47d61592b398b0979674573e558d05d366d1f3310826bafe8d31ad0934a29fc2

Sharing

Copy URL Twitter E-mail

General

Target
47d61592b398b0979674573e558d05d366d1f3310826bafe8d31ad0934a29fc2
Size 140KB
Sample241120-2grlpavhqq
SHA256 47d61592b398b0979674573e558d05d366d1f3310826bafe8d31ad0934a29fc2
MD5 c0ec0df34afe01d6899b77c9b57ccdaa
SHA1 0660a0341a5ca6a03a792776cf0a8b9facdcf4bf
SHA512 46e13c3486e11a99704c9bdea401d80ff7ec70fbef51442aa40dcf41ae93b0932bdad3be5eaac3d9859534b668c6273ce04d5e7406792a43adf55ef6c0a6f8f1
SSDEEP 3072:KPkuTHdm1FOM+GZT2lQBV+UdE+rECWp7hK87s8E:tu7uFOM+2BV+UdvrEFp7hKbV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

47d61592b398b0979674573e558d05d366d1f3310826bafe8d31ad0934a29fc2

.exe 140KB

47d61592b398b0979674573e558d05d366d1f3310826bafe8d31ad0934a29fc2

IMPHASH 0513dfa284a52b83da1d3297ed8702dd
SHA256 47d61592b398b0979674573e558d05d366d1f3310826bafe8d31ad0934a29fc2
MD5 c0ec0df34afe01d6899b77c9b57ccdaa
SHA1 0660a0341a5ca6a03a792776cf0a8b9facdcf4bf
SHA512 46e13c3486e11a99704c9bdea401d80ff7ec70fbef51442aa40dcf41ae93b0932bdad3be5eaac3d9859534b668c6273ce04d5e7406792a43adf55ef6c0a6f8f1
SSDEEP 3072:KPkuTHdm1FOM+GZT2lQBV+UdE+rECWp7hK87s8E:tu7uFOM+2BV+UdvrEFp7hKbV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

45:39:70:45:e7:6f:7e:af:7b:47:59:90:09:ca:a1:83:a0:7e:2b:03

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Adobe Systems\, Incorporated,OU=Acrobat XI+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US

Chains

Dec 3, 2012

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Adobe Systems\, Incorporated,OU=Acrobat XI+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US

Serial Number

09:ac:06:4d:05:28:17:ff:4d:79:42:ea:69:76:c3:d8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 20, 2012 - Sep 20, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

31066

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\CB\ARM_Sustaining\BuildResults\bin\Win32\Release\armsvc.pdb

kernel32

UnmapViewOfFile FormatMessageW GetLocalTime CreateFileMappingW OpenFileMappingW GetVolumeInformationW GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess MapViewOfFile LocalFree CloseHandle GetCurrentThreadId DeleteCriticalSection lstrcmpiW LocalAlloc FindClose GetProcAddress GetLastError RaiseException lstrlenW MultiByteToWideChar lstrcmpW GetModuleFileNameW GetFileAttributesW SizeofResource InitializeCriticalSection GetModuleHandleW InterlockedDecrement InterlockedIncrement LoadLibraryExW TerminateProcess GetStartupInfoW GetSystemTimeAsFileTime Sleep InterlockedExchange GetCurrentProcessId lstrcmpA FindFirstFileW FindResourceW FreeLibrary LoadResource InterlockedCompareExchange

user32

DispatchMessageW PostThreadMessageW LoadStringW CharNextW GetMessageW

advapi32

OpenSCManagerW RegisterEventSourceW CloseServiceHandle DeleteService StartServiceCtrlDispatcherW OpenServiceW RegCreateKeyExW RegQueryValueExW RegQueryInfoKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegSetValueExW RegCloseKey RegEnumKeyExW ControlService ReportEventW RegisterServiceCtrlHandlerW RegOpenKeyExW SetServiceStatus RegDeleteValueW RegDeleteKeyW DeregisterEventSource CreateServiceW

shell32

ShellExecuteExW SHGetFolderPathW

ole32

CoRevokeClassObject CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoUninitialize CoTaskMemRealloc CoRegisterClassObject StringFromGUID2 CoInitialize

oleaut32

SysFreeString RegisterTypeLi VarUI4FromStr UnRegisterTypeLi LoadTypeLi SysStringLen SysAllocString

crypt32

CryptDecodeObject CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptMsgClose

wintrust

WinVerifyTrust

msvcr90

__setusermatherr _configthreadlocale _initterm_e _initterm _wcmdln exit _XcptFilter _except_handler4_common _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ _invoke_watson _controlfp_s _CxxThrowException __CxxFrameHandler3 _adjust_fdiv __set_app_type __p__fmode ??3@YAXPAX@Z wcsncpy_s ??_U@YAPAXI@Z memcmp free malloc vswprintf_s wcslen wcsstr _recalloc memset ??_V@YAXPAX@Z memcpy_s _putws wcscat_s wcscpy_s swprintf_s _itow_s _time64 ?terminate@@YAXXZ _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer _amsg_exit __wgetmainargs _cexit _exit __p__commode

Sharing

General

Malware Config

Signatures

File Explorer

47d61592b398b0979674573e558d05d366d1f3310826bafe8d31ad0934a29fc2

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

wintrust

msvcr90

generic