feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36
MD5 e530d19a769bcd90ec3e92ebf08d68e9
SHA1 ba44d592474de8fdb853f25fb364fe14a4779f74
SHA512 36e0b6fac19955bc2cc7c629f34577d1b0897ba4b551b5b0db3c8aec62c9ee92c15b7e1d953d79a3d6b428a31b816b7a410a2b62542d7260d97b22306e9b8f67
SSDEEP 24576:VouY8YFDfePwag4UuD8fb12btPSMAs+10lDgJHuA:tYZBW4uD8fxstPSMAP10lD
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

66:fd:6f:7e:14:17:88:1d:4f:3b:74:87:ad:93:80:6d:b2:1e:b5:34:0f:dc:ab:d4:05:79:c0:86:60:5f:b4:86

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,L=Tempe,ST=Arizona,C=US

Chains

Jul 16, 2024

CN=Gen Digital Inc.,O=Gen Digital Inc.,L=Tempe,ST=Arizona,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Gen Digital Inc.,O=Gen Digital Inc.,L=Tempe,ST=Arizona,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,L=Tempe,ST=Arizona,C=US

Serial Number

07:a6:1e:cf:a7:4c:c7:b2:ce:b4:20:35:c7:72:be:1d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 22, 2024 - May 21, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/Armor

SHA256 90ea0b7abbd52a052ff34a28e840821a87f36676952eb89fa50ea813d2ade6ef
MD5 539436411a91ffff5f656b26255c8626
SHA1 671cee8628e8cf7658c2705018203b6c2c77b149
SHA512 52b7926540393f9e82724d7291f438b9a58ea09128821f2847d29fdd9fc6e1334cbae26e093d321abd88052780feee358145379ffa02a6cb3858ab11f94ecab6
MD5 SHA1 SHA512

$TEMP/Calm

SHA256 3c29f332850330bcebab673d0bd18b3313eacd7576d5cf8effd158169cca4a34
MD5 caf941605fb0c9b10e1ac279eee961ac
SHA1 7d88fee90d42f11540810d458c73dfe41b9ab85c
SHA512 bed8761b7644b505ca45af83391398dd3d303759779e6ba24743cf7681b5053734989a0c0a9fe586da4bfda12e2dda401cd886963d42da2896e65af1561e3227
SSDEEP 768:M+HYYD9Z3IubYJVk+kFcTIFyFBS0XJG+gJXBm3Rrn7WyhZLb/qrWbWy9CIcnZCFV:9HjDLIYFlUi0XJzIen7WyhZ/fWgcIDL9
MD5 SHA1 SHA512 SSDEEP

$TEMP/Circumstances

SHA256 3cc341685fded40e7973a6918312e174f7e9ee3c9f3fd32420f2b1cb21109361
MD5 acbcde3c125a72ebd6a2ae8315f50b63
SHA1 9a1548555b64caf4b0f7e2e14a1b30e700c81552
SHA512 98c8b3972715f6f3cd889ac3e7471f667ab98082a1cb5a5eb815665005e7d9e872bb8f2a2acaa97879c85cc797b48d17c86e39feaa3ea72a109928c4994d44bd
SSDEEP 1536:ApWIjQXUCEFFz2o0FzVeCaYa+N8qMFy/9IC1JUX44iNpONdqXu4yRrPWF1WQ9ZP6:Ap8UZ7zWlhNVMFg9l3Uo4iNpONdqXu4i
MD5 SHA1 SHA512 SSDEEP

$TEMP/Holders

SHA256 0e1b8db2db7933870edaa0bccdc6a606f6e55597dde8f99638928f91728ea272
MD5 30d6715fcb0d2ecea58ef12c55f47667
SHA1 c9db2ae4074ddb7379bbb4f6839b8321be526fa0
SHA512 9b7e3c1855a300b41ba965a08dfbd396337870121151822b67d1bfe8a2d8aa03d7360952dee799445c2c6ccd93ce58808534f5c891d51761e21f9ce5da0bb44b
SSDEEP 768:w7cF3u8NXQfHL4N36/X01TnsCBwfHRdsEglZlxJvu8lresgN01a:XdNQsZCX01TsCBwfHRd0jBlHC01a
MD5 SHA1 SHA512 SSDEEP

$TEMP/Kathy

SHA256 d40d6e421976295250834db769af750c92012dcc88dc65507681faf6e4330c19
MD5 c4981f3a5228cb7df18526017be817c6
SHA1 1c3691bfea44a197df09841784cdcaf7cbae3ec5
SHA512 21d3bc72be1b6cab6e0f85a805ab7fde23cc18d856f32b692ad6845f04fad93255b21ebffb2572543c43e8124e9b78fa79ae900bfb7145013fb305bc94d22c01
SSDEEP 384:6ycHejPS9h4hAx/aKlJ/FoeFBdz7pjneNKQOOln1dGV:6yrmFxxlJ/+eZDQKQ/1y
MD5 SHA1 SHA512 SSDEEP

$TEMP/Luxembourg

SHA256 11c9db0ee88e1de82a3a745db8d9d6acf23ad120e18cfb308ad5a538c8868f0d
MD5 1c809e014a5fbf2c2782f00fc96140cd
SHA1 4d35a46db91a9cd4118ed05063f5db8adc885e34
SHA512 060e05889fead6912c67f1fcfb7649996a43d86768cd8f0823572884f93fb6bf50bd3fafa5dad7e3509d5e43431c38cee9675e34f89a24d837b7ec440ded7cdb
SSDEEP 1536:beqMzDVY3xm4tuiZwuh81hEy0ZEmYx/dnOe5MwGz1N1Re61Ga3nzPQcCCGB08zwV:beqmC3xm4YyQ+ZEmYH35MwGh061n3nzT
MD5 SHA1 SHA512 SSDEEP

PlacementMillion/Edinburgh

SHA256 b64170d3071397e910f47f9f298abc22c33841f759b8ee9d999c6a27a2a4a2c0
MD5 a2773a9de9c8deb990a654e343f1258d
SHA1 cc83f93154c2cd956ee2bbd10f974c1db7cd91c8
SHA512 e5787a49fc0ecac8a325774d15c82d2dd27be981b12550a323304a703c7a20e171d08a1a384162a7a37d8e262f8ae7776e01886b845c4d7bf1342ae59da3c164
SSDEEP 1536:5D+MONonbeOJB564wkBY8+gSEyZYJwUp+zJfcjN3zaUjJmldNIC:5DEibHV6ro/SE/8zdUNjaUjclj5
MD5 SHA1 SHA512 SSDEEP

PlacementMillion/Elliott

SHA256 3cf292881045f3d50364f423aca2fbd87e6f7339fe8db36568a1dd4b78a0b842
MD5 a9f377ceb60f84537bbaf960970cca82
SHA1 07bc24abaab9953be6018f92566b37f107e908a3
SHA512 3a30429a589776f430442b7cbbba3fb73a9891fb01e469ae59e3ee0479c90052d38223f102d1959b3b32589df8d14c13c55f765572845fbe67f2ea65b251c9fd
SSDEEP 1536:WBjVrLaFKOUdKIIQDQqO6Muto58cLBiVTiRMPJ:WBprLr2IIpbutVc6
MD5 SHA1 SHA512 SSDEEP

PlacementMillion/Keeps

SHA256 28d4a2a735bf820c7c4e48017ed1c0cbcc9351820fa561861b10f86a0022bf76
MD5 fc1fceed4119e874078b3a5fd502477d
SHA1 cddaf83c2aa7bab873ff8b9e3781c338645c81ac
SHA512 5ec2f9c90500f8d118bc170da95caf09d88bc75f5f1f6d83866c7baa108bfaa74a4fc3d853cdf073430daae68810908514cf02dc4f6c5b5a1675efbcef34760a
SSDEEP 12288:HpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:HT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer