SPSSStatistics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SPSSStatistics.exe
Size 884.7MB
Sample241114-az4kessbmg
SHA256 84f052696739bb6b29681d595b118b5752cb6a162f9c2c6522af9a545fafc282
MD5 ac1250aa57f0cadc8f60fd7a86d8ec03
SHA1 f6ab396d2d665d399f6091227962d8919c93b898
SHA512 364f11434b67b6897232386057af9bbdf78e54b9630f5207be32f635ac0ae5848edaa199eb7d2c0a4a62393549a94826b54528b2cae5e7cb151e1d14d5e86c4c
SSDEEP 25165824:RRHgLvVrxxqJRmyD1NhD/3DjIR5I87tvss:Lgb8RmO7PIjIUtv
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

SPSSStatistics.exe

.exe 884.7MB

SPSSStatistics.exe

IMPHASH be32d421a0c2c3f58d3891e1837fbeee
SHA256 84f052696739bb6b29681d595b118b5752cb6a162f9c2c6522af9a545fafc282
MD5 ac1250aa57f0cadc8f60fd7a86d8ec03
SHA1 f6ab396d2d665d399f6091227962d8919c93b898
SHA512 364f11434b67b6897232386057af9bbdf78e54b9630f5207be32f635ac0ae5848edaa199eb7d2c0a4a62393549a94826b54528b2cae5e7cb151e1d14d5e86c4c
SSDEEP 25165824:RRHgLvVrxxqJRmyD1NhD/3DjIR5I87tvss:Lgb8RmO7PIjIUtv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

7b:4f:d5:da:0e:42:cf:c3:61:1f:9e:54:a6:45:db:1d:eb:93:eb:b7:8b:ed:3a:2a:51:af:f3:d4:69:da:52:ee

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=International Business Machines Corporation,O=International Business Machines Corporation,L=Armonk,ST=New York,C=US

Chains

Oct 4, 2024

CN=International Business Machines Corporation,O=International Business Machines Corporation,L=Armonk,ST=New York,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=International Business Machines Corporation,O=International Business Machines Corporation,L=Armonk,ST=New York,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=International Business Machines Corporation,O=International Business Machines Corporation,L=Armonk,ST=New York,C=US

Serial Number

08:cb:cb:6b:86:63:94:e0:32:0a:5f:67:1b:69:f6:bd

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 14, 2024 - Jun 14, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

287434

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\CodeBases\isdev\redist\Language Independent\i386\setup.pdb

comctl32

ord17

kernel32

FindNextFileW SetFileAttributesW WaitForSingleObject GetSystemTimeAsFileTime GetPrivateProfileStringW MoveFileW GetSystemInfo MulDiv RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadLibraryExW GetVersion GetLocalTime IsValidLocale GetCommandLineW GetFileAttributesW GlobalAlloc GlobalFree FlushFileBuffers VirtualQuery IsBadReadPtr GetDiskFreeSpaceExW GetDriveTypeW GetCurrentProcess GetExitCodeProcess GetCurrentThread GetLocaleInfoW InterlockedExchange LoadLibraryExA GetModuleHandleW GetProcAddress GetSystemDirectoryA LoadLibraryA GetLastError SetLastError CreateFileW GetFileSize CloseHandle CreateFileMappingW MapViewOfFile UnmapViewOfFile lstrlenA MultiByteToWideChar WideCharToMultiByte ReadFile SetFilePointer WriteFile HeapAlloc lstrcmpA SystemTimeToFileTime ResetEvent SetEvent FindResourceExW SetFileTime OpenProcess GetProcessTimes ReadConsoleW WriteConsoleW SetStdHandle GetCurrentDirectoryW SetFilePointerEx GetConsoleMode GetConsoleCP GetTimeFormatW GetDateFormatW OutputDebugStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter GetFileType HeapReAlloc GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FindFirstFileW FindClose CreateDirectoryW CompareFileTime SetCurrentDirectoryW VerLanguageNameW GetUserDefaultLangID GetSystemDefaultLangID lstrcmpiW lstrcmpW LoadLibraryW FreeLibrary CompareStringA CompareStringW lstrcatW GetVersionExW CreateEventW QueryPerformanceFrequency GetTempFileNameW CopyFileW GetTickCount GetExitCodeThread CreateThread FindResourceW GlobalUnlock GlobalLock SizeofResource LockResource LoadResource lstrcpyW SetErrorMode GetTempPathW ExpandEnvironmentStringsW FormatMessageW LocalFree GetWindowsDirectoryW GetSystemDirectoryW CreateProcessW InterlockedDecrement InterlockedIncrement Sleep RemoveDirectoryW DeleteFileW lstrlenW lstrcpynW GetModuleFileNameW GetProcessHeap HeapFree GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCurrentThreadId HeapSize GetModuleHandleExW ExitProcess GetStdHandle GetFullPathNameW IsProcessorFeaturePresent IsDebuggerPresent RtlUnwind LCMapStringW DecodePointer EncodePointer

user32

DefWindowProcW PostMessageW DispatchMessageW TranslateMessage GetMessageW RegisterClassW PostQuitMessage CharPrevW SendDlgItemMessageW wvsprintfW LoadImageW CreateDialogParamW MoveWindow SetCursor GetWindow GetDlgItemTextW SetFocus EnableWindow SetForegroundWindow SetActiveWindow SetDlgItemTextW IsDialogMessageW FindWindowW SubtractRect IntersectRect SetRect FillRect GetSysColorBrush GetSysColor GetWindowRect GetDC GetSystemMetrics GetDlgCtrlID CreateDialogIndirectParamW DestroyWindow IsWindow SendMessageW MessageBoxW CharNextW WaitForInputIdle SetWindowLongW GetWindowLongW GetClientRect EndPaint BeginPaint ReleaseDC GetWindowDC SetWindowPos SetWindowTextW GetDlgItem ExitWindowsEx CharUpperW EndDialog DialogBoxIndirectParamW ShowWindow GetDesktopWindow MsgWaitForMultipleObjects PeekMessageW wsprintfW LoadIconW LoadCursorW KillTimer SetTimer CreateWindowExW

gdi32

TranslateCharsetInfo UnrealizeObject CreateHalftonePalette GetDIBColorTable SelectPalette RealizePalette GetSystemPaletteEntries CreatePalette CreateFontW GetObjectW SetTextColor SetBkMode GetDeviceCaps CreateSolidBrush CreateFontIndirectW SetStretchBltMode StretchBlt SelectObject DeleteDC CreateDIBitmap CreateCompatibleDC BitBlt DeleteObject GetStockObject

advapi32

GetTokenInformation RegOpenKeyExW RegOpenKeyW RegOverridePredefKey LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken OpenProcessToken SetEntriesInAclW SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateWellKnownSid RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegSetValueExW RegEnumValueW RegCreateKeyExW RegDeleteValueW RegQueryValueExW

shell32

SHGetMalloc ShellExecuteExW SHGetPathFromIDListW SHGetFolderPathW SHBrowseForFolderW ShellExecuteW CommandLineToArgvW

ole32

CoCreateInstance CoCreateGuid CLSIDFromProgID CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoUninitialize CoInitialize CoInitializeSecurity

oleaut32

UnRegisterTypeLi SysAllocStringLen SysFreeString SysReAllocStringLen SysStringLen SysAllocString SysStringByteLen SysAllocStringByteLen VarBstrCat VarBstrFromDate VariantClear VariantChangeType GetErrorInfo VarUI4FromStr SystemTimeToVariantTime LoadTypeLi RegisterTypeLi

shlwapi

PathFileExistsW

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

Sharing

General

Malware Config

Signatures

File Explorer

SPSSStatistics.exe

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

rpcrt4

generic