c4eb2f90845a.exe
- IMPHASH 0ae8577c85edd6de7ab512e6ace9adb0
- SHA256 6cb35e6d5e3dc675d2b2fac2e86012d3da4134b213169ef26481c4eb2f90845a
- MD5 2e353132fb63ea9056c83d9e7e030abb
- SHA1 122894bbcfe114fe28ce94da7dddb363581edc06
- SHA512 116e4b2f7129de130237197c281c9238095f80f2af4a68bd617ec9d07c7de2f0580f273fd777214304da77dc856eb357d455d9c5996d14c166cecc66cc060183
- SSDEEP 49152:kGMK7sPVFjY2nyZSNB4t48sUjbpcZ36kWT1r2+I6cMMyIks:rMK6FY2yZSg4RY+krNIFf
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
59:fb:07:05:64:9d:7b:66:97:b7:ee:12:eb:c3:3f:01:12:36:67:3f:80:23:8a:e5:e2:27:0f:42:20:74:83:61
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=91310115607394704N,CN=Shanghai Cabo Paint Co.\, Ltd.,O=Shanghai Cabo Paint Co.\, Ltd.,L=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 1, 0001
Subject
SERIALNUMBER=91310115607394704N,CN=Shanghai Cabo Paint Co.\, Ltd.,O=Shanghai Cabo Paint Co.\, Ltd.,L=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
7b:6c:ac:e3:61:04:a9:0b:ff:22:22:4f:0a:fd:b5:2d
Issuer
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 3, 2024 - Jun 2, 2025
Subject
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 26, 2019 - Mar 22, 2034
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
83216
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\_work\1\s\src\Setup\bin\Release\Setup.pdb
kernel32
InitializeCriticalSectionEx
GetFileAttributesW
CreateFileW
SetFilePointer
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryW
MultiByteToWideChar
LocalFileTimeToFileTime
WideCharToMultiByte
CreateDirectoryW
WriteFile
SetFileTime
FreeResource
LoadResource
FindResourceW
SizeofResource
LockResource
CopyFileW
FindFirstFileW
FindClose
CreateProcessW
IsWow64Process
lstrcmpiW
LeaveCriticalSection
RaiseException
EnterCriticalSection
LoadLibraryExW
GetCurrentThreadId
DecodePointer
WriteConsoleW
SetStdHandle
FreeLibrary
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
LoadLibraryW
GetCurrentProcess
GetModuleFileNameW
DeleteFileW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
MoveFileW
GetTempFileNameW
GetLastError
GetTempPathW
lstrlenW
DeleteCriticalSection
GetModuleHandleW
GetProcAddress
VerSetConditionMask
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
HeapSize
ReadConsoleW
SetFilePointerEx
GetConsoleMode
SetEndOfFile
GetConsoleCP
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
HeapAlloc
HeapFree
VerifyVersionInfoW
GetStringTypeW
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwind
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
user32
ExitWindowsEx
wsprintfW
CharNextW
MessageBoxW
DestroyWindow
GetActiveWindow
LoadStringW
advapi32
GetTokenInformation
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegGetValueW
RegCloseKey
GetUserNameW
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
RegSetValueExW
RegQueryValueExW
shell32
ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
oleaut32
VariantInit
SysAllocString
SysFreeString
VarUI4FromStr
VariantClear
urlmon
URLDownloadToFileW
version
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
shlwapi
PathFileExistsW
comctl32
InitCommonControlsEx
Name
.text
Size
210KB
Virtual Size
209KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
2JVO!@
Size
845KB
Virtual Size
848KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=157, id=243, version=40116,
count=29, id=242, version=40116,
count=23, id=259, version=26706,
count=71, id=261, version=26706,
count=35, id=260, version=26706,
count=2, id=206, version=65501,
count=1, id=208, version=65501,
count=21, id=203, version=65501,
count=165, id=1, productName=Unmarked objects,
count=8, id=265, version=27051,
count=1, id=255, version=27051,
count=1, id=151,
count=1, id=258, version=27051,