1a10550d0149c2f9d716346efc0c12210a4965a3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
1a10550d0149c2f9d716346efc0c12210a4965a3.exe
Size 237KB
Sample241111-vb93hssbnd
SHA256 b19a22e002033220539de5970500c87800b4b64c7bbc583249862cffd27d4a5c
MD5 0c0cf9c43172b6291ee38ce1bcf3e00c
SHA1 1a10550d0149c2f9d716346efc0c12210a4965a3
SHA512 44f7a02e22585b3cddbfd78faeef9eda718ecd961c25385bbad9ec0e3a4ece34a79e46d84b868488ec8afce148c02d3a6bef2428ef4e1d024e7ac6d85e5c0b91
SSDEEP 6144:gD8okEvTyoZVOgd2QZiw5NLclL5orfQH:isjCF2QZiOU+4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

1a10550d0149c2f9d716346efc0c12210a4965a3.exe

.exe 237KB

1a10550d0149c2f9d716346efc0c12210a4965a3.exe

IMPHASH 77eb68348ee30e01ec09fce3582c5f76
SHA256 b19a22e002033220539de5970500c87800b4b64c7bbc583249862cffd27d4a5c
MD5 0c0cf9c43172b6291ee38ce1bcf3e00c
SHA1 1a10550d0149c2f9d716346efc0c12210a4965a3
SHA512 44f7a02e22585b3cddbfd78faeef9eda718ecd961c25385bbad9ec0e3a4ece34a79e46d84b868488ec8afce148c02d3a6bef2428ef4e1d024e7ac6d85e5c0b91
SSDEEP 6144:gD8okEvTyoZVOgd2QZiw5NLclL5orfQH:isjCF2QZiOU+4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Avira GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development 2009,O=Avira GmbH,L=Tettnang,ST=Baden-Wuerttemberg,C=DE

Serial Number

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2009 - Feb 11, 2012

Minor OS version

Major OS version

Entry point

5452

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeInformationW lstrcmp LocalFree GetTempPathW FileTimeToDosDateTime GetCalendarInfoA EnumDateFormatsW GetVersionExA GlobalDeleteAtom GlobalFindAtomA GlobalAlloc LocalAlloc CreateFiber CreatePipe CompareStringA VirtualAlloc GetVolumeInformationA LoadLibraryA GetSystemDirectoryW EnumDateFormatsA GetLogicalDrives DisconnectNamedPipe CopyFileA SetLocaleInfoW FreeResource SystemTimeToFileTime SetThreadPriority

user32

GetMenuItemRect CheckMenuRadioItem GetWindowRect GetCaretPos ActivateKeyboardLayout GetParent CallWindowProcW WinHelpW LoadCursorW AdjustWindowRect CopyImage CreateDialogIndirectParamW GetCursorPos GetMenuItemID LoadMenuIndirectA CharUpperW CreateMenu ArrangeIconicWindows RegisterClassExW LoadIconA SetWindowPos DestroyWindow DialogBoxIndirectParamW GetDlgItemInt GetSysColor DialogBoxParamW ShowCaret WaitMessage DestroyCursor UnregisterClassW SendMessageW MonitorFromRect GetClassNameA GetClassInfoExA GetIconInfo DrawTextW DrawTextA CallWindowProcA CreateWindowExW UpdateWindow

gdi32

SetICMProfileW ExtEscape SetRectRgn RemoveFontResourceExW GetPolyFillMode ColorMatchToTarget GetCharABCWidthsI SetWorldTransform PlayMetaFile GetLogColorSpaceW CreateRoundRectRgn SetWindowOrgEx GetCharacterPlacementW

advapi32

RegOpenKeyW RegOpenKeyExW RegEnumValueA RegCreateKeyExA

shell32

SHFreeNameMappings

opengl32

glTexGendv glTexCoord2iv glRecti glDebugEntry glEvalCoord1fv glMaterialfv glRasterPos2fv glPixelMapuiv glEvalCoord2d

inetcomm

MimeOleGetContentTypeExt MimeOleGetBodyPropA CreateSMTPTransport MimeOleConvertEnrichedToHTML

Name

.X2"*

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.d>ir

Size

512B

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.T:O

Size

1024B

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.b9"g9Y

Size

3KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.LJn

Size

2KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

206KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1a10550d0149c2f9d716346efc0c12210a4965a3.exe

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

opengl32

inetcomm

generic