ec67a5b01514bed3aa6740ca0824108d2d7d117b8bd1ecbf81fb9dc3c0a095e6

Sharing

Copy URL Twitter E-mail

General

Target
ec67a5b01514bed3aa6740ca0824108d2d7d117b8bd1ecbf81fb9dc3c0a095e6
Size 8.8MB
Sample260423-pceecact7w
SHA256 ec67a5b01514bed3aa6740ca0824108d2d7d117b8bd1ecbf81fb9dc3c0a095e6
MD5 01e3f58491a9757b022553fb00c893a1
SHA1 667bc4658bdb1196c889de46ff30b0dceb0af8ef
SHA512 8ccd592e7e0ff63fcf14608fa2cb41d26e44756f46c555211257cdc1484e5ed2e4e117ab234065e9329fe40affcfaad36dc219b80232715cd33aa5cc79e8ea8d
SSDEEP 49152:txogkKY6iKLXJ+8w44fvNKKiqX+0o+zC+wI5KkdDVw4VwICetWIXKgI0Vw9o8g8r:Khmiwl3ICetWavmZJOPgBkCj
TLSH
T1BE964AD17F40FCE4E8164436552288FABFD23C10A6203D7625B27A2FEF3A7595A1F50A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

ec67a5b01514bed3aa6740ca0824108d2d7d117b8bd1ecbf81fb9dc3c0a095e6

.exe 8.8MB

ec67a5b01514bed3aa6740ca0824108d2d7d117b8bd1ecbf81fb9dc3c0a095e6

IMPHASH 4227af58308a99d48e73bf894dc38f2b
SHA256 ec67a5b01514bed3aa6740ca0824108d2d7d117b8bd1ecbf81fb9dc3c0a095e6
MD5 01e3f58491a9757b022553fb00c893a1
SHA1 667bc4658bdb1196c889de46ff30b0dceb0af8ef
SHA512 8ccd592e7e0ff63fcf14608fa2cb41d26e44756f46c555211257cdc1484e5ed2e4e117ab234065e9329fe40affcfaad36dc219b80232715cd33aa5cc79e8ea8d
SSDEEP 49152:txogkKY6iKLXJ+8w44fvNKKiqX+0o+zC+wI5KkdDVw4VwICetWIXKgI0Vw9o8g8r:Khmiwl3ICetWavmZJOPgBkCj
TLSH
T1BE964AD17F40FCE4E8164436552288FABFD23C10A6203D7625B27A2FEF3A7595A1F50A
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

c2:d1:c4:37:bb:ad:60:31:78:54:d3:09:dc:a5:5e:81:bf:1b:4a:3f:39:ae:3c:da:1d:ce:47:a6:9b:5a:b6:9e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

Chains

Feb 17, 2026

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

Serial Number

05:c1:5b:a9:90:8e:f7:0e:96:df:d8:52:23:95:77:1d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 12, 2025 - Dec 14, 2027

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

375060

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Dropbox.pdb

dropbox_core

dbxlog_log bootstrap_event_loop bootstrap_cleanup_application apex_context_get_current bootstrap_application bootstrap_abort

advapi32

RegGetValueW ConvertSidToStringSidA EventWrite EventRegister EventUnregister RevertToSelf RegDisablePredefinedCache RegOpenKeyExW RegCloseKey SetTokenInformation OpenProcessToken GetKernelObjectSecurity GetSecurityDescriptorSacl GetAce SetKernelObjectSecurity DuplicateTokenEx MapGenericMask AccessCheck InitializeSid GetSidSubAuthority IsValidSid GetLengthSid CreateWellKnownSid ConvertStringSidToSidW ConvertSidToStringSidW EqualSid CreateProcessAsUserW SetThreadToken RegCreateKeyExW RegQueryValueExW RegSetValueExW CreateRestrictedToken LookupPrivilegeValueW AdjustTokenPrivileges BuildTrusteeWithSidW SetEntriesInAclW GetSecurityInfo SetSecurityInfo InitializeAcl AddMandatoryAce FreeSid ImpersonateLoggedOnUser GetNamedSecurityInfoW GetSecurityDescriptorDacl SystemFunction036 DuplicateToken GetTokenInformation

kernel32

GetStdHandle SetEnvironmentVariableW GetFileType OpenMutexW FreeLibrary GetProcAddress LoadLibraryW SetDllDirectoryW GetModuleHandleA GetLastError HeapSetInformation GetCurrentThread GetCurrentProcess CreateIoCompletionPort SetLastError CreateEventW CreateThread ResetEvent GetQueuedCompletionStatus SetEvent UnregisterWait RegisterWaitForSingleObject TerminateJobObject PostQueuedCompletionStatus WaitForSingleObject GetModuleHandleExW SetInformationJobObject DuplicateHandle GetCurrentThreadId TerminateProcess GetUserDefaultLangID GetUserDefaultLCID GetUserDefaultLocaleName EnumSystemLocalesEx HeapDestroy GetTickCount GetVersionExW GetProductInfo GetNativeSystemInfo GetModuleHandleW IsWow64Process TryAcquireSRWLockExclusive ReleaseSRWLockExclusive UnregisterWaitEx Sleep IsDebuggerPresent RaiseException CloseHandle GetThreadId SetThreadPriority GetThreadPriority SetHandleInformation LocalFree AssignProcessToJobObject WriteProcessMemory CreateFileMappingW MapViewOfFile ReadProcessMemory GetCurrentProcessorNumber SetThreadAffinityMask VirtualFree GetProcessHeaps ExpandEnvironmentStringsW GetCurrentProcessId LoadLibraryExW AcquireSRWLockExclusive QueryPerformanceCounter GetSystemTimeAsFileTime QueryPerformanceFrequency QueryThreadCycleTime CreateJobObjectW QueryInformationJobObject GetModuleFileNameW CreateFileW GetCurrentDirectoryW GetLocalTime OutputDebugStringA WriteFile FormatMessageA CreateNamedPipeW VirtualAllocEx VirtualProtectEx DeleteProcThreadAttributeList InitializeProcThreadAttributeList UpdateProcThreadAttribute CreateMutexW UnmapViewOfFile GetFileAttributesW QueryDosDeviceW GetLongPathNameW GetProcessHandleCount GetCommandLineW CreateDirectoryW ReadFile SetCurrentDirectoryW TlsGetValue VerSetConditionMask VerifyVersionInfoW ReadConsoleW Process32FirstW Process32NextW OpenProcess GetProcessTimes WaitForMultipleObjects lstrlenW DebugBreak SetFilePointerEx GetFileSizeEx SetEndOfFile FlushFileBuffers FindClose FindNextFileW FindFirstFileExW SetUnhandledExceptionFilter RtlCaptureStackBackTrace TlsAlloc TlsFree TlsSetValue CreateRemoteThread LCMapStringW WideCharToMultiByte MultiByteToWideChar RtlLookupFunctionEntry RtlVirtualUnwind CompareStringW RtlUnwind HeapReAlloc EnumSystemLocalesW IsValidLocale HeapFree HeapAlloc GetProcessHeap SetStdHandle GetConsoleMode GetConsoleOutputCP ExitProcess GetCommandLineA InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter RtlCaptureContext InitializeSListHead WaitForSingleObjectEx DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CreateToolhelp32Snapshot GetLocaleInfoW VirtualFreeEx IsValidCodePage GetACP GetOEMCP RegisterApplicationRestart CreateProcessW HeapSize WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW

ole32

CoCreateFreeThreadedMarshaler CoIncrementMTAUsage CoUninitialize CoTaskMemFree CoInitializeEx

shell32

SHGetKnownFolderPath ShellExecuteW

shlwapi

PathIsNetworkPathW

user32

FindWindowW GetWindowThreadProcessId AllowSetForegroundWindow SendMessageW CreateWindowStationW GetThreadDesktop CloseDesktop CreateDesktopW SetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW CloseWindowStation

ws2_32

WSASocketW WSASetLastError WSAGetLastError closesocket WSADuplicateSocketW

api-ms-win-mm-time-l1-1-0

timeGetTime

crypt32

CryptHashPublicKeyInfo

wintrust

WinVerifyTrust WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteStringBuffer WindowsCreateStringReference WindowsDeleteString WindowsPromoteStringBuffer WindowsPreallocateStringBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoUninitialize RoInitialize

comctl32

ord344 ord345

oleaut32

SysFreeString

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo GetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

609KB

Virtual Size

609KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

140KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8.0MB

Virtual Size

8.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=23, id=260, version=27412,

count=15, id=259, version=27412,

count=188, id=261, version=27412,

count=1, id=253, version=28518,

count=17, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=10, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,

count=93, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=262, version=27412,

count=28, id=257, version=27412,

count=385, productName=Unmarked objects (old),

count=3, id=257, version=29924,

count=438, id=1, productName=Unmarked objects,

count=1, id=260, version=29924,

count=6, id=261, version=29924,

count=1, id=256, version=29924,

count=1, id=255, version=29924,

count=1, id=151,

count=1, id=258, version=29924,