2ad4343522d7a5ea98cc80e4df4a9c04cf33df8a6e485871f5715769a08004b1

Sharing

Copy URL Twitter E-mail

General

Target
2ad4343522d7a5ea98cc80e4df4a9c04cf33df8a6e485871f5715769a08004b1
Size 197KB
Sample240910-jbkbbatdpb
SHA256 2ad4343522d7a5ea98cc80e4df4a9c04cf33df8a6e485871f5715769a08004b1
MD5 7bab86b2f25d1047305600051f616580
SHA1 008501dd416e699a4b189f7e8a02f7b16109f01e
SHA512 bb3a04755e8f0762e51cce5b6a4b6e251320c965b080c4c0678fdc0bd691e3637e8577880eabd5e6d66a7595713665f073c9df067060bcf95e9e36040a8c678a
SSDEEP 6144:ko7Y+tE5LrNn8QG9mFd0BV+UdvrEFp7hKHx:ko7Y+tMn8VmFd0BjvrEH7W
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2ad4343522d7a5ea98cc80e4df4a9c04cf33df8a6e485871f5715769a08004b1

.dll 197KB

2ad4343522d7a5ea98cc80e4df4a9c04cf33df8a6e485871f5715769a08004b1

IMPHASH 4e040f95a0245947c112b5751408d98f
SHA256 2ad4343522d7a5ea98cc80e4df4a9c04cf33df8a6e485871f5715769a08004b1
MD5 7bab86b2f25d1047305600051f616580
SHA1 008501dd416e699a4b189f7e8a02f7b16109f01e
SHA512 bb3a04755e8f0762e51cce5b6a4b6e251320c965b080c4c0678fdc0bd691e3637e8577880eabd5e6d66a7595713665f073c9df067060bcf95e9e36040a8c678a
SSDEEP 6144:ko7Y+tE5LrNn8QG9mFd0BV+UdvrEFp7hKHx:ko7Y+tMn8VmFd0BjvrEH7W
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

4e:b7:51:10:93:b5:5a:b6:cd:c4:cd:c3:d3:b1:44:e1:aa:ff:c0:04:c2:c4:1e:29:3a:3b:8d:cf:96:00:ce:37

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Lenovo,O=Lenovo,L=Morrisville,ST=North Carolina,C=US

Chains

Jun 21, 2024

CN=Lenovo,O=Lenovo,L=Morrisville,ST=North Carolina,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Lenovo,O=Lenovo,L=Morrisville,ST=North Carolina,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Lenovo,O=Lenovo,L=Morrisville,ST=North Carolina,C=US

Serial Number

0c:3a:09:57:17:d6:17:22:12:0b:aa:f8:65:00:e9:f1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 7, 2024 - Feb 6, 2025

Minor OS version

Major OS version

Entry point

10408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\home\jenkins\agent\workspace\17-Commercial-1.20-Consumer-2407\src\LenovoSystemUpdateAddin\bin\x86\Release\kehelper.pdb

kernel32

CloseHandle CreateFileA GetModuleHandleA DeviceIoControl GetCurrentProcess GetModuleFileNameA DecodePointer GetProcAddress GetLastError WriteConsoleW CreateFileW HeapReAlloc HeapSize GetStringTypeW SetFilePointerEx GetFileSizeEx SetStdHandle MultiByteToWideChar WideCharToMultiByte LocalFree UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree LCMapStringW GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode

advapi32

CloseServiceHandle OpenSCManagerA DeleteService ControlService StartServiceA OpenServiceA CreateServiceA

ole32

CoCreateInstance CoInitializeSecurity CoInitializeEx CoSetProxyBlanket CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

2ad4343522d7a5ea98cc80e4df4a9c04cf33df8a6e485871f5715769a08004b1

PE Signature issue

kernel32

advapi32

ole32

oleaut32

generic