6c959214ddfc52098b71f6db88766dd12eb9508afa2090c8bc9c9ddf79a0c489

Sharing

Copy URL Twitter E-mail

General

Target
6c959214ddfc52098b71f6db88766dd12eb9508afa2090c8bc9c9ddf79a0c489
Size 151KB
Sample240613-3zycmazfmn
SHA256 6c959214ddfc52098b71f6db88766dd12eb9508afa2090c8bc9c9ddf79a0c489
MD5 c701f9f3bd4e2150513eb36d22645fb8
SHA1 39e128385ae36c04d038b1d8a5f39ba7221f6a3f
SHA512 a4e84621e3ea085a05d60c186d4c08210b2d1cc209f252bf024d1dfd4467452b9428f79fc8f8e1c2845ea7dff042df9d69eb9ad52c36f63e504e5465586250ad
SSDEEP 3072:So5sRbO6SBgTCPZ0W1f8zEXahv0bX+m6SLXULDWaPXpyq0p2:So5sRbO6STPLRahvS+YXUXWa
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

6c959214ddfc52098b71f6db88766dd12eb9508afa2090c8bc9c9ddf79a0c489

.exe 151KB

6c959214ddfc52098b71f6db88766dd12eb9508afa2090c8bc9c9ddf79a0c489

IMPHASH 6a3f639b41bedc02289b74e05cbf1d2b
SHA256 6c959214ddfc52098b71f6db88766dd12eb9508afa2090c8bc9c9ddf79a0c489
MD5 c701f9f3bd4e2150513eb36d22645fb8
SHA1 39e128385ae36c04d038b1d8a5f39ba7221f6a3f
SHA512 a4e84621e3ea085a05d60c186d4c08210b2d1cc209f252bf024d1dfd4467452b9428f79fc8f8e1c2845ea7dff042df9d69eb9ad52c36f63e504e5465586250ad
SSDEEP 3072:So5sRbO6SBgTCPZ0W1f8zEXahv0bX+m6SLXULDWaPXpyq0p2:So5sRbO6STPLRahvS+YXUXWa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Avira GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development 2009,O=Avira GmbH,L=Tettnang,ST=Baden-Wuerttemberg,C=DE

Serial Number

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2009 - Feb 11, 2012

Minor OS version

Major OS version

Entry point

5772

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrlenW GetTimeFormatA TlsAlloc CopyFileA EnumDateFormatsW SetComputerNameA EnumDateFormatsA GetAtomNameA EnumTimeFormatsW GetExitCodeThread GetSystemDirectoryA GetShortPathNameW SystemTimeToFileTime ExitProcess SetLocaleInfoA GetWindowsDirectoryA VirtualAlloc GetCurrentProcessId FileTimeToDosDateTime InitializeCriticalSection WaitForMultipleObjects GetTempPathW OpenFile OpenProcess CreateSemaphoreW GetLocaleInfoW GetEnvironmentVariableA GetShortPathNameA OpenEventW SetLastError lstrcpyn

user32

AppendMenuA LoadIconW LoadBitmapW ShowWindow GetWindowTextW ActivateKeyboardLayout ClientToScreen RegisterClassExW LoadBitmapA RegisterClassExA TrackPopupMenu CreateMenu GetMenuStringA UnregisterClassW LoadMenuA GetClassInfoExA GetClassInfoExW

gdi32

RectInRegion FixBrushOrgEx GetBoundsRect CreatePolygonRgn OffsetWindowOrgEx GetROP2 ExtEscape BitBlt PolyBezier SetPaletteEntries CreateFontIndirectExA SwapBuffers CombineRgn TranslateCharsetInfo

advapi32

RegOpenKeyExA RegDeleteKeyA RegCloseKey

ole32

CoInitialize CoFileTimeNow CoDosDateTimeToFileTime OleCreateEx

winmm

mixerSetControlDetails waveInGetDevCapsA

winspool.drv

SetPrinterW ConvertUnicodeDevModeToAnsiDevmode QuerySpoolMode GetPrinterDataExW EnumPrintProcessorsA AddPrinterConnectionA QueryColorProfile

Name

.+#.

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bZh!

Size

2KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.umBv

Size

1024B

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.0J

Size

512B

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1024B

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.)'%

Size

2KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

732B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6c959214ddfc52098b71f6db88766dd12eb9508afa2090c8bc9c9ddf79a0c489

PE Signature issue

kernel32

user32

gdi32

advapi32

ole32

winmm

winspool.drv

generic