avast_free_antivirus_setup_online[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
avast_free_antivirus_setup_online.exe
Size 243KB
Sample241015-tbs9bsshqc
SHA256 b625fd9059386774f2952b00c679590b0b6c628e58da1fa6ed65b1a6d8026439
MD5 2a1972531c60c349f9637a364b73af05
SHA1 eadae5b76f1335a0e090dff8c81ff58f7ffa3975
SHA512 cfebb736a966e4fc64fbe89d1e993e03f41374a3efbc44c20679bc5db7b6dc5176f0bf5cbb02a2d291f4ebe38a2c5425ee17ed52e9c1f6dece9afcff6fd77ede
SSDEEP 3072:+eJbDwLibLaZ/S91gxiJPU3qtmQv2cthYSdqMREwPLr6VsOWPGWynVFGQMeJquu1:+kDOZargxSHmQv2+B9EwCzGQMeQBqq7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

avast_free_antivirus_setup_online.exe

.exe 243KB

avast_free_antivirus_setup_online.exe

IMPHASH d692b06eb88ecd849f7778fde1ba5c2b
SHA256 b625fd9059386774f2952b00c679590b0b6c628e58da1fa6ed65b1a6d8026439
MD5 2a1972531c60c349f9637a364b73af05
SHA1 eadae5b76f1335a0e090dff8c81ff58f7ffa3975
SHA512 cfebb736a966e4fc64fbe89d1e993e03f41374a3efbc44c20679bc5db7b6dc5176f0bf5cbb02a2d291f4ebe38a2c5425ee17ed52e9c1f6dece9afcff6fd77ede
SSDEEP 3072:+eJbDwLibLaZ/S91gxiJPU3qtmQv2cthYSdqMREwPLr6VsOWPGWynVFGQMeJquu1:+kDOZargxSHmQv2+B9EwCzGQMeQBqq7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

95:3a:83:e7:18:13:c9:9e:4f:cb:87:54:2f:16:b9:fa:90:32:64:ed:97:d2:07:e5:a9:8e:0b:4e:11:55:84:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

Chains

Sep 29, 2024

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

Serial Number

01:5a:6b:ec:4d:7f:54:9f:e5:25:c8:52:df:67:0e:13

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 16, 2023 - Jan 15, 2026

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

4128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb

kernel32

InterlockedExchangeAdd HeapFree GetLastError SetLastError Sleep GetFileSizeEx WriteFile SetEndOfFile SetFilePointerEx CloseHandle MapViewOfFile UnmapViewOfFile CreateFileMappingW FindResourceExW EnumResourceNamesW GetWindowsDirectoryW CreateDirectoryW CreateFileW MultiByteToWideChar CreateThread GetSystemTimeAsFileTime GetNativeSystemInfo lstrcatA lstrlenA GetVersionExA GetCurrentProcess GetExitCodeProcess ResumeThread ReleaseMutex WaitForSingleObject CreateMutexW CreateProcessW GetPrivateProfileIntW GetPrivateProfileStringW GetDiskFreeSpaceExW CopyFileW MoveFileExW CreateHardLinkW LocalFree HeapAlloc GetProcessHeap HeapSetInformation ExitProcess IsProcessorFeaturePresent lstrcpyW GetModuleHandleW GetCommandLineW GetSystemDirectoryW SetDllDirectoryW WriteConsoleW FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose LCMapStringW FindResourceW LoadLibraryW SizeofResource LoadResource GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetVersionExW FreeLibrary LockResource GetFileType GetStringTypeW InterlockedExchange GetUserDefaultLangID GetProcAddress GetACP RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA LoadLibraryA DecodePointer GetVersion HeapDestroy HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount DeleteCriticalSection DeviceIoControl GetVolumeNameForVolumeMountPointW GetVolumePathNameW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW TerminateProcess OutputDebugStringW RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetCommandLineA GetStdHandle GetModuleFileNameW GetModuleHandleExW

user32

ReleaseDC GetMessageW TranslateMessage DispatchMessageW AllowSetForegroundWindow PostMessageW wsprintfA LoadStringW MessageBoxExW wsprintfW SystemParametersInfoW IsDialogMessageW LoadImageW DestroyIcon FindWindowW FillRect GetWindowRect InvalidateRect SendMessageW BeginPaint EndPaint GetDC SetForegroundWindow GetSystemMetrics KillTimer SetTimer SetFocus SetWindowPos DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW

gdi32

GetObjectW CreateDIBSection SelectObject GetTextExtentPoint32W DeleteObject CreateSolidBrush CreatePatternBrush CreateFontIndirectW

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA GetSidSubAuthorityCount GetSidSubAuthority IsValidSid GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorA

ole32

CoInitializeEx CoCreateInstance CreateStreamOnHGlobal CoUninitialize

comctl32

ord17

shlwapi

StrStrW StrToIntW

Name

.text

Size

139KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

avast_free_antivirus_setup_online.exe

kernel32

user32

gdi32

advapi32

ole32

comctl32

shlwapi

generic