AAM UpdatesEqn.rar
- SHA256 c23c9b0248323334f8706fa7890d8b8822fd3dba2aeff10aafd25033de646fa2
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
AAM UpdatesEqn/AAM Updates.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
AAM UpdatesEqn/AAM Updates.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
AAM UpdatesEqn/hex.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
AAM UpdatesEqn/hex.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target AAM UpdatesEqn.rar
- Size 191KB
- Sample260324-ttbf8sgv9j
- SHA256 c23c9b0248323334f8706fa7890d8b8822fd3dba2aeff10aafd25033de646fa2
- MD5 6f58b5c4b0545eb5fbbcf78f547918d5
- SHA1 365828e2a38a9872977bc5c50d223b39901bfe6f
- SHA512 2a0e7ecbabc5d5aa2ae4263455549be23dd9f9d26926edcb8d65784dbe358dbea45d1e0f87b571d2ce344b5e0db0d86641557dc0b607fea23b7417f20da42dad
- SSDEEP 3072:T9h1/y8LCyGNdpq7NhcL1821ttbKLlPekmfhhSjprUJfNiR/+O6z3wJsWqoQmUVX:CNKNhCrtRKLNlgXyrmiR/+V0iV1fitW7
- TLSH T16314131D4E362F52B8F5762205A92D7ACC41BC122772FD84787946CE8A37B347A38F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/AAM UpdatesEqn/AAM Updates.exe - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AAM UpdatesEqn/hex.dll
File Explorer
-
AAM UpdatesEqn.rar.rar 191KB
-
AAM UpdatesEqn/AAM Updates.exe.exe 185KB
-
AAM UpdatesEqn/adobeupdate.dat157KB
-
AAM UpdatesEqn/hex.dll.dll 20KB
AAM UpdatesEqn/AAM Updates.exe
- IMPHASH 87b66fbc31fd804dcc1ea09f9a947825
- SHA256 0459e62c5444896d5be404c559c834ba455fa5cae1689c70fc8c61bc15468681
- MD5 c70d8dce46b4551133ecc58aed84bf0e
- SHA1 00626346632fdfb2a1d5831793e92a3601ec4d9f
- SHA512 12117c7fa9acef9a2a8d7da53a2a435dd45298bb98439025e2c4a3bb0c8096675d5541c0b2eb7246164e2a19cd879f98c0a007b0f73691d59036822be01a6f92
- SSDEEP 3072:Ab6eqM+UdkAkko1tnC0Ag0Fuj8zDTBfhXxFGS7EArdUYVS77ylmrYM:o6VM+Uu5Lm0AO4DTB9GSYAfUUmrYM
- TLSH T10A048D04B6E28573D471093144B9BEA44639F9392F12CF7BBF98361B2D653C09533ABA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
81:9d:d4:a1:ee:ff:cf:05:ec:e1:63:d1:40:74:eb:70:d4:4e:8f:4b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 13, 2016
SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 4, 2014 - Mar 3, 2024
Subject
SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Issuer
CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 6, 2015 - Oct 28, 2017
Minor OS version
1
Major OS version
5
Entry point
8512
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\builds\ACC\GM\source\dev\target\win32\Release\HEX\Adobe CEF Helper.pdb
kernel32
FindNextFileW
WriteFile
GetModuleFileNameW
FindClose
CreateFileW
GetLastError
CloseHandle
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
RaiseException
DecodePointer
DeleteCriticalSection
WideCharToMultiByte
HeapFree
GetCurrentProcess
TerminateProcess
HeapSize
CreateEventW
HeapReAlloc
HeapAlloc
GetProcessHeap
GetModuleHandleW
LCMapStringW
WriteConsoleW
GetConsoleCP
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetDllDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
TlsSetValue
GetCommandLineW
TlsGetValue
TlsAlloc
SetLastError
EncodePointer
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetConsoleMode
SetFilePointerEx
GetFileType
GetACP
GetModuleHandleExW
ExitProcess
GetStdHandle
RtlUnwind
LoadLibraryExW
OutputDebugStringW
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetStringTypeW
TlsFree
advapi32
SystemFunction036
shlwapi
PathAppendW
PathRemoveFileSpecW
Name
.text
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=241, version=40116,
count=153, id=243, version=40116,
count=29, id=242, version=40116,
count=2, id=261, version=23013,
count=22, id=259, version=23907,
count=59, id=261, version=23907,
count=34, id=260, version=23907,
count=12, id=203, version=65501,
count=193, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=24, id=265, version=23918,
count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,
AAM UpdatesEqn/adobeupdate.dat
- SHA256 e3fafa3b5c5eb9edd1002a848312bc182460f2ff9c0df732e6b6acf6e00fc5ea
- MD5 58bdf783da4c627d2f13612a09a9b5a8
- SHA1 c07aadf9d55a2aba2a32be62e68bfdf00a095810
- SHA512 f8db2f393fe7bd6067e2eda72575af147e77daa84cd7957638dea3d40b9d2ea76139873f1d114dc6864e0ae38261ecbcceaaa9329839d581a422212ead751b66
- SSDEEP 3072:vmepDDtNEvyiYKM0i891KkvHuEvGkmXkwkjFOOnn2V:vXpfQvy7KM0mEvGbUlU
- TLSH T12FF39E5D4848E2DBDA4F630A5CD4D76200CF8CE1CCD67ACBC4A3AD6495BDBD9422CA2D
- MD5 SHA1 SHA512 SSDEEP TLSH
AAM UpdatesEqn/hex.dll
- IMPHASH cb102cae363c92ced4df9814ae530320
- SHA256 f331eb3d7f6789e48f2e3bfb1a87595561722f45aaec150df537488587024096
- MD5 eafaba7898e149895b36ee488e3d579c
- SHA1 64bfd0f7ecf21c8d961b6176863ecd5015bf4b64
- SHA512 46413b264438622d717a3dc28b0620940f05a8322f8d2a00f7521aef978bb8e78d6e8c885339a3a28be52273f37c0cab11711143c8e687c0c2472ac8f2f3c355
- SSDEEP 48:aDliH6TlonoLk9mBzGSwX56BCP/szcYijZc64u1MDLpXpUM6Et2MfQGEWzfD:ulI6xuowkzMX8B6/ODLpZUqVr7
- TLSH T1B692847BD7D13A19C03C2BB5C98B3E53585B9C3923F8001AD253BA1619552E2EE26D83
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6687
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
malloc
_initterm
free
exit
_adjust_fdiv
strlen
kernel32
GetProcAddress
LocalAlloc
LocalFree
GetModuleHandleA
CEFProcessForkHandlerEx
Name
.text
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
406B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
130B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=19, version=8034,
count=4, id=10, version=8047,
count=3, id=4, version=8047,
count=12, id=1, productName=Unmarked objects,
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,