c90f2a37bd610f7991b6e387de829040N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
c90f2a37bd610f7991b6e387de829040N.exe
Size 248KB
Sample240825-nx4passfmf
SHA256 0858c3f707ce06636879d2b349cdf8746673fa98117a2b04ded2b0297ae31c29
MD5 c90f2a37bd610f7991b6e387de829040
SHA1 77bc4bbe4c08bbe8969fc7d214ba473304bb39e1
SHA512 41bc02d0b1a321a4334ea88930d985ba761afd88dbff541d5f4ecd966b3c9e2dcae15db2e4cfa1548ab6e7b0fe232238dd5ba8575871903252acb5a4bcab04c9
SSDEEP 6144:gk1eNshhrZahVbNzD3kXVqpV+x9YpY9Fq4f5jgGx5:gk9ZahVm0pseoxjB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

c90f2a37bd610f7991b6e387de829040N.exe

.exe 248KB

c90f2a37bd610f7991b6e387de829040N.exe

IMPHASH e3d6498467eb01cfd1939a8c963aa374
SHA256 0858c3f707ce06636879d2b349cdf8746673fa98117a2b04ded2b0297ae31c29
MD5 c90f2a37bd610f7991b6e387de829040
SHA1 77bc4bbe4c08bbe8969fc7d214ba473304bb39e1
SHA512 41bc02d0b1a321a4334ea88930d985ba761afd88dbff541d5f4ecd966b3c9e2dcae15db2e4cfa1548ab6e7b0fe232238dd5ba8575871903252acb5a4bcab04c9
SSDEEP 6144:gk1eNshhrZahVbNzD3kXVqpV+x9YpY9Fq4f5jgGx5:gk9ZahVm0pseoxjB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

59:3a:77:f9:74:03:d5:80:dc:56:9d:55:50:4b:d5:71:c7:07:b3:f1

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=BITDEFENDER LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BITDEFENDER LLC,L=Fort Lauderdale,ST=Florida,C=US

Chains

May 7, 2010

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=BITDEFENDER LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BITDEFENDER LLC,L=Fort Lauderdale,ST=Florida,C=US

Serial Number

1c:2d:d6:1a:35:e6:5d:f6:29:97:01:ff:9b:e5:ca:44

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 20, 2010 - Jan 24, 2012

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsBadWritePtr VirtualAlloc CreateNamedPipeW GetUserDefaultLangID GetProcessHeap GetThreadLocale GetTempFileNameA OpenSemaphoreA lstrcmpiW GetEnvironmentVariableW CreateThread GetFullPathNameA CopyFileExW EnumTimeFormatsW IsBadReadPtr OpenWaitableTimerW GetEnvironmentStringsA WaitForSingleObject DisconnectNamedPipe GetDiskFreeSpaceA FatalAppExitW GetWindowsDirectoryA EnumDateFormatsW EnumDateFormatsA CopyFileExA GetTempPathW GetVersionExA GetSystemDefaultLangID GetVersion FindAtomW GetEnvironmentVariableA GetFileType ExpandEnvironmentStringsW AddAtomA LocalAlloc ReplaceFileA GetProcessHeaps CreateFileMappingA GetSystemTime lstrcpynW LocalFree lstrcatW ExitProcess GetNumberFormatW CreateEventA DeleteAtom FreeLibrary IsValidCodePage MulDiv EnumCalendarInfoA

user32

ArrangeIconicWindows CheckDlgButton SetWindowTextA GetMenuStringW CloseWindow LoadMenuIndirectW GetForegroundWindow GetClassInfoExW GetWindowLongA CallWindowProcW GetDC SetCursor IsMenu wsprintfA SetWindowPos CheckMenuRadioItem SetForegroundWindow MessageBeep RegisterClassW SetCapture TrackPopupMenu LoadCursorW GetDlgItemTextA GetMessageA AppendMenuA IsWindow LoadCursorA CreateDialogIndirectParamW LoadIconA DefDlgProcA InsertMenuW GetClassInfoW CallWindowProcA GetClassInfoExA SetWindowLongW IsChild GetMenuItemID wvsprintfW GetDC CopyIcon GetAsyncKeyState GetCursorPos CreateWindowExW DestroyMenu GetDlgItemTextW wsprintfW

gdi32

GetGraphicsMode SetMapperFlags SelectClipRgn GetPolyFillMode UpdateColors SetBitmapDimensionEx EndPath CreateBrushIndirect GdiGetBatchLimit StrokeAndFillPath Arc SetColorSpace SetArcDirection SetViewportExtEx GetMetaFileA CreateCompatibleDC DeleteMetaFile

advapi32

RegOpenKeyA RegDeleteValueW RegQueryInfoKeyA RegReplaceKeyA ConvertSidToStringSidW RegOpenKeyExA

shell32

SHGetDiskFreeSpaceExA StrCmpNIA StrStrIW ExtractIconExA StrStrW DuplicateIcon

comdlg32

PrintDlgExW ReplaceTextW PrintDlgExA ChooseFontA

urlmon

HlinkGoBack

crypt32

CryptMsgOpenToDecode

Name

.dIjpP

Size

10KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.GMd

Size

1KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pUltCa

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yN

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.WKF

Size

1024B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1024B

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.PD

Size

4KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

213KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mor

Size

2KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c90f2a37bd610f7991b6e387de829040N.exe

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

comdlg32

urlmon

crypt32

generic