49e8d314f7084420cc692c53002e1aaafbcf5b657304861226f0dd54807fb0d9

Sharing

Copy URL Twitter E-mail

General

Target
49e8d314f7084420cc692c53002e1aaafbcf5b657304861226f0dd54807fb0d9
Size 2.1MB
Sample240902-1ctptaxerl
SHA256 49e8d314f7084420cc692c53002e1aaafbcf5b657304861226f0dd54807fb0d9
MD5 cecaa56ad0ca869d22ab07241c18478a
SHA1 ed5018b9aeb6172337c0e0fc9535ffed655feec1
SHA512 df0557b832e7356d08e4f9bf48e0322639ec820ea31b73488070f70f26e4434261e3578c9405ebf52690173b7b2aab1517df56b7f895822464aa2ca66ae43697
SSDEEP 49152:V8PsZNCHFOAxh5f1f2tfxaPZXbuo3j5XpUf:uPsZuFOAYfxaPhbuo3j5Xp4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

49e8d314f7084420cc692c53002e1aaafbcf5b657304861226f0dd54807fb0d9

.exe 2.1MB

49e8d314f7084420cc692c53002e1aaafbcf5b657304861226f0dd54807fb0d9

IMPHASH 964d99ec0c0e5a03658f1714f812c1cf
SHA256 49e8d314f7084420cc692c53002e1aaafbcf5b657304861226f0dd54807fb0d9
MD5 cecaa56ad0ca869d22ab07241c18478a
SHA1 ed5018b9aeb6172337c0e0fc9535ffed655feec1
SHA512 df0557b832e7356d08e4f9bf48e0322639ec820ea31b73488070f70f26e4434261e3578c9405ebf52690173b7b2aab1517df56b7f895822464aa2ca66ae43697
SSDEEP 49152:V8PsZNCHFOAxh5f1f2tfxaPZXbuo3j5XpUf:uPsZuFOAYfxaPhbuo3j5Xp4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

25:e5:f9:49:28:7b:ac:e7:96:66:9b:cb:61:35:33:6a:90:fb:26:d8:c4:ee:ba:33:b4:26:b0:93:90:08:d7:fc

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-1138985,CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.1=#130b53656f6e676e616d2d7369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Oct 5, 2022

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:dd:a3:fa:e1:5d:dc:b3:77:ef:dc:e3:aa:6b:c2:a5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 10, 2022 - Jan 7, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1382193

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

u:\AhnLab\Common\AhnRestore\Trunk\Src\V3Restore\Release\V3Restore.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

ws2_32

WSAGetLastError getsockopt gethostbyname WSAStartup getaddrinfo ioctlsocket getsockname socket connect setsockopt bind listen getnameinfo ntohs freeaddrinfo WSACleanup send WSASetLastError recv accept closesocket

kernel32

InterlockedDecrement SetThreadPriority ResumeThread SetEvent SuspendThread CreateEventW GlobalAddAtomW GetFileAttributesExW LocalFileTimeToFileTime SystemTimeToFileTime SetFileTime SetFileAttributesW GetFileAttributesW GetFileSizeEx GetFileTime InterlockedIncrement CompareStringW GlobalReAlloc GlobalHandle InitializeCriticalSection LocalReAlloc GlobalGetAtomNameW GetAtomNameW GetThreadLocale GetPrivateProfileIntW WritePrivateProfileStringW GetPrivateProfileStringW GlobalFlags GetVersionExA LoadLibraryA GlobalFindAtomW FreeResource MoveFileW DeleteFileW GetStringTypeExW FlushFileBuffers LockFile UnlockFile DuplicateHandle GlobalDeleteAtom GetVolumeInformationW GetFullPathNameW GetShortPathNameW SetErrorMode GetStartupInfoW RtlUnwind HeapFree HeapAlloc GetDriveTypeW GetLocalTime HeapReAlloc GetFileInformationByHandle PeekNamedPipe Sleep ExitProcess SetConsoleCtrlHandler GetDriveTypeA FindFirstFileA RaiseException ExitThread CreateThread HeapSize SetUnhandledExceptionFilter GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate HeapDestroy VirtualFree GetTickCount TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation FatalAppExitA VirtualAlloc GetConsoleCP GetCurrentDirectoryA SetCurrentDirectoryA SetStdHandle LCMapStringA LCMapStringW GetFullPathNameA CreateFileA GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW CompareStringA InterlockedExchange GlobalFree CopyFileW GlobalSize GlobalAlloc GlobalLock GlobalUnlock MulDiv GetEnvironmentVariableW ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode FindClose FindFirstFileW FindNextFileW QueryPerformanceCounter GetSystemTimeAsFileTime FormatMessageW GetStdHandle GetFileType InterlockedExchangeAdd GetCurrentThreadId TlsFree TlsSetValue TlsGetValue TlsAlloc DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount InterlockedCompareExchange SetLastError GetCurrentDirectoryW CreateProcessW WaitForSingleObject OutputDebugStringA GetCurrentProcessId SetCurrentDirectoryW GetModuleFileNameW GetTempPathW SetFilePointer WriteFile SetEndOfFile WideCharToMultiByte GetFileSize ReadFile MultiByteToWideChar CreateFileW LoadLibraryW GetWindowsDirectoryW GetSystemDirectoryW LoadLibraryExW GetUserDefaultLangID FileTimeToLocalFileTime FileTimeToSystemTime FindResourceW LoadResource LockResource SizeofResource lstrcpyW lstrcatW CreateMutexW lstrcmpA CloseHandle lstrlenA lstrcpynW GetVersion GetModuleHandleA FreeLibrary LocalAlloc lstrcmpW lstrlenW LocalFree GetSystemInfo lstrcmpiW GetVersionExW GetLastError GetModuleHandleW GetProcAddress GetCurrentProcess

user32

MoveWindow ShowWindow ScrollWindowEx DestroyIcon CharUpperW InflateRect GetMenuItemInfoW DestroyMenu SystemParametersInfoW TranslateAcceleratorW BringWindowToTop SetRectEmpty CreatePopupMenu InsertMenuItemW InvalidateRect LoadAcceleratorsW GetMenuBarInfo LoadMenuW ReuseDDElParam UnpackDDElParam EndDialog GetNextDlgTabItem CreateDialogIndirectParamW GetKeyNameTextW MapVirtualKeyW IsRectEmpty GetSystemMenu SetParent UnionRect GetDialogBaseUnits SetRect SetTimer KillTimer GetDCEx LockWindowUpdate WinHelpW IsChild GetClassLongW SetPropW GetPropW RemovePropW IsWindow SetFocus GetForegroundWindow SetActiveWindow BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints ScrollWindow TrackPopupMenuEx TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar UpdateWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect DeferWindowPos GetScrollInfo SetScrollInfo IsDialogMessageW DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement UnregisterClassW WaitMessage ReleaseCapture GetCapture WindowFromPoint SetCapture GetDesktopWindow GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect SetWindowTextW EndPaint BeginPaint GetWindowDC ClientToScreen ScreenToClient GrayStringW DrawTextExW DrawTextW TabbedTextOutW FillRect DeleteMenu GetWindowTextLengthW GetWindowTextW LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow ShowOwnedPopups SetCursor SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent SendMessageW ModifyMenuW EnableMenuItem CheckMenuItem UnhookWindowsHookEx PostMessageW PostQuitMessage GetMenuState GetMenuStringW AppendMenuW GetMenuItemID IsDlgButtonChecked SetDlgItemTextW SetDlgItemInt GetDlgItemTextW GetDlgItemInt CheckRadioButton CheckDlgButton RegisterWindowMessageW LoadIconW SendDlgItemMessageW SetWindowPlacement SendDlgItemMessageA InsertMenuW GetMenuItemCount GetSubMenu RemoveMenu MessageBoxW GetProcessWindowStation GetUserObjectInformationW wsprintfW CharNextA CharPrevA GetSystemMetrics

gdi32

SetTextJustification SetTextCharacterExtra SetMapperFlags ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetCurrentPositionEx ArcTo PolyDraw PolylineTo PolyBezierTo ExtSelectClipRgn DeleteDC CreateDIBPatternBrushPt CreatePatternBrush CreateCompatibleDC GetStockObject SetTextAlign PlayMetaFileRecord LineTo EnumMetaFile PlayMetaFile CreatePen ExtCreatePen CreateSolidBrush CreateHatchBrush GetDCOrgEx CreateFontIndirectW GetTextExtentPoint32W CreateRectRgnIndirect SetRectRgn RectVisible CombineRgn GetMapMode PatBlt DPtoLP CreateCompatibleBitmap GetCharWidthW CreateFontW StretchDIBits GetTextMetricsW GetBkColor SelectPalette MoveToEx PtVisible StartDocW GetPixel BitBlt OffsetClipRgn IntersectClipRect ExcludeClipRect GetClipBox SetMapMode ModifyWorldTransform SetWorldTransform SetGraphicsMode SetTextColor SetStretchBltMode SetROP2 SetPolyFillMode SetBkMode SetBkColor RestoreDC SaveDC CreateBitmap CreateDCW CopyMetaFileW GetObjectType GetDeviceCaps GetWindowExtEx GetViewportExtEx GetObjectW SelectClipPath CreateRectRgn GetClipRgn SelectClipRgn DeleteObject SetColorAdjustment SetArcDirection TextOutW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegSetValueExW RegCreateKeyW RegCreateKeyExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegSetValueW CryptAcquireContextW CryptGenRandom CryptReleaseContext RegisterEventSourceW ReportEventW DeregisterEventSource RegOpenKeyA RegQueryValueExA RegOpenKeyExW RegQueryValueExW RegCloseKey RegDeleteValueW

shell32

ExtractIconW DragFinish DragQueryFileW SHGetFileInfoW

shlwapi

PathFindFileNameW PathStripToRootW PathIsUNCW PathFindExtensionW PathRemoveExtensionW PathRemoveFileSpecW

ole32

CoTaskMemFree SetConvertStg WriteFmtUserTypeStg WriteClassStg OleRegGetUserType ReadFmtUserTypeStg ReadClassStg CreateBindCtx ReleaseStgMedium CoTaskMemAlloc StringFromCLSID CoInitializeEx CoUninitialize CLSIDFromString CoCreateInstance StringFromGUID2 CoDisconnectObject OleDuplicateData CoTreatAsClass

oleaut32

SysStringLen VariantClear SafeArrayCreate SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData LoadRegTypeLi LoadTypeLi RegisterTypeLi SysStringByteLen SysAllocStringByteLen SysFreeString SafeArrayRedim VariantChangeType VariantCopy SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayCopy SafeArrayGetElement SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayLock SafeArrayUnlock SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor VariantTimeToSystemTime SystemTimeToVariantTime SysAllocStringLen VarDateFromStr SysReAllocStringLen VarCyFromStr VarBstrFromCy VarBstrFromDec VarDecFromStr VarBstrFromDate VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

49e8d314f7084420cc692c53002e1aaafbcf5b657304861226f0dd54807fb0d9

PE Signature issue

version

ws2_32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

generic