91f6decbef6b9e8d950ad6e4d3d8e79840f26653b6a2259a957dc6295118e151

Sharing

Copy URL Twitter E-mail

General

Target
91f6decbef6b9e8d950ad6e4d3d8e79840f26653b6a2259a957dc6295118e151
Size 218KB
Sample241031-crhdbsymfl
SHA256 91f6decbef6b9e8d950ad6e4d3d8e79840f26653b6a2259a957dc6295118e151
MD5 76396a70ae28b095e4b3386186293a38
SHA1 6d9582554eeb6c44e2d2f58921c0a0f5b73b82b3
SHA512 74968ddeb5f3994aacc7a29a574dca1211916a600fef9d8318a1a8e41d6d5a1b4f9a8d8d72321b7b848d560f70967bf2bbfc6af049053d3c5b926e42fdc94e67
SSDEEP 3072:nvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:v1SyAJp6rjn1gOObn4b6h9h
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

91f6decbef6b9e8d950ad6e4d3d8e79840f26653b6a2259a957dc6295118e151

.exe 218KB

91f6decbef6b9e8d950ad6e4d3d8e79840f26653b6a2259a957dc6295118e151

IMPHASH 5dbe4621616d081e3440b0469a9471ca
SHA256 91f6decbef6b9e8d950ad6e4d3d8e79840f26653b6a2259a957dc6295118e151
MD5 76396a70ae28b095e4b3386186293a38
SHA1 6d9582554eeb6c44e2d2f58921c0a0f5b73b82b3
SHA512 74968ddeb5f3994aacc7a29a574dca1211916a600fef9d8318a1a8e41d6d5a1b4f9a8d8d72321b7b848d560f70967bf2bbfc6af049053d3c5b926e42fdc94e67
SSDEEP 3072:nvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:v1SyAJp6rjn1gOObn4b6h9h
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

1a:1a:68:ca:97:da:2f:d6:ef:b5:93:14:5e:61:bb:e0:62:cb:95:b2

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Chains

Oct 29, 2024

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Serial Number

01:ed:f8:34:0c:df:06:0c:09:9e:1a:64:72:f7:6d:b4

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 11, 2006 - Nov 24, 2007

Minor OS version

Major OS version

Entry point

277531

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreatePipe GetComputerNameA GetCalendarInfoA TlsAlloc CreateDirectoryW GetMailslotInfo GetModuleFileNameW GetCalendarInfoW GetPriorityClass GetUserDefaultLCID GlobalFindAtomA GetProcAddress FindAtomW FileTimeToLocalFileTime EnumDateFormatsW OpenEventA GetLocaleInfoW lstrcmpiW SetLocaleInfoW GetEnvironmentVariableW GetExitCodeProcess MulDiv SetUnhandledExceptionFilter GetNamedPipeInfo EndUpdateResourceW SetComputerNameA GetProcessHeap SetPriorityClass FreeResource GetModuleHandleW QueryPerformanceFrequency GetFileAttributesW CompareStringA LoadLibraryA IsDebuggerPresent HeapCreate CreateNamedPipeW GetThreadPriority OpenMutexW ExpandEnvironmentStringsA lstrcmpi GetEnvironmentStringsA FileTimeToDosDateTime GetCommandLineA lstrcpynW GetDiskFreeSpaceW lstrcmp GetCurrentDirectoryA

user32

AnimateWindow GetWindowRgn GetClassInfoA CreateDialogParamA GetClassInfoExW EnumChildWindows RegisterClassA DrawTextA SetFocus MessageBoxIndirectW MonitorFromPoint ClientToScreen DefWindowProcA LoadImageA ActivateKeyboardLayout GetTopWindow LoadMenuIndirectA MessageBoxA GetDC UnregisterClassW mouse_event GetMenuState SetCursor ShowCursor IsDlgButtonChecked CheckDlgButton SetParent keybd_event DrawTextW SetDlgItemInt FrameRect RegisterClassExW RemoveMenu SendMessageA TrackPopupMenuEx GetForegroundWindow LoadMenuA GetDlgItemTextW CreateDialogIndirectParamW SetDlgItemTextW MessageBeep SetActiveWindow CharNextA GetMenu UpdateLayeredWindow SetWindowLongA CloseWindow MessageBoxW EndDialog IsIconic CreateAcceleratorTableA

gdi32

PtInRegion SetWorldTransform CreateEnhMetaFileW CreateDCW CreateMetaFileW TranslateCharsetInfo EnumFontsA ScaleViewportExtEx CreateCompatibleDC GetDIBits RemoveFontResourceW SetPixel GetEnhMetaFileDescriptionA

advapi32

RegCreateKeyExW RegOpenKeyW RegRestoreKeyA RegOpenKeyA RegSaveKeyW RegReplaceKeyA

shlwapi

SHDeleteEmptyKeyA PathFindNextComponentW StrCpyW PathStripPathA SHCopyKeyW PathIsURLW SHRegQueryInfoUSKeyW PathCreateFromUrlA

oleaut32

VarR4FromR8

winmm

mciSendStringW mciSendStringA

winspool.drv

DeleteFormA

Name

.sX

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.RqVY

Size

1KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.lziQh

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.EXGwv

Size

4KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

167KB

Virtual Size

535KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

4KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

950B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

91f6decbef6b9e8d950ad6e4d3d8e79840f26653b6a2259a957dc6295118e151

PE Signature issue

kernel32

user32

gdi32

advapi32

shlwapi

oleaut32

winmm

winspool.drv

generic