aff09c8a9c9f3525ef9dcb8a76016f70N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
aff09c8a9c9f3525ef9dcb8a76016f70N.exe
Size 181KB
Sample240820-cj79saydkd
SHA256 6190530cc987519e57c6cc74ec38635b17ce4988c5b90c2053ec14f8b13bbc54
MD5 aff09c8a9c9f3525ef9dcb8a76016f70
SHA1 dd88cc4888e6da1ddbc00019ecc835ab77e5ba63
SHA512 ca154a6fa4d819061a6ee4d7c27a7d601d32ed20a3cd90afad8b00f9a1004af04d5f5c3b08bdfc37d3b06d356214e2097ed08eeb6346d5b4c5236bf4c75474bb
SSDEEP 3072:pg4NVFS/YK/guBAKdJlR2m+aJLtgN2lQBV+UdE+rECWp7hKPLvtfr:pgITS/zI1KImAxBV+UdvrEFp7hKrd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

aff09c8a9c9f3525ef9dcb8a76016f70N.exe

.exe 181KB

aff09c8a9c9f3525ef9dcb8a76016f70N.exe

IMPHASH 5523dda9a438aa3992e03f3746f19bf6
SHA256 6190530cc987519e57c6cc74ec38635b17ce4988c5b90c2053ec14f8b13bbc54
MD5 aff09c8a9c9f3525ef9dcb8a76016f70
SHA1 dd88cc4888e6da1ddbc00019ecc835ab77e5ba63
SHA512 ca154a6fa4d819061a6ee4d7c27a7d601d32ed20a3cd90afad8b00f9a1004af04d5f5c3b08bdfc37d3b06d356214e2097ed08eeb6346d5b4c5236bf4c75474bb
SSDEEP 3072:pg4NVFS/YK/guBAKdJlR2m+aJLtgN2lQBV+UdE+rECWp7hKPLvtfr:pgITS/zI1KImAxBV+UdvrEFp7hKrd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Serial Number

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Timespan

May 12, 1997 - Jan 7, 2004

Subject

CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d

Serial Number

Issuer

CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=InstallShield Software Corporation,OU=Research and Development,O=InstallShield Software Corporation,L=Schaumburg,ST=Illinois,C=US

Serial Number

08:d1:35

Issuer

CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 12, 2002 - Feb 12, 2003

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Serial Number

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 28, 2001 - Jan 6, 2004

Minor OS version

Major OS version

Entry point

45516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

version

VerInstallFileA GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

kernel32

GetLastError SetLastError lstrcmpiA lstrlenA CompareStringW GetVersionExA DeleteFileA CompareStringA GetWindowsDirectoryA GetTempPathA GetFileAttributesA GetTempFileNameA GlobalUnlock GlobalLock GlobalAlloc GlobalFree GetTickCount LockResource LoadResource FindResourceA lstrcpyA SetErrorMode FreeLibrary RemoveDirectoryA LeaveCriticalSection EnterCriticalSection CreateThread CreateMutexA WaitForSingleObject ReleaseMutex InitializeCriticalSection DeleteCriticalSection SetEvent OpenEventA GetModuleHandleA GetCurrentThreadId HeapAlloc GetSystemInfo HeapCreate lstrcpynA lstrcatA GetPrivateProfileIntA lstrlenW FindFirstFileA SetFilePointer GetProcAddress LoadLibraryA GetShortPathNameA GetSystemDefaultLangID MoveFileA FindResourceExA GetFileSize HeapDestroy UnmapViewOfFile MapViewOfFile CreateFileMappingA SizeofResource GetStartupInfoA ExitProcess GetCommandLineA DebugBreak HeapReAlloc HeapFree VirtualQuery VirtualProtect SearchPathA ResetEvent QueryPerformanceCounter SystemTimeToFileTime lstrcmpA MultiByteToWideChar GetCurrentThread GetVersion IsBadReadPtr ReadFile Sleep WriteFile CloseHandle CreateEventA QueryPerformanceFrequency InterlockedDecrement InterlockedIncrement CreateFileA GetModuleFileNameA CreateDirectoryA WideCharToMultiByte WritePrivateProfileStringA GetPrivateProfileStringA FindClose CreateProcessA GetCurrentProcess

user32

MsgWaitForMultipleObjects LoadStringA CharNextA PeekMessageA PostThreadMessageA CharUpperA SetTimer SetWindowRgn DialogBoxIndirectParamA SetActiveWindow CharLowerBuffA CreateDialogIndirectParamA GetDlgItem SendMessageA SetDlgItemTextA LoadIconA GetWindowRect SystemParametersInfoA SetWindowPos CharLowerA GetWindowTextA GetDesktopWindow ScreenToClient MoveWindow KillTimer DestroyWindow GetMessageA IsDialogMessageA TranslateMessage DispatchMessageA GetDC ReleaseDC SetWindowTextA ShowWindow EndDialog wsprintfA

gdi32

CreateFontIndirectA LPtoDP GetTextExtentPoint32A DeleteObject GetObjectA

advapi32

RegCreateKeyExA OpenThreadToken OpenProcessToken GetTokenInformation RegCloseKey RegOpenKeyExA RegSetValueExA AllocateAndInitializeSid RegQueryValueExA RegDeleteKeyA RegEnumKeyExA RegOpenKeyA RegQueryValueA FreeSid EqualSid

ole32

CoTaskMemFree StringFromGUID2 GetRunningObjectTable CoCreateInstance CoCreateGuid CoReleaseMarshalData CoInitialize CoGetInterfaceAndReleaseStream CoUninitialize CoRevokeClassObject CoRegisterClassObject StringFromCLSID CoTaskMemAlloc CoMarshalInterThreadInterfaceInStream

oleaut32

SysStringLen SysFreeString SysAllocStringLen VariantCopy VariantClear LoadRegTypeLi LoadTypeLi RegisterTypeLi SysAllocString

lz32

LZClose LZCopy LZOpenFileA

Sharing

General

Malware Config

Signatures

File Explorer

aff09c8a9c9f3525ef9dcb8a76016f70N.exe

PE Signature issue

version

kernel32

user32

gdi32

advapi32

ole32

oleaut32

lz32

generic