2dc72db28603d8d113b27c665ed7fcd4a023d201046c8fe87178d697c7264655

Sharing

Copy URL Twitter E-mail

General

Target
2dc72db28603d8d113b27c665ed7fcd4a023d201046c8fe87178d697c7264655
Size 1.1MB
Sample260418-ejba6af18y
SHA256 2dc72db28603d8d113b27c665ed7fcd4a023d201046c8fe87178d697c7264655
MD5 3c7172d5db763c4d0637253e2877f348
SHA1 ad18af0bd61c57b0fc1b514131d8a0de74b29796
SHA512 59adf3c0ed4f1a58e18ea77d204e54efe3f0b6ed2d25337e2920407626a5c5e66ff8ab8bdf9a890bb494e399d3d10dd1a6319e0ef27eea94017bcf81d3c9d798
SSDEEP 24576:n+uME7Er0EZHahWP4CONw0DtjnkOrwn83ijQLjhWuPZ38wTt+qNkNGNgrEH7k:jLErTcWPhONFDtjn/r2+LjhWuPR8wT0L
TLSH
T19445AF0375D18075E5B30630A9BDBB25AEFDBA350A32C64E13C82A5D6F71981D73A353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2dc72db28603d8d113b27c665ed7fcd4a023d201046c8fe87178d697c7264655

File Explorer

2dc72db28603d8d113b27c665ed7fcd4a023d201046c8fe87178d697c7264655

.dll 1.1MB

2dc72db28603d8d113b27c665ed7fcd4a023d201046c8fe87178d697c7264655

IMPHASH 566608fc4e739807cf78f375182a051b
SHA256 2dc72db28603d8d113b27c665ed7fcd4a023d201046c8fe87178d697c7264655
MD5 3c7172d5db763c4d0637253e2877f348
SHA1 ad18af0bd61c57b0fc1b514131d8a0de74b29796
SHA512 59adf3c0ed4f1a58e18ea77d204e54efe3f0b6ed2d25337e2920407626a5c5e66ff8ab8bdf9a890bb494e399d3d10dd1a6319e0ef27eea94017bcf81d3c9d798
SSDEEP 24576:n+uME7Er0EZHahWP4CONw0DtjnkOrwn83ijQLjhWuPZ38wTt+qNkNGNgrEH7k:jLErTcWPhONFDtjn/r2+LjhWuPR8wT0L
TLSH
T19445AF0375D18075E5B30630A9BDBB25AEFDBA350A32C64E13C82A5D6F71981D73A353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

49:65:72:3b:e6:5a:09:63:75:b0:f1:1d:1f:15:6f:d3:65:e9:2a:b3:e7:15:bd:7a:b3:1e:d2:a9:8d:2e:e4:33

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US

Chains

Mar 19, 2026

CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

0e:98:2f:dd:f0:6e:93:e9:11:06:5d:03:7d:4d:d4:82

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 28, 2024 - Aug 6, 2027

Minor OS version

Major OS version

Entry point

630521

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

goopdate_unsigned.pdb

kernel32

TransactNamedPipe SetNamedPipeHandleState VirtualQueryEx WaitNamedPipeW InitOnceComplete InitOnceBeginInitialize CreateDirectoryW SizeofResource SetLastError lstrlenW WriteFile GetPrivateProfileIntW OutputDebugStringA SetFilePointer GetEnvironmentVariableW WaitForSingleObject CreateFileW GetCurrentThreadId ReleaseMutex Sleep GetFileInformationByHandle GetFileAttributesExW OutputDebugStringW LockResource CloseHandle FindResourceExW LoadResource FindResourceW GetLocalTime GetCurrentProcessId lstrcmpiW lstrcmpW FindFirstFileW FindNextFileW GetCurrentProcess RemoveDirectoryW WaitForMultipleObjects FindClose GetFileAttributesW DuplicateHandle FormatMessageW GetCurrentThread DeleteFileW LoadLibraryW GetCurrentDirectoryW GetProcAddress LocalFree GetModuleHandleW FreeLibrary GetTempFileNameW OpenMutexW GetTickCount LoadLibraryExW GetExitCodeProcess ReadFile CompareFileTime SetEndOfFile SetFileAttributesW FileTimeToSystemTime MoveFileExW GetFileSize CopyFileW GetSystemTimeAsFileTime GetFileTime FlushFileBuffers lstrcpynW ExitProcess IsDebuggerPresent WideCharToMultiByte MultiByteToWideChar GetTimeZoneInformation FileTimeToLocalFileTime SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetModuleFileNameW GetTempPathW GetSystemDirectoryW VirtualQuery TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateMutexW CreateEventW SetEvent ResetEvent GetLongPathNameW SetPriorityClass TerminateProcess WaitForMultipleObjectsEx OpenProcess CreateToolhelp32Snapshot ProcessIdToSessionId Process32NextW WaitForSingleObjectEx ReadProcessMemory SetHandleInformation CreatePipe GetSystemPowerStatus GlobalMemoryStatusEx CreateProcessW SetProcessWorkingSetSize GetVersionExW VerSetConditionMask VerifyVersionInfoW LocalAlloc HeapSetInformation GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetStdHandle QueryDosDeviceW GetLogicalDriveStringsW OpenEventW CreateThread SetCurrentDirectoryW OpenThread QueryPerformanceCounter GetCommandLineW GetStringTypeExW GetThreadLocale lstrcmpA GetStringTypeExA SetFilePointerEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead GetStringTypeW TryAcquireSRWLockExclusive CompareStringEx InitializeCriticalSectionEx EncodePointer LCMapStringEx GetCPInfo QueryPerformanceFrequency RtlUnwind InterlockedPushEntrySList InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo VirtualAlloc VirtualProtect GetModuleHandleExW GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFileSizeEx SetStdHandle GetConsoleOutputCP GetConsoleMode ReadConsoleW WriteConsoleW GetProcessId ReleaseSemaphore RtlCaptureContext DeleteTimerQueueTimer CreateTimerQueueTimer LoadLibraryExA VirtualFree FlushInstructionCache InterlockedPopEntrySList MulDiv GlobalHandle CreateTimerQueue DeleteTimerQueueEx GetSystemDefaultLangID GetUserDefaultLangID GetComputerNameExW GetPrivateProfileStringW DeviceIoControl GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount GetSystemTime UnregisterWaitEx RegisterWaitForSingleObject QueueUserWorkItem Thread32First Thread32Next SetProcessShutdownParameters GetProcessShutdownParameters CreateSemaphoreW Process32FirstW HeapFree

oleaut32

SysReAllocStringLen SysAllocString SystemTimeToVariantTime LoadRegTypeLi OleCreateFontIndirect VarBstrCmp VariantChangeType SafeArrayRedim SafeArrayDestroy SafeArrayGetUBound SafeArrayUnlock SafeArrayGetLBound SafeArrayCopy SafeArrayGetVartype SafeArrayLock SafeArrayCreate LoadTypeLi VariantClear VariantInit SysAllocStringLen SysFreeString SysAllocStringByteLen OleLoadPicturePath SysStringLen VarUI4FromStr VariantTimeToSystemTime SysStringByteLen

user32

GetClientRect TranslateMessage MapWindowPoints PeekMessageW GetMonitorInfoW DispatchMessageW CreateWindowExW CloseClipboard EmptyClipboard SetClipboardData SetCapture UnregisterClassW GetParent SetForegroundWindow GetClassNameW SetWindowContextHelpId GetMenuState InflateRect SetActiveWindow OffsetRect IsMenu SetFocus FrameRect IsRectEmpty GetSysColorBrush SystemParametersInfoW UpdateWindow GetCursorPos EnumChildWindows EnableMenuItem EnableWindow IsDialogMessageW GetWindowTextLengthW GetSystemMenu GetFocus GetDC FillRect ScreenToClient EndDialog SetWindowTextW ShowWindow InvalidateRgn MapDialogRect RemoveMenu GetDlgItem GetDesktopWindow CreateDialogIndirectParamW CreateAcceleratorTableW RedrawWindow RegisterWindowMessageW FlashWindow ReleaseCapture PostQuitMessage SetLayeredWindowAttributes OpenClipboard LoadImageW EnumWindows GetSystemMetrics SendMessageW IsWindowVisible GetWindowThreadProcessId PostThreadMessageW CharNextW LoadStringW IsWindow CharLowerBuffA CopyRect CharNextA DestroyIcon ClientToScreen DestroyAcceleratorTable IsChild GetTopWindow GetSysColor MoveWindow InvalidateRect CharUpperW CharLowerW CharLowerBuffW MessageBoxW wvsprintfW wsprintfW GetWindowLongW GetMessageW AllowSetForegroundWindow GetWindow GetWindowRect DestroyWindow SetWindowPos MonitorFromWindow PostMessageW WaitForInputIdle SendDlgItemMessageW CopyImage GetClassInfoExW KillTimer SetWindowLongW LoadCursorW SetTimer RegisterClassExW CallWindowProcW DefWindowProcW CharUpperBuffW GetWindowTextW EndPaint BeginPaint ReleaseDC

iphlpapi

GetIfTable

netapi32

NetGetJoinInformation NetApiBufferFree NetWkstaUserGetInfo NetWkstaGetInfo

psapi

EnumProcesses GetModuleFileNameExW EnumProcessModules

shlwapi

PathAddBackslashW PathRemoveFileSpecW PathRemoveExtensionW PathStripPathW PathCommonPrefixW PathFindFileNameW SHQueryValueExW PathFileExistsW PathAddExtensionW UrlCombineW PathFindExtensionW PathIsDirectoryW PathIsDirectoryEmptyW UrlIsW UrlUnescapeA PathAppendA UrlEscapeW PathCreateFromUrlW PathAppendW PathCanonicalizeW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

userenv

LeaveCriticalPolicySection EnterCriticalPolicySection ExpandEnvironmentStringsForUserW DestroyEnvironmentBlock CreateEnvironmentBlock GetProfileType UnloadUserProfile

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSFreeMemory

advapi32

RegEnumKeyExW ControlService QueryServiceStatus SystemFunction036 DuplicateToken RegOverridePredefKey GetUserNameW SetSecurityDescriptorOwner GetAce RegOpenCurrentUser IsTextUnicode DeregisterEventSource CreateServiceW SetServiceStatus ChangeServiceConfig2W DeleteService RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW QueryServiceConfigW ChangeServiceConfigW QueryServiceConfig2W RegisterEventSourceW ReportEventW TraceEvent GetSecurityInfo CryptAcquireContextW CryptGenRandom CryptReleaseContext GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids GetSidSubAuthorityCount GetSidIdentifierAuthority AllocateAndInitializeSid ImpersonateSelf FreeSid CheckTokenMembership RegNotifyChangeKeyValue RegQueryInfoKeyW RegDeleteKeyW RegCreateKeyExW GetAclInformation RegSetValueExW RegDeleteValueW RegEnumValueW LookupPrivilegeValueW AdjustTokenPrivileges CreateProcessAsUserW ConvertSidToStringSidW DuplicateTokenEx SetSecurityDescriptorDacl RevertToSelf MakeSelfRelativeSD RegQueryValueExW GetSecurityDescriptorLength GetLengthSid RegOpenKeyExW InitializeAcl AddAce IsValidSid GetSecurityDescriptorOwner InitializeSid CopySid GetSecurityDescriptorControl SetNamedSecurityInfoW GetSidLengthRequired GetSidSubAuthority GetSecurityDescriptorGroup RegCloseKey GetSecurityDescriptorDacl GetSecurityDescriptorSacl GetTokenInformation SetSecurityDescriptorGroup MakeAbsoluteSD OpenThreadToken OpenServiceW InitializeSecurityDescriptor StartServiceW OpenProcessToken ImpersonateLoggedOnUser ConvertStringSidToSidW GetNamedSecurityInfoW OpenSCManagerW CloseServiceHandle EqualSid

ntdll

NtDeleteKey

ole32

CoGetCallContext CoRevertToSelf CoTaskMemFree CoSetProxyBlanket IIDFromString CoReleaseServerProcess CoTaskMemAlloc CoInitializeSecurity CoRegisterClassObject CoResumeClassObjects CoImpersonateClient CoTaskMemRealloc CoInitializeEx CoRevokeClassObject CoRegisterPSClsid OleSaveToStream ReadClassStm WriteClassStm CoCreateInstance StringFromGUID2 CoCreateGuid CoSuspendClassObjects CoGetObject CoUninitialize CreateStreamOnHGlobal CoGetClassObject OleUninitialize CLSIDFromProgID OleInitialize CoAddRefServerProcess CLSIDFromString OleLockRunning

shell32

ShellExecuteExW CommandLineToArgvW SHGetFolderPathW ord680

comctl32

InitCommonControlsEx _TrackMouseEvent

crypt32

CryptHashCertificate CryptUnprotectData CryptProtectData CertFreeCertificateContext CryptQueryObject CertDuplicateCertificateContext CertCloseStore CertFindCertificateInStore CertGetNameStringW

msimg32

GradientFill

uxtheme

SetWindowTheme

wininet

InternetCrackUrlW HttpSendRequestW InternetCloseHandle InternetConnectW HttpQueryInfoW InternetQueryDataAvailable InternetReadFile HttpAddRequestHeadersW HttpOpenRequestW InternetOpenW

wintrust

WinVerifyTrust

gdi32

CreateRectRgnIndirect DPtoLP CreateFontIndirectW CreateSolidBrush DeleteObject GetObjectW DeleteDC GetDeviceCaps GetStockObject CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt ExtTextOutW FillRgn CombineRgn SetBkColor SetViewportOrgEx GetRegionData SetTextColor CreateRectRgn OffsetRgn GetTextMetricsW

Sharing

General

Malware Config

Signatures

File Explorer

2dc72db28603d8d113b27c665ed7fcd4a023d201046c8fe87178d697c7264655

PE Signature issue

kernel32

oleaut32

user32

iphlpapi

netapi32

psapi

shlwapi

version

userenv

wtsapi32

advapi32

ntdll

ole32

shell32

comctl32

crypt32

msimg32

uxtheme

wininet

wintrust

gdi32

generic