rename (2)[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

rename (2).exe
Size

1.6MB
MD5

2192b5059195d40c7a737bcfcc04abb2
SHA1

1d103964af1ab922252ce1091e906abdebb024b7
SHA256

7cb991b1ecf41a669ad9cf31bf882f9eb3e31381b757c073fccc4e57a224caba
SHA512

628d6eb048ad3b9fd4c0c1a31415b7b9e6edb6f1b560e02894ab3de397193d895e1d9c7dd735dd54fab101d4d5b97b96000369328df3f926877502a4e41187e2
SSDEEP

12288:wp7vRsqy57qrWFsmQ3HUdUyxWKZPKv8y0yx2sYfFNbuyG:U7v4UN3HUWpQSvQPdZu3

Score

1^/10

Malware Config

Signatures

Files

rename (2).exe
.exe windows:6 windows x86 arch:x86

3935bab72eef54886f257d2eb5c2f179

Code Sign

33:00:00:01:0b:bf:86:a4:4e:62:8e:e7:04:00:00:00:00:01:0b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-08-2018 20:20

Not After

23-11-2019 20:20

Subject

CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A240-4B82-130E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:11

Not After

26-07-2019 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:3c:50:47:d6:c6:cf:04:68:d6:00:00:00:00:02:3c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12-07-2018 20:07

Not After

08-08-2019 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

34:16:a5:37:ae:7c:e1:54:d4:16:5a:56:7e:bf:80:65:c0:e3:8b:b3:09:3e:5e:f8:1c:16:1a:ca:47:23:91:b9
Signer

Actual PE Digest

34:16:a5:37:ae:7c:e1:54:d4:16:5a:56:7e:bf:80:65:c0:e3:8b:b3:09:3e:5e:f8:1c:16:1a:ca:47:23:91:b9

Digest Algorithm

sha256

PE Digest Matches

true

04:14:50:31:5d:38:fa:eb:9c:9c:12:ba:20:6b:9e:76:fa:91:1f:5a
Signer

Actual PE Digest

04:14:50:31:5d:38:fa:eb:9c:9c:12:ba:20:6b:9e:76:fa:91:1f:5a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

OneDrive.pdb

Imports

kernel32

SetEvent
MultiByteToWideChar
VerSetConditionMask
VerifyVersionInfoW
PostQueuedCompletionStatus
GetQueuedCompletionStatus
ReadDirectoryChangesW
CreateIoCompletionPort
CreateFileW
OpenFileById
GetFinalPathNameByHandleW
CompareStringOrdinal
GetFileAttributesW
GetExitCodeProcess
ExpandEnvironmentStringsW
SetLastError
ReadConsoleW
ReadFile
SetEndOfFile
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
CreateEventExW
IsValidCodePage
FindNextFileW
IsWow64Process
GetUserDefaultLCID
GetCommandLineW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetCurrentProcess
GetSystemTimeAsFileTime
WaitForSingleObject
TerminateProcess
GetCurrentProcessId
Sleep
OpenProcess
GetModuleHandleW
MoveFileW
CloseHandle
CreateProcessW
CopyFileW
GetModuleHandleExW
FreeLibrary
GetProcAddress
LoadLibraryW
SetDllDirectoryW
GetModuleFileNameW
LocalFree
DeleteCriticalSection
DecodePointer
RaiseException
FindFirstFileExW
FindClose
GetTimeZoneInformation
SetStdHandle
EnumSystemLocalesW
WriteConsoleW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFullPathNameW
GetCurrentDirectoryW
WriteFile
GetStdHandle
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
GetDriveTypeW
GetLastError
GetACP
InitializeCriticalSectionEx
LoadLibraryExW
RtlUnwind
InitializeSListHead
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
GetStringTypeW
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent

user32

GetWindowThreadProcessId
PostMessageW
EnumWindows
GetClassNameW

advapi32

EventWriteTransfer
EventUnregister
FreeSid
SetNamedSecurityInfoW
SetEntriesInAclW
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
RegEnumKeyW
RegCreateKeyTransactedW
EventRegister
RegEnumValueW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
RegDeleteValueW
RegDeleteKeyExW
RegDeleteTreeW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegGetValueW
RegSetKeyValueW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

SHFileOperationW
SHChangeNotify
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetKnownFolderPath
CommandLineToArgvW
ord526

ole32

CoTaskMemFree
StringFromGUID2
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

LoadTypeLi
LoadRegTypeLi
SysAllocString
GetRecordInfoFromTypeInfo
SysFreeString

ktmw32

RollbackTransaction
CommitTransaction
CreateTransaction

shlwapi

SHGetValueW
PathFileExistsW
SHRegGetBoolUSValueW
PathIsPrefixW

wininet

InternetCanonicalizeUrlW

Sections

.text
Size: 392KB - Virtual size: 392KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3935bab72eef54886f257d2eb5c2f179

Code Sign

33:00:00:01:0b:bf:86:a4:4e:62:8e:e7:04:00:00:00:00:01:0bCertificate

Extended Key Usages

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:02:3c:50:47:d6:c6:cf:04:68:d6:00:00:00:00:02:3cCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

34:16:a5:37:ae:7c:e1:54:d4:16:5a:56:7e:bf:80:65:c0:e3:8b:b3:09:3e:5e:f8:1c:16:1a:ca:47:23:91:b9Signer

04:14:50:31:5d:38:fa:eb:9c:9c:12:ba:20:6b:9e:76:fa:91:1f:5aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

ktmw32

shlwapi

wininet

Sections

.text Size: 392KB - Virtual size: 392KB

.rdata Size: 117KB - Virtual size: 116KB

.data Size: 15KB - Virtual size: 19KB

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.reloc Size: 22KB - Virtual size: 22KB

33:00:00:01:0b:bf:86:a4:4e:62:8e:e7:04:00:00:00:00:01:0b
Certificate

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:02:3c:50:47:d6:c6:cf:04:68:d6:00:00:00:00:02:3c
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

34:16:a5:37:ae:7c:e1:54:d4:16:5a:56:7e:bf:80:65:c0:e3:8b:b3:09:3e:5e:f8:1c:16:1a:ca:47:23:91:b9
Signer

04:14:50:31:5d:38:fa:eb:9c:9c:12:ba:20:6b:9e:76:fa:91:1f:5a
Signer

.text
Size: 392KB - Virtual size: 392KB

.rdata
Size: 117KB - Virtual size: 116KB

.data
Size: 15KB - Virtual size: 19KB

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.reloc
Size: 22KB - Virtual size: 22KB