2f0cbfa0f285df217fac1faad59fa80f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2f0cbfa0f285df217fac1faad59fa80f.exe
Size 27.8MB
Sample240916-m99kmsthkd
SHA256 6ec2acc681da0597eeb30a40a34d5d1054152b18eb1e77e9c02a4dc77c030985
MD5 2f0cbfa0f285df217fac1faad59fa80f
SHA1 bcef79da67710f2691a2f9f1d63815aa58fb8707
SHA512 fe0d9fb84afefe2e408d4d0c4d810205b256de729f42d472d7cd503c8070c8888a19581af9e01541b6889eb6d5c83dc3d0ebcabc137c9f43923aedff6c75ae2b
SSDEEP 393216:lRPgWrgOSzU6QhcUkTb0LQvz1HaeNceuGznq6HZac4fFrPn:fPgWVOTwkrReeuGu6HUc49r
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

File Explorer

2f0cbfa0f285df217fac1faad59fa80f.exe

.exe 27.8MB

2f0cbfa0f285df217fac1faad59fa80f.exe

IMPHASH 9672ebf5bb7c1bcff5adba809443e5a6
SHA256 6ec2acc681da0597eeb30a40a34d5d1054152b18eb1e77e9c02a4dc77c030985
MD5 2f0cbfa0f285df217fac1faad59fa80f
SHA1 bcef79da67710f2691a2f9f1d63815aa58fb8707
SHA512 fe0d9fb84afefe2e408d4d0c4d810205b256de729f42d472d7cd503c8070c8888a19581af9e01541b6889eb6d5c83dc3d0ebcabc137c9f43923aedff6c75ae2b
SSDEEP 393216:lRPgWrgOSzU6QhcUkTb0LQvz1HaeNceuGznq6HZac4fFrPn:fPgWVOTwkrReeuGu6HUc49r
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.

PE Signature issue

Digest

8f:98:f5:48:f0:96:7c:c9:3c:bc:e8:46:29:af:eb:24:d1:bf:84:60:f3:5c:a1:18:ec:5a:d2:e5:79:f4:5e:66

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=13066343,CN=CYNC LIMITED,O=CYNC LIMITED,L=London,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 11, 2024

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

56:b6:29:cd:34:bc:78:f6

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2017 - May 30, 2042

Subject

SERIALNUMBER=13066343,CN=CYNC LIMITED,O=CYNC LIMITED,L=London,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0f:a2:7d:25:53:f2:4d:a7:9d:1c:c6:bd:87:73:ee:9a

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 25, 2024 - Jul 25, 2025

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

CN=SSL.com Timestamping Unit 2024 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2024 - Feb 16, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

4511408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

QueueUserAPC LocalFree DeleteCriticalSection WideCharToMultiByte lstrcpyW SleepEx GetTempFileNameW FormatMessageA CreateIoCompletionPort CreateEventW PostQueuedCompletionStatus WaitForSingleObject FindClose GetTempPathW EnumResourceNamesW GetEnvironmentVariableW GetQueuedCompletionStatus LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects EnumResourceTypesW CreateWaitableTimerW lstrlenW EnterCriticalSection SetLastError SetWaitableTimer FindFirstFileW FindResourceW WriteConsoleW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetConsoleOutputCP GetFileSizeEx HeapSize HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapAlloc HeapFree GetModuleFileNameW FileTimeToSystemTime LoadResource CloseHandle GlobalAlloc LockResource TerminateThread SetEvent GetLastError SizeofResource FormatMessageW GetFileAttributesW CreateFile2 MultiByteToWideChar IsValidCodePage GetACP GetOEMCP CreateFileA CreateFileW GetFileAttributesA GetFileInformationByHandle GetFileType GetFullPathNameW ReadFile WriteFile PeekNamedPipe GetExitCodeProcess Sleep GetStdHandle SearchPathA DuplicateHandle SetHandleInformation CreatePipe GetCurrentProcess CreateProcessA OpenProcess GetProcAddress LoadLibraryA InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetModuleHandleW InitializeCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetSystemInfo VirtualFree GetCurrentProcessId GetSystemTimeAsFileTime GetSystemTime SystemTimeToFileTime GetSystemDirectoryA FreeLibrary LoadLibraryW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW PulseEvent GetDiskFreeSpaceW SetFilePointer GetVersion GetVersionExW FlushFileBuffers DeleteFileW MoveFileW CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile MoveFileExW SetEndOfFile SignalObjectAndWait ResetEvent ReleaseMutex CreateMutexW CreateThread GetTickCount LockFile LockFileEx UnlockFile RaiseException GetLocaleInfoEx WaitForSingleObjectEx SwitchToThread WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW TryAcquireSRWLockExclusive GetCurrentDirectoryW FindFirstFileExW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetCPInfo InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedPushEntrySList LoadLibraryExW ExitProcess GetTimeZoneInformation ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler SetStdHandle SetFilePointerEx GetDriveTypeW SystemTimeToTzSpecificLocalTime CreateDirectoryW

user32

GetUserObjectInformationW MessageBoxW GetProcessWindowStation MessageBoxA

shell32

ShellExecuteW

ws2_32

sendto recvfrom getpeername shutdown socket setsockopt listen connect closesocket bind accept send recv WSASetLastError WSASend getservbyport WSACreateEvent WSACloseEvent WSAEnumNetworkEvents gethostbyaddr inet_ntoa inet_addr htons htonl WSAGetLastError gethostbyname select ntohs getsockopt getsockname ioctlsocket WSACleanup WSAStartup WSAWaitForMultipleEvents ntohl WSARecv WSAEventSelect getservbyname

shlwapi

PathFileExistsW

crypt32

CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertOpenSystemStoreW

advapi32

CryptGetUserKey CryptReleaseContext CryptGenRandom DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptDestroyKey CryptSetHashParam CryptGetProvParam InitializeSecurityDescriptor CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW SetSecurityDescriptorDacl

Sharing

General

Malware Config

Signatures

File Explorer

2f0cbfa0f285df217fac1faad59fa80f.exe

PE Signature issue

kernel32

user32

shell32

ws2_32

shlwapi

crypt32

advapi32

generic