SecuriteInfo[.]com[.]FileRepMalware[.]76928771[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.FileRepMalware.76928771.exe
Size 11.6MB
Sample260304-behb5abs71
SHA256 231ebbfd680cee62d1c4a2ea1b44686c311bfc94a1fe57af3a41ef4b08797c95
MD5 3ac0c1b445c10d5af928c0c3ed8ea409
SHA1 1c0f9e610b7a043928956dc36cf513ff7a02168f
SHA512 ba5cd2909f5d7ef19bc66cac004d517d48c3e186fc79bcab1fcd419a84d6a16f07c89ee6a3804c600cdfa3efdf800e54ea76ad627afe5b49b6a9a4ba455c5924
SSDEEP 196608:iilaNrKUYAu40C5u7alCFr7nQInJ45/9iD54+V11bFv4zws:iilaN8J9s
TLSH
T129C6A22CD905A366E2B2C170859D4A17F161892AF63D5F8B31C75F193242AC33EA1FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
SecuriteInfo.com.FileRepMalware.76928771.exe

File Explorer

SecuriteInfo.com.FileRepMalware.76928771.exe

.exe 11.6MB

SecuriteInfo.com.FileRepMalware.76928771.exe

IMPHASH 16d3dcda6fe34199f57bb11fc5930901
SHA256 231ebbfd680cee62d1c4a2ea1b44686c311bfc94a1fe57af3a41ef4b08797c95
MD5 3ac0c1b445c10d5af928c0c3ed8ea409
SHA1 1c0f9e610b7a043928956dc36cf513ff7a02168f
SHA512 ba5cd2909f5d7ef19bc66cac004d517d48c3e186fc79bcab1fcd419a84d6a16f07c89ee6a3804c600cdfa3efdf800e54ea76ad627afe5b49b6a9a4ba455c5924
SSDEEP 196608:iilaNrKUYAu40C5u7alCFr7nQInJ45/9iD54+V11bFv4zws:iilaN8J9s
TLSH
T129C6A22CD905A366E2B2C170859D4A17F161892AF63D5F8B31C75F193242AC33EA1FDE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6d:64:00:0a:a1:d3:11:16:81:59:f9:68:9f:f4:0c:f4:65:ad:11:d1:6b:6a:58:19:0b:03:c7:c9:92:68:7e:d5

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=1636032,CN=Intel Corporation,O=Intel Corporation,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Dec 29, 2025

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

d7:e0:90:13:b0:ef:6d:db:fb:ae:33:e5:4a:9a:fa:dd

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 21, 2025 - Aug 21, 2026

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

2742646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\BuildAgent\temp\buildTmp\JetBrains\CompileNative.Bin\Zafokuv\windows-x86\JetBrains.Etw.Collector.pdb

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom

crypt32

CertGetNameStringW

ntdll

NtQueryInformationProcess VerSetConditionMask NtReadVirtualMemory ZwSetInformationFile RtlUnwind

secur32

GetUserNameExW

shlwapi

SHDeleteKeyW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wintrust

WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WTHelperProvDataFromStateData

kernel32

FormatMessageA GetLastError Sleep UnmapViewOfFile FreeLibrary GetModuleHandleW LoadLibraryW LoadLibraryExW VerifyVersionInfoW CloseHandle GetLogicalDrives QueryDosDeviceW GetSystemInfo GetNativeSystemInfo GetProcAddress GetCurrentProcess OpenProcess GetCurrentProcessId QueryPerformanceCounter DuplicateHandle CreateFileMappingW GetModuleHandleA LocalFree SwitchToThread MapViewOfFileEx GetFileSizeEx SetEndOfFile SetFilePointer FormatMessageW WideCharToMultiByte TlsAlloc CreateProcessW TlsFree K32GetModuleFileNameExW QueryFullProcessImageNameW K32GetProcessImageFileNameW OpenThread SetLastError WaitForSingleObject HeapSize DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects TerminateThread QueueUserAPC HeapAlloc SleepEx PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus TlsGetValue TlsSetValue CreateFileW GetExitCodeProcess GetModuleFileNameW FlushFileBuffers GetCurrentThreadId WriteFile ReadFile IsWow64Process GetCommandLineW CreateWaitableTimerW MultiByteToWideChar CancelIoEx GetOverlappedResult WaitNamedPipeW DisconnectNamedPipe SetErrorMode GetSystemTimeAsFileTime GetComputerNameExW GetModuleHandleExW SetEnvironmentVariableA GetEnvironmentStrings FreeEnvironmentStringsA GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetEvent HeapReAlloc GetProcessHeap WriteConsoleW CreateEventW VirtualQuery HeapFree GetCommandLineA GetStdHandle ExitProcess GetFileType GetConsoleOutputCP SetStdHandle FreeLibraryAndExitThread ExitThread CreateThread InterlockedPushEntrySList TerminateProcess GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent ResetEvent InitializeSListHead GetCPInfo CompareStringEx LCMapStringEx IsValidCodePage ReadConsoleW GetConsoleMode GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle SetFilePointerEx GetTempPathW AreFileApisANSI DeviceIoControl CopyFileW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW QueryPerformanceFrequency InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork IsProcessorFeaturePresent RaiseException GetStringTypeW InitOnceBeginInitialize InitOnceComplete WaitForSingleObjectEx EncodePointer DecodePointer

advapi32

QueryAllTracesW StartTraceW ControlTraceW LookupAccountSidW GetTokenInformation RegDeleteKeyExW ProcessTrace OpenTraceW CloseTrace RegQueryValueExW RegCreateKeyExW RegDeleteValueW RegSetValueExW RegCloseKey RegOpenKeyExW SetSecurityDescriptorDacl InitializeSecurityDescriptor AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

ws2_32

WSAAddressToStringW WSASocketW WSARecv listen select connect WSAIoctl getaddrinfo WSASend ioctlsocket closesocket WSAGetLastError WSACleanup WSAStartup getsockopt WSAStringToAddressW freeaddrinfo ntohl ntohs htonl htons accept WSASetLastError getsockname shutdown bind __WSAFDIsSet setsockopt

mswsock

GetAcceptExSockaddrs AcceptEx

Sharing

General

Malware Config

Signatures

File Explorer

SecuriteInfo.com.FileRepMalware.76928771.exe

PE Signature issue

bcrypt

crypt32

ntdll

secur32

shlwapi

version

wintrust

kernel32

advapi32

ws2_32

mswsock

generic