912d3b25832df70bf979831c1ae04fe10dd8ef42666f38cdc0641bf2e9e1ba6e[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
912d3b25832df70bf979831c1ae04fe10dd8ef42666f38cdc0641bf2e9e1ba6e.exe
Size 811KB
Sample260416-rtjrhaa14m
SHA256 912d3b25832df70bf979831c1ae04fe10dd8ef42666f38cdc0641bf2e9e1ba6e
MD5 403a31e403711a54e61fc1f25942c9b3
SHA1 01e97e3b61bd9c29e26e4e1c52ac9fb9ad6675d5
SHA512 499c5b5fcc6a53b42e806e86a1537c6cfc4d44d8e660dcfc7767ab630b64f694a7095dbffaa5b542a5678bfc147de5cb09f8d0d318d34309dfc3b296245634dd
SSDEEP 12288:+KBZ4mgsmsgRijWpAhODvjSJDnCRdkuVZ68pwsHdNyGtxlBjvrEH72:+K0mnmsgY4JfSJDqdjVZRNyG/rEH72
TLSH
T14805CF2279D1C0B6D1333130195CD758A2FAF4354A3A49ABB7CC636D2F785C28B35BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
912d3b25832df70bf979831c1ae04fe10dd8ef42666f38cdc0641bf2e9e1ba6e.exe

File Explorer

912d3b25832df70bf979831c1ae04fe10dd8ef42666f38cdc0641bf2e9e1ba6e.exe

.exe 811KB

912d3b25832df70bf979831c1ae04fe10dd8ef42666f38cdc0641bf2e9e1ba6e.exe

IMPHASH f55eab757908a44d768fab3919a79097
SHA256 912d3b25832df70bf979831c1ae04fe10dd8ef42666f38cdc0641bf2e9e1ba6e
MD5 403a31e403711a54e61fc1f25942c9b3
SHA1 01e97e3b61bd9c29e26e4e1c52ac9fb9ad6675d5
SHA512 499c5b5fcc6a53b42e806e86a1537c6cfc4d44d8e660dcfc7767ab630b64f694a7095dbffaa5b542a5678bfc147de5cb09f8d0d318d34309dfc3b296245634dd
SSDEEP 12288:+KBZ4mgsmsgRijWpAhODvjSJDnCRdkuVZ68pwsHdNyGtxlBjvrEH72:+K0mnmsgY4JfSJDqdjVZRNyG/rEH72
TLSH
T14805CF2279D1C0B6D1333130195CD758A2FAF4354A3A49ABB7CC636D2F785C28B35BA6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

20:b9:bd:60:ed:7c:66:d2:f4:7e:54:7b:22:70:dd:58:c8:66:b4:67:81:24:55:e2:49:a6:b5:59:40:af:a5:fb

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Chains

Dec 18, 2025

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Serial Number

0a:a1:8f:63:f9:6f:11:77:1c:bb:0b:43:e4:d6:90:b8

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 10, 2025 - Jan 11, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

262102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CLSIDFromString StringFromGUID2 IIDFromString OleRun CoUninitialize CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance

shell32

Shell_NotifyIconA ShellExecuteA SHGetFolderPathW

wininet

InternetTimeToSystemTime InternetCrackUrlA InternetTimeFromSystemTime InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetErrorDlg

user32

GetDesktopWindow LoadImageA SetWindowLongA MessageBoxW GetWindowLongA SetForegroundWindow wsprintfA CharNextA LoadStringA GetMessageA GetMessageW TranslateMessage DispatchMessageA DispatchMessageW PeekMessageA PostMessageA DefWindowProcA PostQuitMessage RegisterClassA CreateWindowExA DestroyWindow ShowWindow MsgWaitForMultipleObjectsEx IsWindowUnicode GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu GetCursorPos

version

VerQueryValueW GetFileVersionInfoA GetFileVersionInfoSizeA

kernel32

GetFileInformationByHandle GetDriveTypeW VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetConsoleOutputCP GetSystemTimeAsFileTime GetModuleHandleW GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringEx EncodePointer InitializeCriticalSectionEx GetStringTypeW GetConsoleMode GetCommandLineW GetFileType GetStdHandle GetModuleFileNameW InitializeSListHead WriteConsoleW GetCommandLineA DecodePointer CloseHandle RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection WaitForSingleObject CreateMutexA CreateEventA WaitForMultipleObjects FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryExA LoadResource SizeofResource lstrcmpA lstrcmpiA lstrcatA lstrlenA FindResourceA SetDllDirectoryA SystemTimeToTzSpecificLocalTime MultiByteToWideChar WideCharToMultiByte IsDBCSLeadByte SetEvent ResetEvent GetFullPathNameW lstrcpyA lstrcpynA CreateFileA WriteFile OpenEventA Sleep DeleteFileA GetTempPathA GetCurrentProcess GetVersionExA LocalFree ReadFile FileTimeToSystemTime GetCurrentProcessId GetCurrentThreadId GetLocalTime FormatMessageW GetEnvironmentVariableA FindClose ExitProcess TerminateProcess GetSystemDirectoryA LockResource LoadLibraryA LocalAlloc FormatMessageA SetLastError GetNativeSystemInfo GetModuleHandleExW SetHandleInformation CreatePipe PeekNamedPipe GetExitCodeProcess CreateProcessA SetEndOfFile SetFilePointerEx GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage GetFileAttributesA GetModuleHandleExA LoadLibraryW CreateDirectoryW LoadLibraryExW OpenMutexA QueryPerformanceCounter CreateFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection IsDebuggerPresent OutputDebugStringW SetStdHandle HeapFree HeapAlloc HeapSize HeapReAlloc GetTimeZoneInformation CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetFileSizeEx ReadConsoleW GetCurrentDirectoryW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap CreateThread

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyA CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegQueryValueExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExA RegQueryInfoKeyW RegOpenKeyExA RegNotifyChangeKeyValue RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegCloseKey

oleaut32

GetErrorInfo SysFreeString VarUI4FromStr SysAllocString SysStringByteLen SysAllocStringByteLen VariantInit VariantClear VariantChangeType

shlwapi

ord12

gdi32

GetStockObject

crypt32

CryptUnprotectData CryptProtectData CryptStringToBinaryA CryptBinaryToStringA

msi

ord117 ord189 ord168 ord31 ord159 ord160 ord91 ord115 ord44 ord204 ord137 ord141 ord8 ord67

Sharing

General

Malware Config

Signatures

File Explorer

912d3b25832df70bf979831c1ae04fe10dd8ef42666f38cdc0641bf2e9e1ba6e.exe

PE Signature issue

ole32

shell32

wininet

user32

version

kernel32

advapi32

oleaut32

shlwapi

gdi32

crypt32

msi

generic