2dc42c590df799104e11c48039d6d8ac6fc71217f2a2870c129bdad6443d517d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2dc42c590df799104e11c48039d6d8ac6fc71217f2a2870c129bdad6443d517d.exe
Size 1.6MB
Sample260420-e7f7bag14k
SHA256 2dc42c590df799104e11c48039d6d8ac6fc71217f2a2870c129bdad6443d517d
MD5 02b2a056d19a3edac495d70200b5c136
SHA1 02404e4e1de86ce04c62526e98e63f6b868fdca5
SHA512 e7f774f67e720d9fed2311b5632e37822d9e27321781b7679e9d2544672de91ec3732618878b1dcedcd577e4ba1a4e58e20a9310d79a95509a7b7877650b9155
SSDEEP 49152:G/fQfSsM7QfC5+/EpKgp1RajfAetIIIIIIIIII4zIMrZwjUmu6:OMC5TRd
TLSH
T186858D12B791803BD11706745ABB93727C39B7642B928857AFB4DE0C1FB63806E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2dc42c590df799104e11c48039d6d8ac6fc71217f2a2870c129bdad6443d517d.exe

File Explorer

2dc42c590df799104e11c48039d6d8ac6fc71217f2a2870c129bdad6443d517d.exe

.exe 1.6MB

2dc42c590df799104e11c48039d6d8ac6fc71217f2a2870c129bdad6443d517d.exe

IMPHASH 96dee91d234223c1e8b9fe4456e322f0
SHA256 2dc42c590df799104e11c48039d6d8ac6fc71217f2a2870c129bdad6443d517d
MD5 02b2a056d19a3edac495d70200b5c136
SHA1 02404e4e1de86ce04c62526e98e63f6b868fdca5
SHA512 e7f774f67e720d9fed2311b5632e37822d9e27321781b7679e9d2544672de91ec3732618878b1dcedcd577e4ba1a4e58e20a9310d79a95509a7b7877650b9155
SSDEEP 49152:G/fQfSsM7QfC5+/EpKgp1RajfAetIIIIIIIIII4zIMrZwjUmu6:OMC5TRd
TLSH
T186858D12B791803BD11706745ABB93727C39B7642B928857AFB4DE0C1FB63806E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ef:1f:75:2b:83:8f:38:ab:32:cc:2e:6b:50:ea:dd:7e:08:19:d5:a3

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=80333613,CN=ASROCK INC.,O=ASROCK INC.,STREET=2F.\, No. 37\, Sec. 2\, Zhongyang S. Rd.\, Beitou Dist.,L=Taipei,ST=Taipei,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 29, 2022

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:15:4b:5a:c3:94

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 1, 1998 - Jan 28, 2028

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

3b:e2:4b:96:d2:c8:d7:29:ed:db:03:e3

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 17, 2021 - Sep 17, 2024

Minor OS version

Major OS version

Entry point

5712

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CloseServiceHandle ControlService CreateServiceA DeleteService InitiateSystemShutdownA LookupPrivilegeValueA OpenProcessToken OpenSCManagerA OpenServiceA RegCloseKey RegConnectRegistryW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueA RegEnumValueW RegFlushKey RegLoadKeyW RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegReplaceKeyW RegRestoreKeyW RegSaveKeyW RegSetValueExW RegUnLoadKeyW StartServiceA

kernel32

AllocConsole Beep CloseHandle CompareStringW CreateEventA CreateEventW CreateFileA CreateFileW CreateMutexA CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileA DeviceIoControl EnterCriticalSection EnumCalendarInfoW ExitProcess ExitThread FindClose FindFirstFileW FindResourceW FormatMessageW FreeConsole FreeLibrary FreeResource GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceW GetEnvironmentStrings GetExitCodeThread GetFileAttributesA GetFileAttributesW GetFileType GetFullPathNameW GetLargestConsoleWindowSize GetLastError GetLocalTime GetLocaleInfoA GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetStringTypeA GetStringTypeW GetSystemDefaultLangID GetSystemDefaultUILanguage GetSystemDirectoryA GetSystemInfo GetThreadLocale GetThreadPriority GetTickCount GetUserDefaultLCID GetUserDefaultUILanguage GetVersion GetVersionExA GetVersionExW GetWindowsDirectoryA GlobalAddAtomW GlobalAlloc GlobalDeleteAtom GlobalFindAtomW GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection InterlockedCompareExchange InterlockedDecrement InterlockedExchange InterlockedExchangeAdd InterlockedIncrement IsDBCSLeadByteEx IsDebuggerPresent IsValidLocale LCMapStringA LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LockResource MulDiv MultiByteToWideChar OpenMutexA QueryPerformanceCounter RaiseException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlUnwind ScrollConsoleScreenBufferA SetConsoleCtrlHandler SetConsoleCursorPosition SetConsoleScreenBufferSize SetConsoleTextAttribute SetConsoleWindowInfo SetEndOfFile SetErrorMode SetEvent SetFilePointer SetHandleCount SetLastError SetThreadLocale SetThreadPriority SignalObjectAndWait SizeofResource Sleep SuspendThread SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualQuery VirtualQueryEx WaitForMultipleObjectsEx WaitForSingleObject WideCharToMultiByte WriteConsoleA WriteConsoleOutputA WriteConsoleW WriteFile lstrcmpiA lstrcpyW lstrcpynW lstrlenW

version

GetFileVersionInfoA GetFileVersionInfoSizeA GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueA VerQueryValueW

winspool.drv

ClosePrinter DocumentPropertiesW EnumPrintersW ord203 OpenPrinterW

comctl32

FlatSB_GetScrollInfo FlatSB_GetScrollPos FlatSB_SetScrollInfo FlatSB_SetScrollPos FlatSB_SetScrollProp ImageList_Add ImageList_BeginDrag ImageList_Copy ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ImageList_Draw ImageList_DrawEx ImageList_EndDrag ImageList_GetBkColor ImageList_GetDragImage ImageList_GetIcon ImageList_GetIconSize ImageList_GetImageCount ImageList_GetImageInfo ImageList_LoadImageW ImageList_Read ImageList_Remove ImageList_Replace ImageList_ReplaceIcon ImageList_SetBkColor ImageList_SetIconSize ImageList_SetImageCount ImageList_SetOverlayImage ImageList_Write InitializeFlatSB _TrackMouseEvent

gdi32

AbortDoc Arc BitBlt Chord CopyEnhMetaFileW CreateBitmap CreateBrushIndirect CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateDIBitmap CreateFontIndirectW CreateHalftonePalette CreateICW CreatePalette CreatePenIndirect CreateRectRgn CreateSolidBrush DeleteDC DeleteEnhMetaFile DeleteObject Ellipse EndDoc EndPage EnumFontFamiliesExW EnumFontsW ExcludeClipRect ExtFloodFill ExtTextOutW FrameRgn GetBitmapBits GetBrushOrgEx GetClipBox GetCurrentPositionEx GetDCOrgEx GetDIBColorTable GetDIBits GetDeviceCaps GetEnhMetaFileBits GetEnhMetaFileDescriptionW GetEnhMetaFileHeader GetEnhMetaFilePaletteEntries GetObjectW GetPaletteEntries GetPixel GetRgnBox GetStockObject GetSystemPaletteEntries GetTextExtentExPointW GetTextExtentPoint32W GetTextExtentPointW GetTextMetricsW GetWinMetaFileBits GetWindowOrgEx IntersectClipRect LineTo MaskBlt MoveToEx PatBlt Pie PlayEnhMetaFile PolyBezier PolyBezierTo Polygon Polyline RealizePalette RectVisible Rectangle RestoreDC RoundRect SaveDC SelectClipRgn SelectObject SelectPalette SetAbortProc SetBkColor SetBkMode SetBrushOrgEx SetDIBColorTable SetDIBits SetEnhMetaFileBits SetPixel SetROP2 SetStretchBltMode SetTextColor SetViewportOrgEx SetWinMetaFileBits SetWindowOrgEx StartDocW StartPage StretchBlt StretchDIBits UnrealizeObject

msimg32

AlphaBlend

shell32

SHGetFileInfoW ShellExecuteW

user32

ActivateKeyboardLayout AdjustWindowRectEx BeginPaint CallNextHookEx CallWindowProcW CharLowerBuffW CharLowerW CharNextW CharUpperBuffW CheckMenuItem ClientToScreen CloseClipboard CopyIcon CreateAcceleratorTableW CreateIcon CreateMenu CreatePopupMenu CreateWindowExW DefFrameProcW DefMDIChildProcW DefWindowProcW DeleteMenu DestroyCursor DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DispatchMessageW DrawEdge DrawFocusRect DrawFrameControl DrawIcon DrawIconEx DrawMenuBar DrawTextExW DrawTextW EmptyClipboard EnableMenuItem EnableScrollBar EnableWindow EndPaint EnumChildWindows EnumThreadWindows EnumWindows EqualRect FillRect FindWindowExW FindWindowW FrameRect GetActiveWindow GetCapture GetClassInfoW GetClassLongW GetClientRect GetClipboardData GetCursor GetCursorPos GetDC GetDCEx GetDesktopWindow GetFocus GetForegroundWindow GetIconInfo GetKeyNameTextW GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardLayoutNameW GetKeyboardState GetLastActivePopup GetMenu GetMenuItemCount GetMenuItemID GetMenuItemInfoW GetMenuState GetMenuStringW GetMessageExtraInfo GetMessagePos GetParent GetPropW GetScrollInfo GetScrollPos GetScrollRange GetSubMenu GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetTopWindow GetWindow GetWindowDC GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextW GetWindowThreadProcessId InflateRect InsertMenuItemW InsertMenuW IntersectRect InvalidateRect IsChild IsDialogMessageA IsDialogMessageW IsIconic IsWindow IsWindowEnabled IsWindowUnicode IsWindowVisible IsZoomed KillTimer LoadBitmapW LoadCursorW LoadIconA LoadIconW LoadKeyboardLayoutW LoadStringW MapVirtualKeyW MapWindowPoints MessageBeep MessageBoxA MessageBoxW MsgWaitForMultipleObjects MsgWaitForMultipleObjectsEx OffsetRect OpenClipboard PeekMessageA PeekMessageW PostMessageW PostQuitMessage PtInRect RedrawWindow RegisterClassW RegisterClipboardFormatW RegisterWindowMessageW ReleaseCapture ReleaseDC RemoveMenu RemovePropW ScreenToClient ScrollWindow SendMessageA SendMessageW SetActiveWindow SetCapture SetClassLongW SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenu SetMenuItemInfoW SetParent SetPropW SetRect SetScrollInfo SetScrollPos SetScrollRange SetTimer SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW SetWindowsHookExW ShowOwnedPopups ShowScrollBar ShowWindow SystemParametersInfoW TrackPopupMenu TranslateMDISysAccel TranslateMessage UnhookWindowsHookEx UnregisterClassW UpdateWindow WaitMessage WindowFromPoint wsprintfA

ole32

CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemFree CoUninitialize CreateStreamOnHGlobal IsEqualGUID OleInitialize OleUninitialize

oleaut32

GetErrorInfo OleLoadPicture SafeArrayCreate SafeArrayGetLBound SafeArrayGetUBound SafeArrayPtrOfIndex SysAllocStringLen SysFreeString SysReAllocStringLen VariantChangeType VariantClear VariantCopy VariantInit

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

417KB

Virtual Size

456KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

66KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

73KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2dc42c590df799104e11c48039d6d8ac6fc71217f2a2870c129bdad6443d517d.exe

PE Signature issue

advapi32

kernel32

version

winspool.drv

comctl32

gdi32

msimg32

shell32

user32

ole32

oleaut32

generic