8fca62923e5dbfe155d299cc743f6750N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8fca62923e5dbfe155d299cc743f6750N.exe
Size

192KB
MD5

8fca62923e5dbfe155d299cc743f6750
SHA1

c8bfca7287843c13100b54c4332bbac58cd35aa6
SHA256

d3ca63875c669d8becd219499346b5acc740dd9fe962de94c43029c5493b20ea
SHA512

7bf870f2d82fbc1b307c1976dacc061a899f53a014cebd1be3159f1f235b3b47f38b429aef7a4f049a6438f6cf25ef73d6828fb616d0f4d7b66cf05ddc78ec93
SSDEEP

3072:xm2ZMjsHF00MG93SWPYBs4+Au727suCImBTAcCYOH+v2lQBV+UdE+rECWp7hKCBA:VZM4lqGI647bm5VzBV+UdvrEFp7hKSA

Score

1^/10

Malware Config

Signatures

Files

8fca62923e5dbfe155d299cc743f6750N.exe
.exe windows:5 windows x86 arch:x86

8e7482716c50cef9b70d88c6f00c2302

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:20:be:3e:b8:66:52:69:27:f9:99:b9:7b:04:34:6e
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/06/2016, 00:00

Not After

24/01/2019, 12:00

Subject

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,POSTALCODE=300,STREET=No. 2\, Innovation Road II\, Hsinchu Science Park,L=Hsinchu,ST=Taiwan,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:e8:87:90:4a:8d:33:04:14:3b:59:27:a8:94:e1:39:08:b4:22:7e
Signer

Actual PE Digest

3b:e8:87:90:4a:8d:33:04:14:3b:59:27:a8:94:e1:39:08:b4:22:7e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\work\AutoInstall\AutoInstall_V2\RTKAutoInstall\RTKAutoInstall\ServiceInstall_Release\WifiAutoInstallSrv.pdb

Imports

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList

kernel32

GetTickCount
HeapSize
GetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
CloseHandle
SetEvent
GetLastError
Sleep
CreateEventW
CreateFileW
WaitForSingleObject
GetModuleFileNameW
DeviceIoControl
GetCurrentProcess
SetFilePointerEx
WriteConsoleW
DecodePointer
HeapReAlloc
EnterCriticalSection
GetConsoleCP
FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
RaiseException
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap

user32

RegisterDeviceNotificationW
UnregisterDeviceNotification

advapi32

DeregisterEventSource
RegisterServiceCtrlHandlerExW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
SetServiceStatus
DeleteService
ControlService
OpenProcessToken
StartServiceW
StartServiceCtrlDispatcherW
OpenServiceW
QueryServiceStatusEx
RegisterEventSourceW
ReportEventW
GetTokenInformation

shell32

ShellExecuteExW

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8e7482716c50cef9b70d88c6f00c2302

Code Sign

61:20:4d:b4:00:00:00:00:00:27Certificate

Key Usages

03:20:be:3e:b8:66:52:69:27:f9:99:b9:7b:04:34:6eCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

3b:e8:87:90:4a:8d:33:04:14:3b:59:27:a8:94:e1:39:08:b4:22:7eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

setupapi

kernel32

user32

advapi32

shell32

Sections

.text Size: 73KB - Virtual size: 73KB

.rdata Size: 27KB - Virtual size: 26KB

.data Size: 2KB - Virtual size: 6KB

.gfids Size: 512B - Virtual size: 172B

.rsrc Size: 2KB - Virtual size: 2KB

61:20:4d:b4:00:00:00:00:00:27
Certificate

03:20:be:3e:b8:66:52:69:27:f9:99:b9:7b:04:34:6e
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

3b:e8:87:90:4a:8d:33:04:14:3b:59:27:a8:94:e1:39:08:b4:22:7e
Signer

.text
Size: 73KB - Virtual size: 73KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 2KB - Virtual size: 6KB

.gfids
Size: 512B - Virtual size: 172B

.rsrc
Size: 2KB - Virtual size: 2KB