SecuriteInfo[.]com[.]Win64[.]MalwareX-gen[.]4428[.]30234[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Win64.MalwareX-gen.4428.30234.exe
Size 1.0MB
Sample240613-np1bxa1cpr
SHA256 b03c08b6749794c5cd972c565c3215e51a00faebc640e9e2c6bf861a53797a24
MD5 0a31329b6172776635649ab5005c4671
SHA1 3c427ed1d329771bf254da2ce40ad63ce46ec8b3
SHA512 6e91d3689c5adc5e76d684f7803716c68efe6573c1ffe0e1ce53913bc1c1034ed544a35f2ef132fd1e904fdd0db9fff0520aed0132c9cb60da117b1583e70805
SSDEEP 12288:l+YQOafj69sTHbjwoHaGAkaYUwjfQONtdunMtz3EYAFXIgngm4dMMrT0wga1KOxo:Hs3AVM3rTxb17G5PWMU9dkh8gQ4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Win64.MalwareX-gen.4428.30234.exe

.exe 1.0MB

SecuriteInfo.com.Win64.MalwareX-gen.4428.30234.exe

IMPHASH 6df91d70e9f04b921cf80ac4e8d038bb
SHA256 b03c08b6749794c5cd972c565c3215e51a00faebc640e9e2c6bf861a53797a24
MD5 0a31329b6172776635649ab5005c4671
SHA1 3c427ed1d329771bf254da2ce40ad63ce46ec8b3
SHA512 6e91d3689c5adc5e76d684f7803716c68efe6573c1ffe0e1ce53913bc1c1034ed544a35f2ef132fd1e904fdd0db9fff0520aed0132c9cb60da117b1583e70805
SSDEEP 12288:l+YQOafj69sTHbjwoHaGAkaYUwjfQONtdunMtz3EYAFXIgngm4dMMrT0wga1KOxo:Hs3AVM3rTxb17G5PWMU9dkh8gQ4
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

34:b6:cb:be:33:1c:f8:20:b2:d4:42:02:36:e0:2d:9a:9b:16:af:03:be:3c:03:6a:ed:18:9a:03:a2:b4:ae:5f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91510100677184972A,CN=四川迅游网络科技股份有限公司,O=四川迅游网络科技股份有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e68890e983bde9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Apr 24, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:5d:45:23:54:52:ea:9e:e9:0c:37:04:98:8e:02:8e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 21, 2022 - May 2, 2025

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

257908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Process32FirstW CloseHandle VirtualAllocEx Process32NextW SetEndOfFile WriteConsoleW HeapSize CreateFileW GetLastError CreateToolhelp32Snapshot OpenProcess GlobalAddAtomW GetModuleFileNameW CreateRemoteThread WriteProcessMemory SetStdHandle OutputDebugStringW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW FormatMessageA EncodePointer DecodePointer LocalFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetCurrentThread GetFileType GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx FlushFileBuffers ReadFile ReadConsoleW SetConsoleCtrlHandler HeapReAlloc GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW RtlUnwind

user32

PostMessageW FindWindowA

advapi32

RegQueryValueExA RegCreateKeyExW RegSetValueExW RegOpenKeyExA RegOpenKeyExW RegCloseKey

wininet

InternetOpenW InternetCloseHandle InternetReadFile InternetOpenUrlW

Name

.text

Size

708KB

Virtual Size

708KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

144KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

148KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Win64.MalwareX-gen.4428.30234.exe

PE Signature issue

kernel32

user32

advapi32

wininet

generic