09eceec007aab5ee60df1cf76cea1f7b6511806f884334d6a620cb6d8bc7633f

Sharing

Copy URL Twitter E-mail

General

Target
09eceec007aab5ee60df1cf76cea1f7b6511806f884334d6a620cb6d8bc7633f
Size 2.6MB
Sample240610-d4j85abf2y
SHA256 09eceec007aab5ee60df1cf76cea1f7b6511806f884334d6a620cb6d8bc7633f
MD5 725c7e20795933354a400bc60162b11c
SHA1 6697b0d7a1c449a2b3e8539721098cd4d34009e2
SHA512 091e08ac2926514efbe5f833a98c24af235286e9e2f5ec84bb75394cf373da9b10f0c5c5a973b9519b8d6616b84aa6d44125e85a7f567ea5340a6733b929f8e2
SSDEEP 49152:m8RtOFSsg/q2/1upBeEytP4VKpHThGZ7aM0KB4JRwTckxs8sLv:m8Rj/qlot6VKPGhB4Jt
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

09eceec007aab5ee60df1cf76cea1f7b6511806f884334d6a620cb6d8bc7633f

.exe 2.6MB

09eceec007aab5ee60df1cf76cea1f7b6511806f884334d6a620cb6d8bc7633f

IMPHASH d5c73fc3222fb91b5e280f7fdbfe32d7
SHA256 09eceec007aab5ee60df1cf76cea1f7b6511806f884334d6a620cb6d8bc7633f
MD5 725c7e20795933354a400bc60162b11c
SHA1 6697b0d7a1c449a2b3e8539721098cd4d34009e2
SHA512 091e08ac2926514efbe5f833a98c24af235286e9e2f5ec84bb75394cf373da9b10f0c5c5a973b9519b8d6616b84aa6d44125e85a7f567ea5340a6733b929f8e2
SSDEEP 49152:m8RtOFSsg/q2/1upBeEytP4VKpHThGZ7aM0KB4JRwTckxs8sLv:m8Rj/qlot6VKPGhB4Jt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

7a:66:d4:24:36:ea:8b:cb:5f:8a:ee:e1:28:a2:71:78:7b:f6:6a:d2:05:37:9e:9f:85:ec:63:aa:64:3c:44:39

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Xing Wang,O=Xing Wang,L=Shanghai,C=CN,1.2.840.113549.1.9.1=#0c1277786865726540686f746d61696c2e636f6d

Chains

Jun 7, 2024

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 29, 2015 - Jun 9, 2027

Subject

CN=Xing Wang,O=Xing Wang,L=Shanghai,C=CN,1.2.840.113549.1.9.1=#0c1277786865726540686f746d61696c2e636f6d

Serial Number

0b:1a:d7:f3:8c:1e:fa:c6:01:be:a4:3a:b2:a2:ef:aa

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftKernelCodeSigning

Timespan

Dec 8, 2020 - Dec 8, 2023

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2021,O=Asseco Data Systems S.A.,C=PL

Serial Number

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2032

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Minor OS version

Major OS version

Entry point

556359

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FreeLibraryAndExitThread ExitThread FileTimeToSystemTime PeekNamedPipe CreateWaitableTimerA ResumeThread SetWaitableTimer OpenEventA WaitForMultipleObjectsEx AreFileApisANSI DeviceIoControl GetFullPathNameW GetCurrentDirectoryW LoadLibraryExW GetProcAddress FreeLibrary FormatMessageW WideCharToMultiByte MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead ReleaseSemaphore LoadLibraryW GetVersionExW GetSystemDefaultLangID GetSystemInfo GlobalMemoryStatus WaitForSingleObject GetModuleFileNameW GetLongPathNameW GetTempFileNameW GetCommandLineW GetFileAttributesW FormatMessageA CreateFileW ReadFile WriteFile FlushFileBuffers SetFilePointer SetEndOfFile GetFileInformationByHandle VirtualAlloc VirtualFree SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetCurrentThread SetThreadPriority Sleep QueryPerformanceFrequency DuplicateHandle CreateSemaphoreA GetModuleHandleA GetDriveTypeW GetThreadTimes SetConsoleCtrlHandler SetConsoleTextAttribute GetStdHandle OutputDebugStringA ReleaseMutex OpenEventW UnmapViewOfFile MapViewOfFile TerminateThread WaitForMultipleObjects InitializeCriticalSection CreateMutexW CreateThread RtlUnwind InterlockedPushEntrySList RaiseException GetCommandLineA ExitProcess GetModuleHandleExW GetACP GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW OutputDebugStringW SetStdHandle HeapSize GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW GetEnvironmentVariableW LoadLibraryA FindFirstFileW SetConsoleMode ReadConsoleA ReadConsoleW InterlockedDecrement lstrlenW InterlockedIncrement GetExitCodeProcess DebugBreak lstrlenA CreateProcessW GlobalAlloc GlobalFree MulDiv GetPrivateProfileStringW WritePrivateProfileStringW CreateDirectoryW GetFileAttributesExW CreateFileMappingW OpenFileMappingW TerminateProcess GetCurrentProcess HeapFree LocalFree GetProcessHeap HeapAlloc GetLastError CreateEventA CloseHandle GetTempPathW SetEvent

user32

GetUserObjectInformationW MessageBoxW GetProcessWindowStation LoadStringW CharNextW GetActiveWindow MoveWindow GetClientRect GetWindowRect MapWindowPoints GetWindow GetWindowLongW SetWindowLongW GetDC

advapi32

RegOpenKeyExW RegCloseKey OpenProcessToken AdjustTokenPrivileges CryptReleaseContext CryptGenRandom QueryServiceStatusEx SetServiceStatus CreateServiceW ChangeServiceConfig2W DeleteService OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceObjectSecurity GetSecurityDescriptorDacl BuildExplicitAccessWithNameW SetEntriesInAclW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetServiceObjectSecurity StartServiceW ControlService RegQueryValueExW RegOpenKeyW RegSetValueExW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW

winmm

timeGetTime

shell32

SHGetSpecialFolderPathW SHFileOperationW

gdi32

GetDeviceCaps SetLayout

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

rpcrt4

RpcStringFreeA UuidToStringA

ws2_32

send WSACleanup WSAGetLastError closesocket recv WSASetLastError

ole32

CoCreateGuid

Sharing

General

Malware Config

Signatures

File Explorer

09eceec007aab5ee60df1cf76cea1f7b6511806f884334d6a620cb6d8bc7633f

PE Signature issue

kernel32

user32

advapi32

winmm

shell32

gdi32

version

rpcrt4

ws2_32

ole32

generic