_2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8[.]exe

General

Target
_2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8.exe
Size 134KB
Sample250910-v8chhsstfs
SHA256 2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8
MD5 a5c70086b3bc4fe64f4e7a0aa452e620
SHA1 2ab44cf5338ef5ed118365b4e8452b906c0dab4b
SHA512 0280164c258afb169b59863c65266626ff1b2cc5a736702a49c2229dfd4d9f5213f6346cd4ec5316a19d5b0b55102c393ce255b999b061c04cc8574495e8e7e7
SSDEEP 3072:oZkmuVEvfzS9ljrZU/bH0ffOkObkPnSh6/5b:OkmQIW9ljrqbH0cwhb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was Codesigned using an insecure algorithm.

resource
_2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8.exe

File Explorer

_2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8.exe

.exe 134KB

_2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8.exe

IMPHASH 2ce62b0c0226079a88a01c701dbee7b9
SHA256 2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8
MD5 a5c70086b3bc4fe64f4e7a0aa452e620
SHA1 2ab44cf5338ef5ed118365b4e8452b906c0dab4b
SHA512 0280164c258afb169b59863c65266626ff1b2cc5a736702a49c2229dfd4d9f5213f6346cd4ec5316a19d5b0b55102c393ce255b999b061c04cc8574495e8e7e7
SSDEEP 3072:oZkmuVEvfzS9ljrZU/bH0ffOkObkPnSh6/5b:OkmQIW9ljrqbH0cwhb
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was Codesigned using an insecure algorithm.

Digest

ff:02:32:59:51:de:72:b9:97:bf:3c:85:35:d3:ad:12:29:08:b0:9a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=8455830000,CN=Rad-Grad D.O.O.,O=Rad-Grad D.O.O.,L=CELJE,C=SI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025349

Chains

Oct 21, 2020

SERIALNUMBER=8455830000,CN=Rad-Grad D.O.O.,O=Rad-Grad D.O.O.,L=CELJE,C=SI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025349

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=8455830000,CN=Rad-Grad D.O.O.,O=Rad-Grad D.O.O.,L=CELJE,C=SI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025349

Serial Number

07:b7:4c:70:c4:aa:09:26:48:b7:f0:d1:a8:a3:a2:8f

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 21, 2020 - Oct 17, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

1

Major OS version

5

Entry point

44243

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess GetCurrentThread SetLastError Sleep CloseHandle LoadLibraryA WinExec GetProcAddress CreateFileW DecodePointer WriteConsoleW SetFilePointerEx QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess RtlUnwind GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetACP HeapFree HeapAlloc GetStringTypeW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode RaiseException

advapi32

CloseServiceHandle

ws2_32

htons htonl bind inet_addr

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

_2ec5256a7edb90b1c05c92f79e8a48c205b29e1ac910a535aa83c30b8dbbeff8.exe

kernel32

advapi32

ws2_32

generic