Lisect_AVT_24003_G1B_96[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Lisect_AVT_24003_G1B_96.exe
Size 1.4MB
Sample240725-c8tgxstfjm
SHA256 adc70e54ca6daadcd9b8e6d293953019fc7c972217f06d32dda86ded68b17a7b
MD5 f01747ebd0c60747e8bfa92eab4ad488
SHA1 73cff8375e835683eb04eb829a11ad3895409461
SHA512 80094dc4b018435a5e181e1aef16df6bddc23acbc40be667c1f32dadb7e99f3fefc5e3dc4b598bbd1d9d2abaad475b2f5eb3f9588a84b82a0d31e6facda20ba4
SSDEEP 24576:j3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6:WmYqHU7pHYY00VcCDdowG3tMa6
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

Lisect_AVT_24003_G1B_96.exe

.exe 1.4MB

Lisect_AVT_24003_G1B_96.exe

IMPHASH 66fd4e61aeff559a6af394a29c49ac49
SHA256 adc70e54ca6daadcd9b8e6d293953019fc7c972217f06d32dda86ded68b17a7b
MD5 f01747ebd0c60747e8bfa92eab4ad488
SHA1 73cff8375e835683eb04eb829a11ad3895409461
SHA512 80094dc4b018435a5e181e1aef16df6bddc23acbc40be667c1f32dadb7e99f3fefc5e3dc4b598bbd1d9d2abaad475b2f5eb3f9588a84b82a0d31e6facda20ba4
SSDEEP 24576:j3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6:WmYqHU7pHYY00VcCDdowG3tMa6
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

ac:df:94:8b:41:ed:9e:19:f9:e8:4c:cc:27:95:05:9c:b7:d1:c9:aa:fe:84:3b:d6:8d:70:ce:44:e4:a0:92:b5

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 19, 2024

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

56:b6:29:cd:34:bc:78:f6

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2017 - May 30, 2042

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

5e:90:65:01:75:69:20:86:f7:3d:d0:5e:e1:4b:3d:a5

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 26, 2024 - Jan 25, 2025

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 9, 2022 - Dec 6, 2032

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

530848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\xml-data\build-dir\CODRU-CL23M-SOURCES\bin\Win32\Release\BdUserHost.pdb

crypt32

CryptMsgGetParam CryptMsgClose CertFindCertificateInStore CertCloseStore CertFreeCTLContext CertFreeCRLContext CertFreeCertificateContext CryptQueryObject CertGetNameStringW

kernel32

InitializeCriticalSectionEx DecodePointer CreateThread SetCurrentDirectoryW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCommandLineW SetEvent HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap CreateEventW GetModuleHandleA OpenProcess OpenEventW GetExitCodeThread LocalFree LocalAlloc GetCurrentProcess LockFile UnlockFile WriteFile SetEnvironmentVariableW GetSystemDirectoryW LoadLibraryExW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP WideCharToMultiByte MultiByteToWideChar GetModuleHandleW GetCurrentProcessId ProcessIdToSessionId CreateFileW GetLastError FormatMessageA FreeLibrary GetProcAddress LoadLibraryW GetModuleFileNameW GetModuleHandleExW DeleteCriticalSection CloseHandle Sleep RaiseException SetDllDirectoryW GetACP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStdHandle ExitProcess GetFileType SetStdHandle FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler TlsFree GetStringTypeW CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW SetEndOfFile SetFileAttributesW SetFilePointerEx AreFileApisANSI DeviceIoControl GetFileInformationByHandleEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetCurrentThreadId EncodePointer LCMapStringEx QueryPerformanceCounter QueryPerformanceFrequency InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW GetSystemTimeAsFileTime GetTickCount64 GetLocaleInfoEx CompareStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW GetFileSizeEx SetFilePointer DebugBreak OutputDebugStringA SetLastError WaitForSingleObject GetProcessTimes GetCurrentThread GetLocalTime GetWindowsDirectoryW GetModuleFileNameA LoadLibraryExA LoadLibraryA FormatMessageW SetSearchPathMode FileTimeToSystemTime K32GetMappedFileNameW WriteConsoleW SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery GetLongPathNameW QueryDosDeviceW InitializeCriticalSectionAndSpinCount ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind TlsAlloc TlsGetValue TlsSetValue

user32

DispatchMessageW PeekMessageW TranslateMessage RegisterClassExW CreateWindowExW ShowWindow UpdateWindow BeginPaint EndPaint PostQuitMessage DefWindowProcW MsgWaitForMultipleObjects

advapi32

ConvertSidToStringSidW LookupAccountSidW GetAclInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority GetSecurityDescriptorDacl GetFileSecurityW GetAce SetSecurityDescriptorDacl InitializeSecurityDescriptor AdjustTokenPrivileges LookupPrivilegeValueW GetNamedSecurityInfoW GetTokenInformation OpenProcessToken FreeSid CheckTokenMembership AllocateAndInitializeSid RegOpenKeyExW RegGetValueW RegCloseKey

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

StringFromCLSID CLSIDFromString CoTaskMemFree

winmm

timeGetTime

wintrust

CryptCATCatalogInfoFromContext CryptCATAdminReleaseContext CryptCATAdminAcquireContext WinVerifyTrust CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash

shlwapi

PathIsRelativeW

ntdll

NtQuerySystemInformation

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

Name

.text

Size

708KB

Virtual Size

708KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

144KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

504KB

Virtual Size

503KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Lisect_AVT_24003_G1B_96.exe

PE Signature issue

crypt32

kernel32

user32

advapi32

shell32

ole32

winmm

wintrust

shlwapi

ntdll

version

generic