Spotify[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Spotify.exe
Size

33.8MB
MD5

a8b0089fc441a9654d781823b31fc85a
SHA1

bc3317bade99fbebb94318b93cdc8f384c948b82
SHA256

b23746f04a8c00dfa531183d4abfdfdcdf4079330c3ebae8e670fb0989d68485
SHA512

8e95c601ea0726a985a46f4fceb1a37cd371d197ac23433784779de32d6e0ff300a14ff8a6c38fe8db97089cb2be7849c73f5e11d25c701d147cf57418948401
SSDEEP

393216:GPAPLMWG8TRO2pOFdgtXLf9UwMN264oYJ06KHWa2dWa2s:BPLNGyi2a8NKHWa2Wad

Score

1^/10

Malware Config

Signatures

Files

Spotify.exe
.exe windows:6 windows x64 arch:x64

0200a0523f0d28c38117a2928ce990e8

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:ab:67:0a:61:bf:4b:7d:af:d5:59:35:6b:5b:cc:ff
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2023, 00:00

Not After

03/10/2024, 23:59

Subject

SERIALNUMBER=556703-7485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ba:c9:33:75:0b:92:a8:a0:dc:df:a4:c1:99:7b:c9:9e:a9:83:f4:63:9f:07:20:12:3f:23:7a:96:c4:57:73:5a
Signer

Actual PE Digest

ba:c9:33:75:0b:92:a8:a0:dc:df:a4:c1:99:7b:c9:9e:a9:83:f4:63:9f:07:20:12:3f:23:7a:96:c4:57:73:5a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Spotify.pdb

Imports

iphlpapi

GetExtendedTcpTable
GetAdaptersAddresses

ws2_32

gethostbyaddr
inet_ntoa
socket
getprotobyname
gethostbyname
inet_addr
WSAWaitForMultipleEvents
WSAEventSelect
WSAEnumNetworkEvents
WSASocketW
WSAAddressToStringW
WSAStringToAddressW
__WSAFDIsSet
accept
bind
connect
getsockname
getsockopt
listen
WSAIoctl
WSARecv
WSARecvFrom
getservbyname
WSASetEvent
getservbyport
WSASendTo
recv
recvfrom
send
sendto
getpeername
freeaddrinfo
WSACloseEvent
getaddrinfo
WSASend
WSAGetLastError
WSASetLastError
shutdown
setsockopt
select
ntohs
ntohl
htons
WSAStartup
htonl
ioctlsocket
WSACreateEvent
closesocket
WSACleanup

gdiplus

GdipBitmapLockBits
GdipCreateBitmapFromStream
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericDefault
GdipDrawString
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipBitmapUnlockBits
GdipDisposeImage
GdipDeleteFont
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipFillEllipse
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateHICONFromBitmap
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipLoadImageFromStream
GdipCloneImage
GdipGetImageHeight

crypt32

CertDuplicateCertificateContext
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertFindCertificateInStore
CertGetNameStringA

dbghelp

SymGetSearchPathW
SymSetSearchPathW

kernel32

InitOnceComplete
InitOnceBeginInitialize
GetExitCodeThread
SwitchToThread
GetTimeZoneInformation
PeekNamedPipe
FreeLibraryAndExitThread
ExitThread
GetDriveTypeW
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
LoadLibraryExA
WakeAllConditionVariable
CreateRemoteThread
VirtualQuery
RtlCaptureStackBackTrace
GetProcessHeaps
VirtualFreeEx
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
VirtualProtectEx
VirtualAllocEx
QueryInformationJobObject
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapDestroy
EnumSystemLocalesEx
GetProcessHandleCount
SetThreadAffinityMask
GetCurrentProcessorNumber
ReadProcessMemory
IsWow64Process
GetProductInfo
SetProcessMitigationPolicy
GetProcessMitigationPolicy
HeapSetInformation
FreeLibraryWhenCallbackReturns
LCMapStringEx
CompareStringEx
LoadResource
SetDefaultDllDirectories
WriteProcessMemory
SetHandleInformation
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
InterlockedPushEntrySList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwind
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetCurrentThread
OutputDebugStringW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetProcessHeap
SetConsoleCtrlHandler
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadFile
ReadConsoleW
CreateFileW
CloseHandle
WriteConsoleW
CreateDirectoryW
DeleteFileW
GetTempFileNameW
DebugBreak
CreateProcessW
GetTickCount64
GetWindowsDirectoryW
LocalFree
FormatMessageA
FormatMessageW
CopyFileExW
MoveFileExW
RegisterApplicationRestart
CreateEventA
GetProcessTimes
GetSystemTime
SystemTimeToFileTime
DecodePointer
InitializeCriticalSectionEx
CreateMutexW
OpenMutexW
InitializeCriticalSection
Sleep
SetThreadPriority
SetEvent
WaitForSingleObject
CreateEventExW
WaitForMultipleObjects
LocalAlloc
LoadLibraryW
GetConsoleScreenBufferInfo
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SleepEx
CreateEventW
SetWaitableTimer
CreateWaitableTimerW
QueueUserAPC
TerminateThread
CancelIoEx
GetFileAttributesExW
GetFullPathNameW
CancelIo
CreateThread
ReadDirectoryChangesW
GetVersionExW
GetVersion
GetFileSize
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetComputerNameW
GetSystemPowerStatus
OpenProcess
K32GetProcessMemoryInfo
ResetEvent
ReleaseMutex
GetSystemInfo
QueryFullProcessImageNameW
GetThreadId
GetModuleHandleA
TrySubmitThreadpoolCallback
LockResource
SizeofResource
FindResourceW
GetUserDefaultUILanguage
ExpandEnvironmentStringsW
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
GetLocaleInfoEx
CreateMutexA
MapViewOfFile
UnmapViewOfFile
OpenMutexA
CreateFileMappingA
OpenFileMappingA
AllocConsole
AttachConsole
GetCurrentConsoleFont
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
PowerCreateRequest
PowerSetRequest
PowerClearRequest
ResumeThread
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
RegisterWaitForSingleObject
UnregisterWait
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetSystemDirectoryA
LoadLibraryA
VirtualAlloc
VirtualProtect
VirtualFree
SwitchToFiber
DeleteFiber
CreateFiberEx
GetEnvironmentVariableW
ConvertFiberToThread
ConvertThreadToFiberEx
SetConsoleMode
ReadConsoleA
FindFirstFileW
VerSetConditionMask
GetNativeSystemInfo
VerifyVersionInfoW
GetFileAttributesW
LockFile
RemoveDirectoryW
UnlockFile
GetTempPathA
GetLocalTime
CreateFileMappingW
MoveFileW
ReplaceFileW
QueryPerformanceFrequency
GetTickCount
K32EnumProcessModules
K32GetModuleFileNameExW
K32GetModuleInformation
GetVolumePathNameW
AreFileApisANSI
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileTime
SetEndOfFile
SetFileAttributesW
DeviceIoControl
CreateDirectoryExW
WaitForSingleObjectEx
CreateSemaphoreA
ReleaseSemaphore
DuplicateHandle
GlobalFree
OpenEventA
OutputDebugStringA
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableSRW
GetLogicalProcessorInformation
WriteConsoleA
SetConsoleTextAttribute
WaitForMultipleObjectsEx
SetThreadDescription
TerminateJobObject
GetUserDefaultLangID
GetUserDefaultLocaleName
TryAcquireSRWLockExclusive
UnregisterWaitEx
SetThreadInformation

oleaut32

GetErrorInfo
SetErrorInfo
SysFreeString
SysAllocString
VariantClear
SysStringLen
SysAllocStringByteLen

ntdll

RtlInitUnicodeString

userenv

DeriveAppContainerSidFromAppContainerName
CreateAppContainerProfile

mswsock

GetAcceptExSockaddrs
AcceptEx

bcrypt

BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpWebSocketCompleteUpgrade
WinHttpGetProxyForUrl
WinHttpSetTimeouts
WinHttpConnect
WinHttpWebSocketReceive
WinHttpWebSocketSend
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetOption
WinHttpOpen

dnsapi

DnsServiceBrowse
DnsFree
DnsServiceBrowseCancel

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData

api-ms-win-mm-time-l1-1-0

timeGetTime

dsound

ord2
ord11

avrt

AvSetMmThreadCharacteristicsW
AvSetMmThreadPriority
AvRevertMmThreadCharacteristics

Exports

Exports

GetHandleVerifier
IsSandboxedProcess

Sections

.text
Size: 19.8MB - Virtual size: 19.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7.5MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

prot
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0200a0523f0d28c38117a2928ce990e8

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0f:ab:67:0a:61:bf:4b:7d:af:d5:59:35:6b:5b:cc:ffCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

ba:c9:33:75:0b:92:a8:a0:dc:df:a4:c1:99:7b:c9:9e:a9:83:f4:63:9f:07:20:12:3f:23:7a:96:c4:57:73:5aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

iphlpapi

ws2_32

gdiplus

crypt32

dbghelp

kernel32

oleaut32

ntdll

userenv

mswsock

bcrypt

winhttp

dnsapi

wintrust

api-ms-win-mm-time-l1-1-0

dsound

avrt

Exports

Exports

Sections

.text Size: 19.8MB - Virtual size: 19.8MB

.rdata Size: 5.1MB - Virtual size: 5.1MB

.data Size: 7.5MB - Virtual size: 7.8MB

.pdata Size: 1.0MB - Virtual size: 1.0MB

_RDATA Size: 512B - Virtual size: 348B

prot Size: 512B - Virtual size: 116B

.rsrc Size: 72KB - Virtual size: 71KB

.reloc Size: 260KB - Virtual size: 259KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0f:ab:67:0a:61:bf:4b:7d:af:d5:59:35:6b:5b:cc:ff
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

ba:c9:33:75:0b:92:a8:a0:dc:df:a4:c1:99:7b:c9:9e:a9:83:f4:63:9f:07:20:12:3f:23:7a:96:c4:57:73:5a
Signer

.text
Size: 19.8MB - Virtual size: 19.8MB

.rdata
Size: 5.1MB - Virtual size: 5.1MB

.data
Size: 7.5MB - Virtual size: 7.8MB

.pdata
Size: 1.0MB - Virtual size: 1.0MB

_RDATA
Size: 512B - Virtual size: 348B

prot
Size: 512B - Virtual size: 116B

.rsrc
Size: 72KB - Virtual size: 71KB

.reloc
Size: 260KB - Virtual size: 259KB