df3eaa545b4ea760919cf931af960521
- SHA256 1c515ba8bd1319594bc5ef7f306c52b32d08d7aea0531f87d60b40b2ed797c51
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
3fd1e5924ec48bb5abc6243cf1641e5f0323ab68d494e5c412a830e45f1e36d7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
3fd1e5924ec48bb5abc6243cf1641e5f0323ab68d494e5c412a830e45f1e36d7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target df3eaa545b4ea760919cf931af960521
- Size 1.5MB
- Sample241109-mlfbwsvrgp
- SHA256 1c515ba8bd1319594bc5ef7f306c52b32d08d7aea0531f87d60b40b2ed797c51
- MD5 df3eaa545b4ea760919cf931af960521
- SHA1 5cbc5677328a48773cd843f8baae8012c932691f
- SHA512 7ad0f78125cd19a395ea1385212fce91c675686958afb796ead2cff342645e43bab32836327e1b9a1cdbab38ee7d040b6290776d7950cf587746aa1a885273a2
- SSDEEP 24576:evIr7w5P2yy5PCdNU6krlzxpdowqJcZKhS7p1KMuLwpcp/Ibt9aB7:evO7Y2yWb6krFxpdowqJcZKhS7pqLwpc
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
df3eaa545b4ea760919cf931af960521.zip 1.5MB
-
3fd1e5924ec48bb5abc6243cf1641e5f0323ab68d494e5c412a830e45f1e36d7.exe.exe 1.7MB
3fd1e5924ec48bb5abc6243cf1641e5f0323ab68d494e5c412a830e45f1e36d7.exe
- IMPHASH ee5612dffe4cd5c13fb65a3e987147a3
- SHA256 3fd1e5924ec48bb5abc6243cf1641e5f0323ab68d494e5c412a830e45f1e36d7
- MD5 1043817d0d592f519cadf46caf36d1c6
- SHA1 2164d3cbfaebd2a58adf3e1ad06ed5f6e4ead928
- SHA512 197576a9a1821b4d517166c6df55879a2949a500920babcb6641b99b761db92eb68b58abace0ec92e527cdd871ceab3632374eb030ba8da5cd2d8a5ec9147675
- SSDEEP 24576:6IuBu5SsFqHllFMco/TSBGIR3AwCctJqSXpnKycHVP5XUbme:6zBu5SsFUlFcbSAVwfZKL1REm
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
46:84:f4:bb:73:d6:fc:46:0c:52:e0:9c:cd:db:59:c9:5f:31:78:84:f9:ec:27:91:fe:97:d2:34:81:f4:99:ce
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=*.copel.com,O=COMPANHIA PARANAENSE DE ENERGIA,L=CURITIBA,ST=Paraná,C=BR
Chains
Nov 11, 2022
Subject
CN=*.copel.com,O=COMPANHIA PARANAENSE DE ENERGIA,L=CURITIBA,ST=Paraná,C=BR
Serial Number
05:f3:1f:07:b9:17:16:58:c3:86:2b:d9:fd:4e:db:3f
Issuer
CN=GeoTrust RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US
Timespan
Sep 15, 2022 - Aug 18, 2023
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
6
Entry point
44952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FreeLibrary
HeapAlloc
InterlockedIncrement
HeapFree
CreateDirectoryW
SetEvent
GetModuleHandleW
GetProcessHeap
GlobalAlloc
GetSystemDirectoryW
WideCharToMultiByte
LoadLibraryW
Sleep
CreateFileW
GetPrivateProfileIntW
GetConsoleAliasesW
GetLastError
SetLastError
GetProcAddress
GetProcessHeaps
GetDefaultCommConfigW
LoadLibraryA
GlobalMemoryStatusEx
CreatePipe
lstrcatW
GetStringTypeW
GetConsoleTitleW
DeleteFileW
DeleteAtom
lstrcpyW
CloseHandle
LCMapStringEx
HeapSize
WriteConsoleW
SetThreadErrorMode
GetLocalTime
ExitProcess
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
EncodePointer
DecodePointer
InterlockedDecrement
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
ReadFile
GetConsoleMode
ReadConsoleW
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
WriteFile
GetModuleFileNameW
RtlUnwind
GetConsoleCP
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
LoadLibraryExW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
SetFilePointerEx
FlushFileBuffers
OutputDebugStringW
SetEndOfFile
user32
GetWindowRect
LoadCursorW
wsprintfW
GetDC
LoadIconW
GetDesktopWindow
GetSysColorBrush
RegisterClassW
SendMessageW
CountClipboardFormats
gdi32
CreateSolidBrush
SetGraphicsMode
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.primero
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bojitr
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.juntrex
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mimsps
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=207, version=50628,
count=16, id=205, version=50628,
count=121, id=206, version=50628,
count=109, id=1, productName=Unmarked objects,
count=7, id=185, version=30716,
count=2, id=211, version=50727,
count=1, id=201, productName=VS2012 build 50727, version=50727,
count=7, id=151,
count=1, id=204, productName=VS2012 build 50727, version=50727,