97f24cb6eb9da0d81d99827e4e6c958ad2430b95dcec7454a8b5bcb64c59698a[.]exe

Resubmissions

06/03/2025, 12:10

250306-pb3esaxyh110

12/11/2024, 11:40

241112-ntbjcasbna10

Sharing

Copy URL Twitter E-mail

General

Target
97f24cb6eb9da0d81d99827e4e6c958ad2430b95dcec7454a8b5bcb64c59698a.exe
Size 245KB
Sample241112-ntbjcasbna
SHA256 97f24cb6eb9da0d81d99827e4e6c958ad2430b95dcec7454a8b5bcb64c59698a
MD5 470acf531aa68ba154781b9886bb8f53
SHA1 fd4e96372f1e4957ed761e11fb885715cd30bba8
SHA512 18b5ef5ed268236eaa59278f320a23d48034ab366060f7e5864ca7b34108798daf0e21269f6008272826621761e61bb43336b520227853ca432aa5c465c92925
SSDEEP 6144:O7HI/0S6GcV6yabg0OLe//fRD/uzc+8fJpgY08g:gH6b6GcV6wq/fJ/rDfJpgYE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

97f24cb6eb9da0d81d99827e4e6c958ad2430b95dcec7454a8b5bcb64c59698a.exe

.exe 245KB

97f24cb6eb9da0d81d99827e4e6c958ad2430b95dcec7454a8b5bcb64c59698a.exe

IMPHASH 70527f2eb8f7c61d13b2009a3286b536
SHA256 97f24cb6eb9da0d81d99827e4e6c958ad2430b95dcec7454a8b5bcb64c59698a
MD5 470acf531aa68ba154781b9886bb8f53
SHA1 fd4e96372f1e4957ed761e11fb885715cd30bba8
SHA512 18b5ef5ed268236eaa59278f320a23d48034ab366060f7e5864ca7b34108798daf0e21269f6008272826621761e61bb43336b520227853ca432aa5c465c92925
SSDEEP 6144:O7HI/0S6GcV6yabg0OLe//fRD/uzc+8fJpgY08g:gH6b6GcV6wq/fJ/rDfJpgYE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Avira GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development 2009,O=Avira GmbH,L=Tettnang,ST=Baden-Wuerttemberg,C=DE

Serial Number

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2009 - Feb 11, 2012

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcmpiW lstrcatA GetFullPathNameA MulDiv QueryPerformanceFrequency GetVersion GetSystemDirectoryA GetLastError CreateDirectoryW FileTimeToDosDateTime LocalAlloc OpenEventW IsBadCodePtr VirtualAlloc GetModuleFileNameA GetLogicalDrives EnumCalendarInfoA GetModuleFileNameW GetNumberFormatA lstrlenA GetShortPathNameA DosDateTimeToFileTime IsValidCodePage CreateEventW GetCurrentDirectoryA GetSystemDefaultLCID GetCommandLineW GetSystemDefaultLangID GetCalendarInfoW CreateMutexA OpenSemaphoreA GetLocalTime LocalFree IsBadWritePtr GetCurrentProcessId SetLocaleInfoW

user32

DialogBoxParamW CallWindowProcA UpdateLayeredWindow InsertMenuA LoadCursorW CopyImage GetClassNameA DefDlgProcA CreateDialogIndirectParamW UpdateWindow SetWindowTextA UnregisterClassW DestroyIcon CreateDesktopA GetMenuInfo GetActiveWindow EndMenu GetDC OpenWindowStationA DrawTextW MessageBoxIndirectA RegisterClassW GetKeyboardLayout GetWindowTextA LoadBitmapA

gdi32

ResizePalette CreateFontIndirectExA GetTextColor CreatePolyPolygonRgn SetTextAlign SetPixel ColorCorrectPalette SetBkColor

advapi32

RegOpenKeyW RegQueryInfoKeyW RegOpenKeyW

ole32

CoDosDateTimeToFileTime BindMoniker CoGetDefaultContext CoGetClassVersion OleUninitialize CoFileTimeNow GetConvertStg OleCreate CoGetInstanceFromFile

oleaut32

VarDecFromUI1 VarUI2FromI2 VarBoolFromStr SafeArraySetIID VarFormatFromTokens VarBstrFromDate VarUI4FromR8

urlmon

RegisterMediaTypeClass URLOpenStreamW

inetcomm

MimeOleStripHeaders MimeOleAlgStrengthFromSMimeCap MimeOleSetCompatMode MimeOleGetRelatedSection MimeOleGetExtContentType EssSignCertificateDecodeEx MimeOleSMimeCapRelease MimeOleGetInternat MimeOleOpenFileStream MimeOleSMimeCapsToDlg MimeOleFileTimeToInetDate EssMLHistoryEncodeEx MimeOleGetCodePageInfo HrGetDisplayNameWithSizeForFile MimeOleSMimeCapAddSMimeCap

Name

.@+e

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.-e

Size

2KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.b"1

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ub*l

Size

1KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.V.K

Size

1024B

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

3KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.;O4*v(

Size

512B

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

214KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

97f24cb6eb9da0d81d99827e4e6c958ad2430b95dcec7454a8b5bcb64c59698a.exe

PE Signature issue

kernel32

user32

gdi32

advapi32

ole32

oleaut32

urlmon

inetcomm

generic