b3e6d17818c8e92d1f1c5d8a59ec8d00N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
b3e6d17818c8e92d1f1c5d8a59ec8d00N.exe
Size 150KB
Sample240825-nt5gesthln
SHA256 69e68c5a721f8a9b9ae3908e48785686a7107f2aa762b484bdcd0fa8b038e316
MD5 b3e6d17818c8e92d1f1c5d8a59ec8d00
SHA1 665c955c378a7cbfdfb41507dbcf3f2ec78d0f64
SHA512 edb5f98d339664fdd743477d85f2f383fa6794edbe88a3ab116f5836dec385505e9afa72137860ea4dbbb9dea652b793bc2cc44efb29dc4d5c7576d5fb7ebb06
SSDEEP 3072:wuuczBGY3j4nLXhfRf70MCRRb85TFcMo7xQGHMOfAVTzXW:wlcEY3iLXXgvRG5TFZoFQaMrHX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

b3e6d17818c8e92d1f1c5d8a59ec8d00N.exe

.exe 150KB

b3e6d17818c8e92d1f1c5d8a59ec8d00N.exe

IMPHASH c9f3babeba0047fbcba878ef92cd94c9
SHA256 69e68c5a721f8a9b9ae3908e48785686a7107f2aa762b484bdcd0fa8b038e316
MD5 b3e6d17818c8e92d1f1c5d8a59ec8d00
SHA1 665c955c378a7cbfdfb41507dbcf3f2ec78d0f64
SHA512 edb5f98d339664fdd743477d85f2f383fa6794edbe88a3ab116f5836dec385505e9afa72137860ea4dbbb9dea652b793bc2cc44efb29dc4d5c7576d5fb7ebb06
SSDEEP 3072:wuuczBGY3j4nLXhfRf70MCRRb85TFcMo7xQGHMOfAVTzXW:wlcEY3iLXXgvRG5TFZoFQaMrHX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Avira GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development 2009,O=Avira GmbH,L=Tettnang,ST=Baden-Wuerttemberg,C=DE

Serial Number

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2009 - Feb 11, 2012

Minor OS version

Major OS version

Entry point

5697

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcat GetEnvironmentStringsA IsBadWritePtr HeapCreate GetSystemDirectoryW ReplaceFileA CompareStringW GetLongPathNameW WaitForSingleObject EnumTimeFormatsA CreateDirectoryW GetUserDefaultLCID SearchPathA GetDateFormatA GetSystemDirectoryA VirtualAlloc SuspendThread SetComputerNameA lstrcmpiA lstrcpynA GetCommandLineA EnumDateFormatsW

user32

AppendMenuA DialogBoxParamW UpdateWindow DrawTextW CreateDesktopA GetDlgItemInt CreateMenu CreateAcceleratorTableA CharUpperA GetIconInfo DestroyMenu SendDlgItemMessageA MessageBeep GetSystemMetrics MessageBoxIndirectW GetMenu GetKeyboardType CharNextA InsertMenuItemA SetWindowTextW GetCursorPos CheckMenuItem SetMenu DestroyIcon CreateAcceleratorTableW

gdi32

CreateEnhMetaFileA GetEnhMetaFilePaletteEntries DPtoLP SetDeviceGammaRamp GetTextExtentPointW GetDCOrgEx CreatePolygonRgn CreateScalableFontResourceA UpdateICMRegKeyA

advapi32

RegCreateKeyExA RegOpenKeyExA RegFlushKey RegEnumValueA RegCreateKeyExW

winspool.drv

FreePrinterNotifyInfo EnumPrinterDriversW DocumentEvent GetPrinterDriverDirectoryW PerfOpen

Name

.fF

Size

9KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.I;S'y$

Size

1KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.$3!pv7

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.<99#e

Size

1KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.!#6B

Size

2KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.?cZ)

Size

2KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

676B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b3e6d17818c8e92d1f1c5d8a59ec8d00N.exe

PE Signature issue

kernel32

user32

gdi32

advapi32

winspool.drv

generic