f6df353ad0c8621d0a0698f7361ee540N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
f6df353ad0c8621d0a0698f7361ee540N.exe
Size 6.3MB
Sample240820-rxexqa1emk
SHA256 158f0b1352ab7537d6cb9b7b4ef893a1513b4eef8543de5d32a104e76cc84591
MD5 f6df353ad0c8621d0a0698f7361ee540
SHA1 e8d8e3becfa4e7427d5c6c2037033a1bee2b4522
SHA512 a2e26a30f9d860ffcf0156bad0abbcfb6a6d5d5022e1e0ad162064ee4a7de3a1208b4096adac11b2203b8380e7bf9eb426e1265c960930713e73bc4d0effda45
SSDEEP 49152:CbA1AZFlsjRniITY86GwBan2qXg4uxkS+DG4EqJpTplhCA0a9j+D5NUOWWuvks9m:Cb4AZ4EiwB0BjhCA0a9s5YH9bg
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

f6df353ad0c8621d0a0698f7361ee540N.exe

.exe 6.3MB

f6df353ad0c8621d0a0698f7361ee540N.exe

IMPHASH 6a822419a67a170751b62c728ad3aa64
SHA256 158f0b1352ab7537d6cb9b7b4ef893a1513b4eef8543de5d32a104e76cc84591
MD5 f6df353ad0c8621d0a0698f7361ee540
SHA1 e8d8e3becfa4e7427d5c6c2037033a1bee2b4522
SHA512 a2e26a30f9d860ffcf0156bad0abbcfb6a6d5d5022e1e0ad162064ee4a7de3a1208b4096adac11b2203b8380e7bf9eb426e1265c960930713e73bc4d0effda45
SSDEEP 49152:CbA1AZFlsjRniITY86GwBan2qXg4uxkS+DG4EqJpTplhCA0a9j+D5NUOWWuvks9m:Cb4AZ4EiwB0BjhCA0a9s5YH9bg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

3a:b4:3b:01:71:b0:db:78:45:60:e2:d2:54:23:5d:49:0c:59:75:f6

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Chains

Feb 17, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tally Solutions Private Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RnD,O=Tally Solutions Private Limited,L=Bangalore,ST=Karnataka,C=IN

Serial Number

0b:dc:0e:72:b5:62:8c:50:bd:df:dd:df:d2:64:f5:78

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 29, 2012 - Feb 28, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

2137587

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\tally.erp9a\release\prod.tally9-erp9a.STABLE\tally.migtool\main\bin\release\tally72migration.pdb

kernel32

LockResource LoadResource FindResourceA SetLastError GetCurrentThreadId GetVersion GetFileType GetStdHandle GetTickCount GlobalMemoryStatus FlushConsoleInputBuffer GetSystemDirectoryA GetTimeZoneInformation GetDriveTypeA GetWindowsDirectoryA GetSystemInfo lstrlenA LocalFree HeapFree HeapAlloc GetSystemTimeAsFileTime GetModuleHandleA GetStartupInfoA GetCommandLineA SizeofResource EnterCriticalSection LeaveCriticalSection HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime RtlUnwind SetConsoleCtrlHandler WriteFile SetConsoleMode GetConsoleMode RaiseException HeapDestroy HeapCreate VirtualFree DeleteCriticalSection VirtualAlloc IsBadWritePtr TlsAlloc TlsFree TlsSetValue TlsGetValue HeapSize UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings SetHandleCount LCMapStringA SetStdHandle GetFullPathNameA GetCurrentDirectoryA InterlockedExchange VirtualQuery VirtualProtect InitializeCriticalSection GetACP GetOEMCP CompareStringA SetEnvironmentVariableA GetStringTypeA GetLocaleInfoA IsBadReadPtr IsBadCodePtr SetEndOfFile SetFilePointer FlushFileBuffers ReadFile UnlockFile LockFile GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetVersionExA FreeLibrary GetCurrentProcessId QueryPerformanceCounter SetErrorMode GetModuleFileNameA FormatMessageA GetProfileStringA LoadLibraryA InterlockedDecrement ResetEvent OpenProcess WaitForSingleObject TerminateProcess CreateFileMappingA GetCurrentProcess DuplicateHandle CreateProcessA GetExitCodeProcess MapViewOfFile CreateEventA Beep FindNextFileA SetFileAttributesA GetLastError GetDiskFreeSpaceA CreateFileA GetFileSize CloseHandle FindFirstFileA FindClose SetUnhandledExceptionFilter DeleteFileA LocalUnlock LocalLock LocalAlloc MoveFileExA Sleep ReadConsoleInputA CreateDirectoryA ExitProcess RemoveDirectoryA

user32

SetTimer GetWindowThreadProcessId EnumWindows SendMessageA WaitForInputIdle HideCaret CreateCaret SetCaretPos ShowCaret GetDC EnumDisplaySettingsA GetKeyboardState MessageBoxA GetWindowDC DrawIcon ReleaseDC KillTimer LoadIconA LoadCursorA RegisterClassA SystemParametersInfoA GetSystemMetrics CreateWindowExA ShowWindow SetFocus GetClientRect DispatchMessageA GetQueueStatus PeekMessageA GetMessageA TranslateMessage LoadImageA GetDesktopWindow SetWindowPos EndPaint BeginPaint DefWindowProcA SetRect FrameRect FillRect CloseClipboard SetClipboardData GetKeyState ShowScrollBar OpenClipboard EmptyClipboard InvalidateRect SetScrollInfo SetScrollPos PostMessageA GetFocus GetUpdateRect PostQuitMessage RegisterClassExA GetProcessWindowStation GetUserObjectInformationW PtInRect GetCursorPos DestroyWindow UpdateWindow wsprintfA

gdi32

SetTextJustification GetDIBits SetEnhMetaFileBits GetEnhMetaFileHeader PlayEnhMetaFile CreateDCA CreateCompatibleBitmap CreateEnhMetaFileA GetTextMetricsA LineTo CreateRectRgn SetRectRgn DeleteDC GetDeviceCaps CreateCompatibleDC GetStockObject DeleteObject SelectObject CreatePen SetTextColor CreateSolidBrush SetBkColor GetRgnBox GetTextExtentPointA BitBlt FrameRgn SelectClipRgn CreateFontIndirectA StretchBlt MoveToEx PatBlt SetStretchBltMode TextOutA SetBkMode CreateBitmap SetTextAlign SetTextCharacterExtra Escape StartPage StartDocA AbortDoc EndDoc EndPage DeleteEnhMetaFile GetEnhMetaFileBits CloseEnhMetaFile PtInRegion CreateHalftonePalette CreatePalette GetDIBColorTable GetObjectA RealizePalette SelectPalette PaintRgn CombineRgn

rpcrt4

UuidFromStringA

wininet

InternetCrackUrlA InternetCanonicalizeUrlA InternetCreateUrlA InternetSetOptionA InternetCloseHandle InternetReadFile HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA HttpQueryInfoA InternetWriteFile HttpEndRequestA InternetQueryOptionA HttpSendRequestExA InternetQueryDataAvailable InternetAttemptConnect InternetSetFilePointer FtpOpenFileA

ole32

CoCreateGuid CoCreateInstance CLSIDFromProgID CoUninitialize CoInitialize

oleaut32

GetErrorInfo SysAllocString VariantClear SysFreeString VariantInit

winspool.drv

EndDocPrinter DeviceCapabilitiesA ClosePrinter DocumentPropertiesA OpenPrinterA StartPagePrinter StartDocPrinterA EndPagePrinter WritePrinter

wsock32

WSACleanup accept WSAAsyncSelect connect recv send WSAGetLastError gethostbyname ioctlsocket htonl ntohl inet_addr gethostbyaddr getsockname WSASetLastError ntohs socket WSAStartup closesocket shutdown htons

odbc32

ord13 ord15 ord14 ord16 ord27 ord11 ord41 ord75 ord24 ord18 ord36 ord4

advapi32

RegCloseKey RegQueryValueExA RegisterEventSourceW RegOpenKeyExA CryptReleaseContext ReportEventW DeregisterEventSource CryptAcquireContextA CryptGenRandom

rasapi32

RasHangUpA

Sharing

General

Malware Config

Signatures

File Explorer

f6df353ad0c8621d0a0698f7361ee540N.exe

PE Signature issue

kernel32

user32

gdi32

rpcrt4

wininet

ole32

oleaut32

winspool.drv

wsock32

odbc32

advapi32

rasapi32

generic