9bf782afcc591d031b253116ac34051b.bin
- SHA256 b19739ddf3b1380eaeaab37739913a1e00285b4849eca3a0860c402d0ad6ca2d
Password
infected
Behavioral task
behavioral1
Sample
318a4e426669f90ff9b6107f56f0ed47616d9da1335473c8f9f41073ca2d694d.exe
Resource
win7-20240705-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
318a4e426669f90ff9b6107f56f0ed47616d9da1335473c8f9f41073ca2d694d.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 9bf782afcc591d031b253116ac34051b.bin
- Size 14.1MB
- Sample240729-dvdd8avdme
- SHA256 b19739ddf3b1380eaeaab37739913a1e00285b4849eca3a0860c402d0ad6ca2d
- MD5 a4da89875e99fe24b3c17cc029cebae8
- SHA1 57bff47ae1f35f19b9abbab9cf1b580d44ac7938
- SHA512 3e8ece5ce0dcda495542abbebd1f5cd8c54b4476d365e9e0c9884f17832cd96aa46800bcf4cdb24eaafe378eaabf8236808a43e134544e5d97719c8c91835f5a
- SSDEEP 393216:XOJTfXV6hUvHq/dJEF+wF5ZYGwre11+PjahDpR:eJp6CvHqvlq5iGMlm
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule static1/unpack001/318a4e426669f90ff9b6107f56f0ed47616d9da1335473c8f9f41073ca2d694d.exe family_hijackloader - Hijackloader family
File Explorer
-
9bf782afcc591d031b253116ac34051b.bin.zip 14.1MB
-
318a4e426669f90ff9b6107f56f0ed47616d9da1335473c8f9f41073ca2d694d.exe.exe 15.2MB
318a4e426669f90ff9b6107f56f0ed47616d9da1335473c8f9f41073ca2d694d.exe
- IMPHASH 8a08c9c098ac4f561b03f3efaa963e1b
- SHA256 318a4e426669f90ff9b6107f56f0ed47616d9da1335473c8f9f41073ca2d694d
- MD5 9bf782afcc591d031b253116ac34051b
- SHA1 901764258a8f7322c9a4155f70e48e9676c7691e
- SHA512 dacc38e7d1fd9d60b6700ed5d28d2aa3283766157e84399f9e6b98161d399b32a8c8ea6846ec932b4c8a13e3690c7b2bc6db17d62f47d9ac22f74cf8dc59400c
- SSDEEP 393216:Lwi3tIkSzBOms76P5jAkCQBIVO3JDps+ziMlbMhrC+lFaiNFjU7AWt:BtuOu5AFQ+0ps++MlAn61
- MD5 SHA1 SHA512 SSDEEP
-
Detects HijackLoader (aka IDAT Loader)
Password
infected
PE Signature issue
Digest
a5:e4:f6:d4:a1:84:70:59:0f:6c:b7:90:c7:a8:e8:bc:fd:8f:d9:33:a5:bf:16:d0:8f:ca:9e:c2:3f:67:a8:8d
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Atrise Software,O=Andrew Revvo,C=RU
Chains
Jun 10, 2023
Subject
CN=Atrise Software,O=Andrew Revvo,C=RU
Serial Number
61:cf:b6:27:03:8a:3d:09:75:ad:c9:7f:86:d8:af:9b:5d:01:d9:e3
Issuer
CN=Andrew Revvo CA,O=Andrew Revvo,C=RU
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 5, 2023 - Jun 4, 2024
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
4
Entry point
455449
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InterlockedIncrement
InterlockedDecrement
CreateFileW
CloseHandle
SetFilePointer
GetFileSize
ReadFile
WriteFile
GetTempFileNameW
GetTempPathW
RaiseException
GetLastError
HeapFree
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
SetConsoleCtrlHandler
HeapAlloc
RtlUnwind
GetVersionExA
GetProcessHeap
DeleteFileW
SetEndOfFile
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
Sleep
ExitProcess
MultiByteToWideChar
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetModuleFileNameA
HeapSize
SetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
InitializeCriticalSection
FlushFileBuffers
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
Name
.text
Size
540KB
Virtual Size
539KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
224KB
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
48KB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
14.4MB
Virtual Size
14.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=47, id=125, productName=VS2005 build 50727, version=50727,
count=23, id=113, version=50727,
count=19, productName=Unmarked objects (old),
count=177, id=109, productName=VS2005 build 50727, version=50727,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=95, id=1, productName=Unmarked objects,
count=206, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,