04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe
Size 1.4MB
Sample240726-n91heazfqa
SHA256 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384
MD5 b7e3cd0eef8a00eb7c6a916386e7ee0e
SHA1 44844b02c42585da9ab37e439dc0a87c7a4e2f62
SHA512 b21d3fcf7746383a17c80aaeeedb69862e0c214c3229d48961ca5b11be18e8e2ebf4e5cd554d6a80fcd80929ce3937ae38880e3f10e67f5336e5afacc0585df2
SSDEEP 24576:03dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6:3mYqHU7pHYY00VcCDdowG3tMa6
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe

.exe 1.4MB

04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe

IMPHASH 66fd4e61aeff559a6af394a29c49ac49
SHA256 04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384
MD5 b7e3cd0eef8a00eb7c6a916386e7ee0e
SHA1 44844b02c42585da9ab37e439dc0a87c7a4e2f62
SHA512 b21d3fcf7746383a17c80aaeeedb69862e0c214c3229d48961ca5b11be18e8e2ebf4e5cd554d6a80fcd80929ce3937ae38880e3f10e67f5336e5afacc0585df2
SSDEEP 24576:03dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6:3mYqHU7pHYY00VcCDdowG3tMa6
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

e7:e6:44:20:39:a8:cb:a0:fd:2e:fe:51:99:2d:d1:de:59:8a:b6:de:47:8b:8a:be:9b:78:92:d8:50:77:b5:70

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 19, 2024

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

56:b6:29:cd:34:bc:78:f6

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2017 - May 30, 2042

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

SERIALNUMBER=1017531-5,CN=4leaf Holding Corp.,O=4leaf Holding Corp.,L=Edmonton,ST=Alberta,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

5e:90:65:01:75:69:20:86:f7:3d:d0:5e:e1:4b:3d:a5

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 26, 2024 - Jan 25, 2025

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 9, 2022 - Dec 6, 2032

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

530848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\xml-data\build-dir\CODRU-CL23M-SOURCES\bin\Win32\Release\BdUserHost.pdb

crypt32

CryptMsgGetParam CryptMsgClose CertFindCertificateInStore CertCloseStore CertFreeCTLContext CertFreeCRLContext CertFreeCertificateContext CryptQueryObject CertGetNameStringW

kernel32

InitializeCriticalSectionEx DecodePointer CreateThread SetCurrentDirectoryW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCommandLineW SetEvent HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap CreateEventW GetModuleHandleA OpenProcess OpenEventW GetExitCodeThread LocalFree LocalAlloc GetCurrentProcess LockFile UnlockFile WriteFile SetEnvironmentVariableW GetSystemDirectoryW LoadLibraryExW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP WideCharToMultiByte MultiByteToWideChar GetModuleHandleW GetCurrentProcessId ProcessIdToSessionId CreateFileW GetLastError FormatMessageA FreeLibrary GetProcAddress LoadLibraryW GetModuleFileNameW GetModuleHandleExW DeleteCriticalSection CloseHandle Sleep RaiseException SetDllDirectoryW GetACP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStdHandle ExitProcess GetFileType SetStdHandle FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler TlsFree GetStringTypeW CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW SetEndOfFile SetFileAttributesW SetFilePointerEx AreFileApisANSI DeviceIoControl GetFileInformationByHandleEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetCurrentThreadId EncodePointer LCMapStringEx QueryPerformanceCounter QueryPerformanceFrequency InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW GetSystemTimeAsFileTime GetTickCount64 GetLocaleInfoEx CompareStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW GetFileSizeEx SetFilePointer DebugBreak OutputDebugStringA SetLastError WaitForSingleObject GetProcessTimes GetCurrentThread GetLocalTime GetWindowsDirectoryW GetModuleFileNameA LoadLibraryExA LoadLibraryA FormatMessageW SetSearchPathMode FileTimeToSystemTime K32GetMappedFileNameW WriteConsoleW SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery GetLongPathNameW QueryDosDeviceW InitializeCriticalSectionAndSpinCount ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind TlsAlloc TlsGetValue TlsSetValue

user32

DispatchMessageW PeekMessageW TranslateMessage RegisterClassExW CreateWindowExW ShowWindow UpdateWindow BeginPaint EndPaint PostQuitMessage DefWindowProcW MsgWaitForMultipleObjects

advapi32

ConvertSidToStringSidW LookupAccountSidW GetAclInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority GetSecurityDescriptorDacl GetFileSecurityW GetAce SetSecurityDescriptorDacl InitializeSecurityDescriptor AdjustTokenPrivileges LookupPrivilegeValueW GetNamedSecurityInfoW GetTokenInformation OpenProcessToken FreeSid CheckTokenMembership AllocateAndInitializeSid RegOpenKeyExW RegGetValueW RegCloseKey

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

StringFromCLSID CLSIDFromString CoTaskMemFree

winmm

timeGetTime

wintrust

CryptCATCatalogInfoFromContext CryptCATAdminReleaseContext CryptCATAdminAcquireContext WinVerifyTrust CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash

shlwapi

PathIsRelativeW

ntdll

NtQuerySystemInformation

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

Name

.text

Size

708KB

Virtual Size

708KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

144KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

504KB

Virtual Size

503KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

04e222ce902b82d05dabc7fbd3123945b9721aaba38b2bb68c2aa305dc214384.exe

PE Signature issue

crypt32

kernel32

user32

advapi32

shell32

ole32

winmm

wintrust

shlwapi

ntdll

version

generic