e41f04fbaaf752d7a3279750772a998f6fcfd0ff9067df623c328044a63f3110N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
e41f04fbaaf752d7a3279750772a998f6fcfd0ff9067df623c328044a63f3110N.exe
Size 201KB
Sample241116-1d79lavanq
SHA256 e41f04fbaaf752d7a3279750772a998f6fcfd0ff9067df623c328044a63f3110
MD5 edb88aa2377b9fa9e4e4f330bd5ec800
SHA1 081991e420c1a04deefab2c1cc55fda9d14edf04
SHA512 127d2d6e0b13f3036a4c5684d7831ccecf68f59874250e6cf2ec11548a0dd75ccf9de1e94569542d614a7ed376e8d495dfaa2c10c2cb6acb2d56cf1e272aca39
SSDEEP 6144:lt++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:S+cff22qZhZcKYhc/
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

e41f04fbaaf752d7a3279750772a998f6fcfd0ff9067df623c328044a63f3110N.exe

.exe 201KB

e41f04fbaaf752d7a3279750772a998f6fcfd0ff9067df623c328044a63f3110N.exe

IMPHASH 98aa7065495f35513795744857924eba
SHA256 e41f04fbaaf752d7a3279750772a998f6fcfd0ff9067df623c328044a63f3110
MD5 edb88aa2377b9fa9e4e4f330bd5ec800
SHA1 081991e420c1a04deefab2c1cc55fda9d14edf04
SHA512 127d2d6e0b13f3036a4c5684d7831ccecf68f59874250e6cf2ec11548a0dd75ccf9de1e94569542d614a7ed376e8d495dfaa2c10c2cb6acb2d56cf1e272aca39
SSDEEP 6144:lt++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:S+cff22qZhZcKYhc/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Trend Micro\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RD,O=Trend Micro\, Inc.,L=Taipei,ST=Taiwan,C=TW

Serial Number

22:5c:8b:52:64:05:84:16:3e:c1:83:50:17:de:d7:81

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 30, 2007 - Feb 15, 2008

Minor OS version

Major OS version

Entry point

7498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenFile IsBadStringPtrW CreateMailslotW GetEnvironmentVariableA GetWindowsDirectoryW SetUnhandledExceptionFilter lstrcpynW GetTempPathW GetLogicalDriveStringsA ConnectNamedPipe lstrcpyn GetProcAddress GetNumberFormatA GetOEMCP OpenMutexW FileTimeToSystemTime CreateEventW GetModuleHandleA CreateSemaphoreW GetLongPathNameW lstrcpy SetCalendarInfoA GetCommandLineW DosDateTimeToFileTime QueryPerformanceFrequency FileTimeToLocalFileTime

user32

IsDlgButtonChecked GetWindowTextA GetWindowLongA GetAsyncKeyState GetActiveWindow MonitorFromRect GetMenuStringA BringWindowToTop CharUpperA CheckMenuItem GetActiveWindow GetDlgItemTextW GetParent UpdateLayeredWindow GetDCEx GetMessageW GetCursorPos LoadMenuA

gdi32

SetArcDirection ColorMatchToTarget ExtFloodFill LPtoDP SetStretchBltMode SetSystemPaletteUse SetMiterLimit ColorCorrectPalette CopyEnhMetaFileW SetWindowExtEx ExtTextOutW FillRgn IntersectClipRect CreateCompatibleDC GetTextColor SetViewportOrgEx RestoreDC PolylineTo

advapi32

RegReplaceKeyA RegRestoreKeyA RegDeleteValueA RegEnumValueW RegCreateKeyExA

shlwapi

UrlCombineA

comctl32

ImageList_SetFlags

wininet

SetUrlCacheEntryInfoA

winspool.drv

ConvertUnicodeDevModeToAnsiDevmode EnumJobsA AdvancedDocumentPropertiesW SplDriverUnloadComplete ExtDeviceMode QuerySpoolMode SetDefaultPrinterA ConfigurePortA GetPrinterDataExW DeviceCapabilitiesA

wsock32

ntohs dn_expand rexec getservbyport GetNameByTypeA

Name

.text

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.WjTd

Size

1KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Grrl

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Lx

Size

1KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eB

Size

1KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e41f04fbaaf752d7a3279750772a998f6fcfd0ff9067df623c328044a63f3110N.exe

PE Signature issue

kernel32

user32

gdi32

advapi32

shlwapi

comctl32

wininet

winspool.drv

wsock32

generic