678568bbf525ff3587d6880216198340N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
678568bbf525ff3587d6880216198340N.exe
Size 133KB
Sample240905-q9vchascmr
SHA256 25aff36ff83bb19e04da60a1442a64e576535cd04a3c990d1eb2a0766eab3704
MD5 678568bbf525ff3587d6880216198340
SHA1 b5c6a6ac6cb517d5794de3631a6dc8800c526efe
SHA512 d547548a70a685ec55d7fbee7311cde9e955a3baf22264f7687eae4d9e0d054d5dd2e586697c03e89046bbce420efb5e7c4d417afdeb8927ad1c8af426295b40
SSDEEP 3072:q+kuxkvEAYcBRO2lQBV+UdE+rECWp7hK66so:JLxoF0BV+UdvrEFp7hKnso
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

678568bbf525ff3587d6880216198340N.exe

.dll 133KB

678568bbf525ff3587d6880216198340N.exe

IMPHASH 14258ed5c525d3cd01b28b943c5b96e7
SHA256 25aff36ff83bb19e04da60a1442a64e576535cd04a3c990d1eb2a0766eab3704
MD5 678568bbf525ff3587d6880216198340
SHA1 b5c6a6ac6cb517d5794de3631a6dc8800c526efe
SHA512 d547548a70a685ec55d7fbee7311cde9e955a3baf22264f7687eae4d9e0d054d5dd2e586697c03e89046bbce420efb5e7c4d417afdeb8927ad1c8af426295b40
SSDEEP 3072:q+kuxkvEAYcBRO2lQBV+UdE+rECWp7hK66so:JLxoF0BV+UdvrEFp7hKnso
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

7d:b6:7a:c9:df:fd:0d:8d:a0:d9:9f:9d:9e:92:d8:28:ea:13:72:57:0d:14:5e:70:73:e8:d6:dd:82:2a:60:77

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-1673585,CN=HANCOM WITH Inc.,O=HANCOM WITH Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085375776f6e2d7369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Apr 7, 2021

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

6a:9e:12:56:ee:1f:98:43:e7:c9:63:65:5f:78:48:16:cf:6b:31:b5

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Apr 7, 2021

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

Serial Number

05:b5:e6:7e:01:09:d5:2a:35:f9:a8:fe:f3:13:e4:d4

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 18, 2019 - Dec 2, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

Serial Number

05:b5:e6:7e:01:09:d5:2a:35:f9:a8:fe:f3:13:e4:d4

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 18, 2019 - Dec 2, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

5368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\XecureEXP\branches\v2001\makelib\Win32\Release\XecureAcIO.pdb

wsock32

connect inet_addr WSAStartup ntohl ioctlsocket htonl WSAGetLastError htons ntohs setsockopt WSACleanup recv bind socket closesocket gethostbyname send listen accept

kernel32

Sleep GetCurrentProcessId GetCurrentThreadId CloseHandle ReleaseMutex CreateMutexA GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange InterlockedExchange GetLastError WaitForSingleObject WideCharToMultiByte FindFirstFileA FindClose FindNextFileA

msvcr90

_except_handler4_common _access _read _close _open _chsize free _onexit sscanf memcpy memcmp memset strncat _locking _fstat64i32 strerror strlen _errno strncpy strcmp _lseek _stat64i32 atoi _write calloc malloc realloc sprintf _mktime64 _gmtime64 strftime _localtime64 _time64 printf strrchr _encode_pointer _malloc_crt _encoded_null _decode_pointer _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _crt_debugger_hook __clean_type_info_names_internal _unlock __dllonexit _lock

XFA_BIN_Cmp XFA_BIN_Copy XFA_BIN_Free XFA_BIN_LIST_Add XFA_BIN_LIST_Copy XFA_BIN_LIST_Free XFA_BIN_LIST_New XFA_BIN_LIST_Reset XFA_BIN_New XFA_BIN_Reset XFA_BIN_Set XFA_BinToHEX XFA_BinToHex XFA_Bind XFA_ClearFileLock XFA_Close XFA_CloseFile XFA_CmpHuge XFA_CmpHugeEx XFA_CreateFile XFA_DecBinNumber XFA_DecUp XFA_DupHuge XFA_DupHugeEx XFA_File_ClearLock XFA_File_Close XFA_File_CloseDIR XFA_File_Create XFA_File_Open XFA_File_OpenDIR XFA_File_Read XFA_File_ReadBin XFA_File_ReadDIR XFA_File_ReadDIR_R XFA_File_Seek XFA_File_SetCallBack XFA_File_SetReadLock XFA_File_SetReadLockNB XFA_File_SetWriteLock XFA_File_SetWriteLockNB XFA_File_Stat XFA_File_Truncate XFA_File_Write XFA_File_WriteBin XFA_FreeBin XFA_Get14ByteTimeStr XFA_GetErrReasonIO XFA_GetIntLen XFA_GetLocalTime XFA_GetNewBinNum XFA_GetTimeRFCType XFA_GetTimeStr XFA_GetUTCGap XFA_GetUTCTime XFA_GetVersionIO XFA_HexToBin XFA_HexToHuge XFA_HexToHugeEx XFA_HexToNum XFA_HugeToHEX XFA_HugeToHEXEx XFA_HugeToHex XFA_HugeToHexEx XFA_HugeToNum XFA_HugeToNumEx XFA_IO_CheckVersion XFA_IO_GetErrorReason XFA_IO_GetVersion XFA_IncBinNumber XFA_IncUp XFA_LocalTime2Str XFA_Mutex_Create XFA_Mutex_Destroy XFA_Mutex_Lock XFA_Mutex_Unlock XFA_NumToHex XFA_NumToHuge XFA_NumToHugeEx XFA_OpenFile XFA_OpenFileAppend XFA_ReadBin XFA_ReadBinFromFd XFA_ReadData XFA_ReadOneChar XFA_ReadRawData XFA_RecvData XFA_SafeFree XFA_SendData XFA_SendRawData XFA_SetBinNumber XFA_SetFileReadLock XFA_SetFileReadLockNoBlock XFA_SetFileWriteLock XFA_SetFileWriteLockNoBlock XFA_Socket_Accept XFA_Socket_Client XFA_Socket_ClientEx XFA_Socket_Close XFA_Socket_Finalize XFA_Socket_Initialize XFA_Socket_Recv XFA_Socket_RecvAll XFA_Socket_RecvRecord XFA_Socket_Send XFA_Socket_SendAll XFA_Socket_SendRecord XFA_Socket_Server XFA_Socket_htonl XFA_Socket_htons XFA_Socket_ntohl XFA_Socket_ntohs XFA_Str2Time XFA_StrToHuge XFA_StrToHugeEx XFA_Time2Str XFA_Time_GetTime XFA_Trace_ClearError XFA_Trace_Finalize XFA_Trace_GetError XFA_Trace_Initialize XFA_Trace_PrintError XFA_Trace_PutError XFA_Trace_WriteError XFA_Truncate XFA_WriteBin XFA_WriteBinToFd XFA_WriteStrToFd XFA_calloc XFA_free XFA_htonl XFA_htons XFA_malloc XFA_ntohl XFA_ntohs XFA_realloc

Sharing

General

Malware Config

Signatures

File Explorer

678568bbf525ff3587d6880216198340N.exe

PE Signature issue

PE Signature issue

wsock32

kernel32

msvcr90

generic