bfacb9251b31be01ffbf9a6d9b092b6de5b51a20b0c9294c86b5406d8fb4fe69

Sharing

Copy URL Twitter E-mail

General

Target
bfacb9251b31be01ffbf9a6d9b092b6de5b51a20b0c9294c86b5406d8fb4fe69
Size 1.6MB
Sample240913-b7kb7axemp
SHA256 bfacb9251b31be01ffbf9a6d9b092b6de5b51a20b0c9294c86b5406d8fb4fe69
MD5 6f331278363805257d4defaef298a1ee
SHA1 9e90a65d3dd1cfb0a451dc77306a75cddec6b20b
SHA512 ac24024c451cd2e1269834b4459d9e3254f871a3d5203a1a4d73164d839021c22370ff2c7204ea208c307d4e578e2f49f60e434b2fd1e376273ddacd0e6dde69
SSDEEP 24576:iE+R/c4De3vJVi9g8K0mRxI4aZVKGhzQtQktXCvaYYj3CvewsmXim04Inkp/VfSY:ih/I3/n8KlXI4aSn54hp/sZ7sLH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

bfacb9251b31be01ffbf9a6d9b092b6de5b51a20b0c9294c86b5406d8fb4fe69

.dll 1.6MB

bfacb9251b31be01ffbf9a6d9b092b6de5b51a20b0c9294c86b5406d8fb4fe69

IMPHASH dd40dece45c51d3213936134a03de49a
SHA256 bfacb9251b31be01ffbf9a6d9b092b6de5b51a20b0c9294c86b5406d8fb4fe69
MD5 6f331278363805257d4defaef298a1ee
SHA1 9e90a65d3dd1cfb0a451dc77306a75cddec6b20b
SHA512 ac24024c451cd2e1269834b4459d9e3254f871a3d5203a1a4d73164d839021c22370ff2c7204ea208c307d4e578e2f49f60e434b2fd1e376273ddacd0e6dde69
SSDEEP 24576:iE+R/c4De3vJVi9g8K0mRxI4aZVKGhzQtQktXCvaYYj3CvewsmXim04Inkp/VfSY:ih/I3/n8KlXI4aSn54hp/sZ7sLH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

5a:3b:db:52:e4:9a:6f:f9:51:16:e3:55:d3:06:db:cf:f8:85:96:ff:b8:b0:17:c5:8b:da:80:6a:cb:ea:9b:9f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2543798,CN=AOMEI International Network Limited,OU=Research Development Centre,O=AOMEI International Network Limited,POSTALCODE=610000,STREET=Rm 83 3/F Yau Lee ctr,L=Hong Kong,ST=Hong Kong,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Chains

Dec 15, 2021

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

af:c7:9e:6f:b3:e6:e0:07:c2:44:c4:68:a5:cf:24:4c:ae:d9:7b:fe

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Dec 15, 2021

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

Serial Number

41:5d:8d:48:1d:99:c6:e4:65:78:64:d0:51:5e:e5:4a

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 5, 2019 - Nov 4, 2022

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

61:18:54:86:00:00:00:00:00:24

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 11, 2011 - Apr 11, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

Serial Number

41:5d:8d:48:1d:99:c6:e4:65:78:64:d0:51:5e:e5:4a

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 5, 2019 - Nov 4, 2022

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

61:18:54:86:00:00:00:00:00:24

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 11, 2011 - Apr 11, 2021

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1020972

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\AMWork\trunk\BR\output\win32\release\autoupdate\ABDownloadCore.pdb

ws2_32

getservbyname WSAStartup gethostbyname WSACleanup htonl shutdown gethostname ioctlsocket listen accept recvfrom sendto getaddrinfo freeaddrinfo connect socket closesocket getpeername getsockopt htons bind ntohs getsockname setsockopt WSAIoctl send recv select WSAGetLastError __WSAFDIsSet WSASetLastError

wldap32

ord50 ord46 ord22 ord211 ord143 ord60 ord26 ord30 ord200 ord32 ord35 ord79 ord33 ord301 ord27 ord41

kernel32

SetEnvironmentVariableA CompareStringW CompareStringA GetLocaleInfoA GetTimeZoneInformation SetEndOfFile GetCurrentDirectoryA GetFullPathNameA SetStdHandle FlushFileBuffers GetConsoleCP LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP GetCPInfo RtlUnwind VirtualAlloc VirtualFree HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA SetHandleCount GetModuleFileNameA RaiseException HeapSize InterlockedDecrement InterlockedIncrement TlsFree TlsSetValue TlsAlloc GetFileAttributesW DeleteFileW Sleep CloseHandle WaitForSingleObject ReleaseMutex WriteFile GetFileSize GetDiskFreeSpaceW CreateMutexW GetLocalTime GetStringTypeA GetLastError ReadFile CreateFileW CreateFileMappingW FindClose FindNextFileW GetModuleFileNameW RemoveDirectoryW FindFirstFileW CreateDirectoryW WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetTickCount SleepEx WaitForSingleObjectEx SetLastError FormatMessageA PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle FreeLibrary GetProcAddress ExpandEnvironmentStringsA VerifyVersionInfoA VerSetConditionMask GetSystemDirectoryA LoadLibraryA GetModuleHandleA GetCurrentThreadId GetVersion QueryPerformanceCounter GetCurrentProcessId GlobalMemoryStatus FindFirstFileA SystemTimeToFileTime WriteConsoleW FlushConsoleInputBuffer TlsGetValue GetConsoleMode SetConsoleMode ReadConsoleInputA GetStringTypeW WriteConsoleA GetConsoleOutputCP SetFilePointerEx GetSystemTime SetConsoleCtrlHandler ExitProcess TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread MoveFileW GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap HeapReAlloc GetSystemTimeAsFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle SetFilePointer GetDriveTypeA GetFileAttributesA CreateFileA

user32

GetUserObjectInformationW wsprintfW MessageBoxA GetProcessWindowStation

advapi32

ReportEventA DeregisterEventSource RegisterEventSourceA

ole32

CoCreateGuid

Sharing

General

Malware Config

Signatures

File Explorer

bfacb9251b31be01ffbf9a6d9b092b6de5b51a20b0c9294c86b5406d8fb4fe69

PE Signature issue

PE Signature issue

ws2_32

wldap32

kernel32

user32

advapi32

ole32

generic