9ba1fdde2cc64be99ce8b98fa34cd602949d13c72a7b84fa5da6828cec12c5d9[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
9ba1fdde2cc64be99ce8b98fa34cd602949d13c72a7b84fa5da6828cec12c5d9.exe
Size 2.3MB
Sample250128-q2dpsazqds
SHA256 9ba1fdde2cc64be99ce8b98fa34cd602949d13c72a7b84fa5da6828cec12c5d9
MD5 2b503de14ff4a3e939492e21033aff3b
SHA1 7407ace444d8e72c1503e660a466bc892d6c4827
SHA512 13594f236b6132db50c309c05e98fdc7081ff8ce1b69032da696a8c17942fe80133f865c880a77604c8e0ca3c3befaa280670af6208db3b6ee635ef0506e9b60
SSDEEP 24576:L4l6cPDrFHbq7BWPxs+fZmKz4TNRRu711wFMvVIH06iyYr/cw1:k5BqFWPxs+fZmUwZu7z+QIU6iRX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

9ba1fdde2cc64be99ce8b98fa34cd602949d13c72a7b84fa5da6828cec12c5d9.exe

.exe 2.3MB

9ba1fdde2cc64be99ce8b98fa34cd602949d13c72a7b84fa5da6828cec12c5d9.exe

IMPHASH 52875a954106569abe466d57cf42a002
SHA256 9ba1fdde2cc64be99ce8b98fa34cd602949d13c72a7b84fa5da6828cec12c5d9
MD5 2b503de14ff4a3e939492e21033aff3b
SHA1 7407ace444d8e72c1503e660a466bc892d6c4827
SHA512 13594f236b6132db50c309c05e98fdc7081ff8ce1b69032da696a8c17942fe80133f865c880a77604c8e0ca3c3befaa280670af6208db3b6ee635ef0506e9b60
SSDEEP 24576:L4l6cPDrFHbq7BWPxs+fZmKz4TNRRu711wFMvVIH06iyYr/cw1:k5BqFWPxs+fZmUwZu7z+QIU6iRX
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

8d:fa:49:61:71:9f:cb:dc:0c:7c:ff:72:76:af:71:2a:3d:a6:27:d4:7d:d2:61:f7:92:6b:96:07:05:91:e9:27

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=1147847357217,CN=ООО НЕВА КЕРАМИКС,O=ООО НЕВА КЕРАМИКС,STREET=пр-кт Просвещения\, 69А помещ 46н,L=Санкт-Петербург,ST=Санкт-Петербург,C=RU,1.2.840.113549.1.9.1=#0c14436c6561726e647332303131406d61696c2e7275,1.3.6.1.4.1.311.60.2.1.2=#13105361696e742050657465727362757267,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 21, 2025

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

2f:94:a1:51:6e:8a:18:2b:14:8f:99:4a

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 9, 2024 - Dec 10, 2025

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1431176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

x64_setup.pdb

kernel32

FlsGetValue FlsAlloc FlsSetValue GetStringTypeW SetStdHandle FlsFree CompareStringW LCMapStringW HeapSize GetConsoleOutputCP GetProcAddress LoadLibraryA VirtualAlloc GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW WriteFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId ReadProcessMemory HeapAlloc GetProcessIoCounters GetSystemTimes GetProcessTimes LocalFree OpenProcess HeapFree GetProcessHeap GetComputerNameExW LoadLibraryExA FreeLibrary CloseHandle GetLastError GetSystemInfo WaitForSingleObject VirtualQueryEx CreateFileW FormatMessageW GlobalMemoryStatusEx K32GetPerformanceInfo FreeEnvironmentStringsW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SwitchToThread CreateWaitableTimerExW SetWaitableTimer Sleep QueryPerformanceCounter SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW FlushFileBuffers GetCurrentProcess GetCurrentProcessId CreateMutexA WaitForSingleObjectEx GetModuleHandleA CreateThread GetStdHandle WideCharToMultiByte WriteConsoleW SetHandleInformation TerminateProcess QueryPerformanceFrequency GetSystemTimePreciseAsFileTime MultiByteToWideChar HeapReAlloc lstrlenW ReleaseMutex FindNextFileW FindClose FindFirstFileExW GetConsoleMode GetFileType GetModuleHandleW GetModuleFileNameW SetEnvironmentVariableW ExitProcess SetFilePointerEx

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile RtlGetVersion NtQuerySystemInformation NtQueryInformationProcess RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry RtlNtStatusToDosError

advapi32

SystemFunction036 CopySid GetLengthSid IsValidSid GetTokenInformation OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey

pdh

PdhCollectQueryData PdhRemoveCounter PdhCloseQuery PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhOpenQueryA

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW GetProcessMemoryInfo

shell32

CommandLineToArgvW

oleaut32

SysFreeString GetErrorInfo SysStringLen

ws2_32

WSAGetLastError freeaddrinfo WSACleanup setsockopt select getsockopt WSAStartup closesocket getpeername ioctlsocket recv WSARecv getsockname listen bind WSASend send WSADuplicateSocketW WSASocketW accept getaddrinfo connect

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

9ba1fdde2cc64be99ce8b98fa34cd602949d13c72a7b84fa5da6828cec12c5d9.exe

PE Signature issue

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

advapi32

pdh

powrprof

psapi

shell32

oleaut32

ws2_32

bcrypt

generic