fc7b438fb7491870db642b25f020733647f6d98b34c53616d84289e5af4975a1N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
fc7b438fb7491870db642b25f020733647f6d98b34c53616d84289e5af4975a1N.exe
Size 1.3MB
Sample250108-e14n2atpa1
SHA256 fc7b438fb7491870db642b25f020733647f6d98b34c53616d84289e5af4975a1
MD5 7baf96236b2fc1e8dbae693e9a5c5fd0
SHA1 0083a2904603facca6f4d18286fc06384356068e
SHA512 d9a2dc240fb51522218f293ea1aa0a79febb377a1932d4d0c0bcfdc621e3ba734116a13093c7ead8fe474d7d8f8788645b1d78999e52d7d3adc79265532627dc
SSDEEP 24576:MAhOqqEQTGkIefvBOqV/gBB5iyfuYTkMeYEY2EaQtYDz+jI9Cv310OA3TX1UQ:StEQTGkNnwggBBxuYx7E9TFLe2OA3TXl
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

fc7b438fb7491870db642b25f020733647f6d98b34c53616d84289e5af4975a1N.exe

.exe 1.3MB

fc7b438fb7491870db642b25f020733647f6d98b34c53616d84289e5af4975a1N.exe

IMPHASH b4f7a55a3326c1a83f96c5e1982dd409
SHA256 fc7b438fb7491870db642b25f020733647f6d98b34c53616d84289e5af4975a1
MD5 7baf96236b2fc1e8dbae693e9a5c5fd0
SHA1 0083a2904603facca6f4d18286fc06384356068e
SHA512 d9a2dc240fb51522218f293ea1aa0a79febb377a1932d4d0c0bcfdc621e3ba734116a13093c7ead8fe474d7d8f8788645b1d78999e52d7d3adc79265532627dc
SSDEEP 24576:MAhOqqEQTGkIefvBOqV/gBB5iyfuYTkMeYEY2EaQtYDz+jI9Cv310OA3TX1UQ:StEQTGkNnwggBBxuYx7E9TFLe2OA3TXl
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

51:6c:be:11:7e:1e:b7:b4:79:75:d4:48:f8:30:66:4d:89:e2:68:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Forty Seven Tech Software LLC,O=Forty Seven Tech Software LLC,L=Beaverton,ST=Oregon,C=US

Chains

Apr 10, 2014

Subject

CN=Forty Seven Tech Software LLC,O=Forty Seven Tech Software LLC,L=Beaverton,ST=Oregon,C=US

Serial Number

27:c1:78:fa:d3:3d:6a

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 18, 2013 - Dec 18, 2016

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

03:01

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 16, 2006 - Nov 16, 2026

Subject

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Serial Number

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Timespan

Jun 29, 2004 - Jun 29, 2034

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

Major OS version

Entry point

63497

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetTickCount CloseHandle WriteFile GetSystemTime CreateFileW GetTempFileNameW GetTempPathW GetDriveTypeW GetModuleFileNameW OpenEventA CreateMutexA GetVersion OpenMutexA WaitForSingleObject GetProcessVersion GetCurrentProcessId GetModuleHandleA GetCurrentThreadId FlushInstructionCache OpenMutexW InterlockedExchange VirtualProtect VirtualAlloc HeapAlloc VirtualFree HeapFree FreeLibrary GetModuleFileNameA GetCommandLineW WriteConsoleW SetFilePointer ReadFile FlushFileBuffers GetConsoleMode GetConsoleCP InitializeCriticalSection IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetLastError GetProcessHeap IsProcessorFeaturePresent FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetModuleHandleW GetCurrentProcess GetProcAddress GetUserDefaultLCID GetStringTypeW MultiByteToWideChar WideCharToMultiByte RtlUnwind EncodePointer DecodePointer RaiseException HeapReAlloc HeapSetInformation GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW HeapCreate HeapDestroy GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryW GetLocaleInfoW SetStdHandle

user32

GetDC GetSysColor GetCursor GetSystemMetrics GetSysColorBrush GetDesktopWindow ReleaseDC GetForegroundWindow GetFocus

gdi32

CreateCompatibleBitmap SelectObject CreatePen Rectangle Ellipse DeleteObject DeleteDC MoveToEx GetStockObject CreateCompatibleDC

ole32

CoCreateInstance

shlwapi

PathStripToRootW

Sharing

General

Malware Config

Signatures

File Explorer

fc7b438fb7491870db642b25f020733647f6d98b34c53616d84289e5af4975a1N.exe

PE Signature issue

kernel32

user32

gdi32

ole32

shlwapi

generic