4f2a13a9ac7dbc44628bf2e5aa4e06c0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
4f2a13a9ac7dbc44628bf2e5aa4e06c0N.exe
Size 151KB
Sample240831-xbb7layhkm
SHA256 cd0c912fb70521d4a7c9a08c9824c97914fb45e3527ec8b759b0c84bda8df5f1
MD5 4f2a13a9ac7dbc44628bf2e5aa4e06c0
SHA1 3e60d0cc26feb6954cf4bc045a62ecc9f8a9dc50
SHA512 55ad0676e1456fbe3cd892186b177387a3a3b8e0f38aa2c589a35f530f3b339d4ae1bc9e8042903b4c0f1dc0e9f7a570852bd6a54caada01d74514d69895884a
SSDEEP 3072:wKjfC0cDh42K4GOfGOe7G2lQBV+UdE+rECWp7hKQwa:RjSK4GOfGQBV+UdvrEFp7hKQb
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

4f2a13a9ac7dbc44628bf2e5aa4e06c0N.exe

.dll 151KB

4f2a13a9ac7dbc44628bf2e5aa4e06c0N.exe

IMPHASH d543e92516e76991eed11ebcbe667420
SHA256 cd0c912fb70521d4a7c9a08c9824c97914fb45e3527ec8b759b0c84bda8df5f1
MD5 4f2a13a9ac7dbc44628bf2e5aa4e06c0
SHA1 3e60d0cc26feb6954cf4bc045a62ecc9f8a9dc50
SHA512 55ad0676e1456fbe3cd892186b177387a3a3b8e0f38aa2c589a35f530f3b339d4ae1bc9e8042903b4c0f1dc0e9f7a570852bd6a54caada01d74514d69895884a
SSDEEP 3072:wKjfC0cDh42K4GOfGOe7G2lQBV+UdE+rECWp7hKQwa:RjSK4GOfGQBV+UdvrEFp7hKQb
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

bc:b6:4e:ba:a7:91:3c:c5:fb:39:dd:e9:f6:d4:f3:6f:77:ef:9e:af

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Chains

Jan 18, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Serial Number

29:c1:5b:3f:aa:cd:52:6a:4e:67:bd:3c:4e:7e:3f:f2

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 25, 2012 - Sep 20, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

47972

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

U:\develop\global\Release\bin\common\x86\UninstallEngine.pdb

msi

ord92 ord32 ord159 ord141 ord72 ord96 ord94 ord190 ord113 ord20 ord70 ord8 ord125 ord17

kernel32

TerminateProcess InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DisableThreadLibraryCalls QueryPerformanceCounter GetTickCount GetCurrentThreadId InterlockedDecrement lstrlenW InterlockedIncrement DebugBreak OutputDebugStringW lstrlenA GetCurrentProcessId CloseHandle GetLastError CopyFileW DeleteFileW CreateMutexW CreateThread FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW LeaveCriticalSection RaiseException EnterCriticalSection MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime GetTempPathW DeleteCriticalSection

user32

wsprintfW wvsprintfW CharNextW LoadStringW

advapi32

RegEnumKeyExW RegDeleteValueW RegCloseKey RegQueryInfoKeyW RegOpenKeyExW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegDeleteKeyW

ole32

CoCreateInstance CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathAppendW PathUnquoteSpacesW PathFileExistsW PathStripPathW StrCmpW

msvcp100

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

msvcr100

_amsg_exit _CxxThrowException __CppXcptFilter _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common __clean_type_info_names_internal _initterm_e _lock __CxxFrameHandler3 memcpy iswdigit ??_V@YAXPAX@Z ??3@YAXPAX@Z _onexit ?terminate@@YAXXZ _malloc_crt _encoded_null __dllonexit _unlock memset _recalloc _initterm memcpy_s free malloc wcsncpy_s ??0exception@std@@QAE@ABV01@@Z ??0exception@std@@QAE@ABQBD@Z ??1exception@std@@UAE@XZ ?what@exception@std@@UBEPBDXZ ??2@YAPAXI@Z iswspace wcsstr memmove _wtoi

Sharing

General

Malware Config

Signatures

File Explorer

4f2a13a9ac7dbc44628bf2e5aa4e06c0N.exe

PE Signature issue

msi

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

msvcp100

msvcr100

generic