0cf06c833517acebaebf18e5b36edccb4903a112117dbee1a19f9b76c7a7b36f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
0cf06c833517acebaebf18e5b36edccb4903a112117dbee1a19f9b76c7a7b36f.exe
Size 2.1MB
Sample241011-j2fqtatcqb
SHA256 0cf06c833517acebaebf18e5b36edccb4903a112117dbee1a19f9b76c7a7b36f
MD5 de2b7ec32d3a5c530e5a1aa6f2b27b16
SHA1 83c3c02a1c5746882094939ed4f1ab61954ff8f0
SHA512 e76d643dc5fad7de78172bafe3b33da231bbce76fb2c46235338e811112f32775dfd20acf770141808ee00c0e9527829933d9ec1ee04c776b774eff80168bee8
SSDEEP 24576:S/BARUsXRaTX3P/drZ6p7Ut2Qcbgn5DFIOG+N3mYm8hz8UQn652/BJOD:i2HXRWXdrEDQ0gn5xfG+8H8hz8rdm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

0cf06c833517acebaebf18e5b36edccb4903a112117dbee1a19f9b76c7a7b36f.exe

.exe 2.1MB

0cf06c833517acebaebf18e5b36edccb4903a112117dbee1a19f9b76c7a7b36f.exe

IMPHASH 19182dc876641424b2d2a37a50cfbbc8
SHA256 0cf06c833517acebaebf18e5b36edccb4903a112117dbee1a19f9b76c7a7b36f
MD5 de2b7ec32d3a5c530e5a1aa6f2b27b16
SHA1 83c3c02a1c5746882094939ed4f1ab61954ff8f0
SHA512 e76d643dc5fad7de78172bafe3b33da231bbce76fb2c46235338e811112f32775dfd20acf770141808ee00c0e9527829933d9ec1ee04c776b774eff80168bee8
SSDEEP 24576:S/BARUsXRaTX3P/drZ6p7Ut2Qcbgn5DFIOG+N3mYm8hz8UQn652/BJOD:i2HXRWXdrEDQ0gn5xfG+8H8hz8rdm
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

6f:89:ff:e7:b8:6d:6f:6e:99:3b:50:40:1c:5e:6a:42:c0:77:d3:ac:a7:67:a4:bc:03:6a:c6:cf:5d:31:90:83

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91350211MA31JF8419,CN=Xiamen Huixiantong Network Technology Co.\, Ltd.,O=Xiamen Huixiantong Network Technology Co.\, Ltd.,L=Xiamen,ST=Fujian,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13065869616d656e,1.3.6.1.4.1.311.60.2.1.2=#130646756a69616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 30, 2024

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

4a:ea:2f:d2:d3:dd:61:d4:54:b2:9a:90:35:c7:44:3e

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 30, 2024 - Sep 30, 2025

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1361128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Copyright_Infringement_Evidence.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetCurrentProcess DuplicateHandle SetHandleInformation CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus ReadFile GetOverlappedResult SetFileCompletionNotificationModes Sleep GetModuleHandleA GetProcAddress FreeEnvironmentStringsW DeleteProcThreadAttributeList CompareStringOrdinal GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SwitchToThread CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject QueryPerformanceCounter GetSystemInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW SetFileInformationByHandle GetStdHandle GetCurrentProcessId WriteFileEx SleepEx GetExitCodeProcess QueryPerformanceFrequency HeapFree HeapReAlloc lstrlenW ReleaseMutex GetProcessHeap HeapAlloc FindClose CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW FindFirstFileW GetFinalPathNameByHandleW CreateEventW CancelIo GetConsoleMode GetModuleHandleW FormatMessageW GetModuleFileNameW CreateNamedPipeW ReadFileEx WaitForMultipleObjects GetFullPathNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute MultiByteToWideChar WriteConsoleW WideCharToMultiByte CreateThread WaitForSingleObjectEx LoadLibraryA CreateMutexA InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentThreadId IsProcessorFeaturePresent

bcrypt

BCryptGenRandom

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW SystemFunction036

secur32

EncryptMessage DeleteSecurityContext DecryptMessage QueryContextAttributesW FreeContextBuffer InitializeSecurityContextW AcquireCredentialsHandleA FreeCredentialsHandle ApplyControlToken AcceptSecurityContext

ws2_32

freeaddrinfo WSAGetLastError WSAIoctl setsockopt WSAStartup WSASend send getaddrinfo recv shutdown getsockopt ioctlsocket connect bind WSASocketW getsockname getpeername WSACleanup closesocket

crypt32

CertOpenStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateChain CertDuplicateCertificateChain CertFreeCertificateContext CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CertDuplicateStore CertAddCertificateContextToStore CertGetCertificateChain

ntdll

NtCreateFile RtlNtStatusToDosError NtCancelIoFileEx NtReadFile NtDeviceIoControlFile NtWriteFile

vcruntime140

memset memcmp memmove __current_exception_context __CxxFrameHandler3 __current_exception __C_specific_handler memcpy

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

exit _exit __p___argc __p___argv _cexit _c_exit _initialize_narrow_environment _initterm_e _get_initial_narrow_environment _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

0cf06c833517acebaebf18e5b36edccb4903a112117dbee1a19f9b76c7a7b36f.exe

PE Signature issue

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

bcrypt

advapi32

secur32

ws2_32

crypt32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic