183136

Sharing

Copy URL Twitter E-mail

General

Target
183136
Size 285KB
Sample260423-pvywpsdy21
SHA256 01c1bff17bec6588e192ec4d7acb74fc9b95eca7cb8bb9585b04fc8ea73c3b43
MD5 094e4e76fb9ab960a73f841bc6733f42
SHA1 d17bb9fc62cfbf422dff72b25b90c9580a758233
SHA512 f3c9c424dbe691e1d1beccdb97739ed6d3b929e8458c4cb71f5393b9d43ea903f358d1898f1f653d6b725279d7c724c8036cbb9a57bc97cbf9bbc04bb7725fa3
SSDEEP 3072:xNdq0swtPmZVnyLMQhJmxn90RAqt/7kDX1+Wrl+jw:xvqXP/UAFA9tkU61
TLSH
T18F5418606343CC99C2468830C928E3F144275C29A5A565EF37A63F5F7B7A9829F11E3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
183136

File Explorer

183136

.exe 285KB

IMPHASH 25184de5e75300ec887e263b6533f8bb
SHA256 01c1bff17bec6588e192ec4d7acb74fc9b95eca7cb8bb9585b04fc8ea73c3b43
MD5 094e4e76fb9ab960a73f841bc6733f42
SHA1 d17bb9fc62cfbf422dff72b25b90c9580a758233
SHA512 f3c9c424dbe691e1d1beccdb97739ed6d3b929e8458c4cb71f5393b9d43ea903f358d1898f1f653d6b725279d7c724c8036cbb9a57bc97cbf9bbc04bb7725fa3
SSDEEP 3072:xNdq0swtPmZVnyLMQhJmxn90RAqt/7kDX1+Wrl+jw:xvqXP/UAFA9tkU61
TLSH
T18F5418606343CC99C2468830C928E3F144275C29A5A565EF37A63F5F7B7A9829F11E3F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

7b:d4:5a:70:15:4f:c9:7f:a0:65:60:9b:2a:aa:10:b3:72:27:21:d4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Intel Corporation - Software and Firmware Products,OU=Intel Architecture Group,O=Intel Corporation

Chains

Apr 26, 2013

CN=Intel Corporation - Software and Firmware Products,OU=Intel Architecture Group,O=Intel Corporation

Subject

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Serial Number

05:b0:ff

Issuer

OU=Equifax Secure Certificate Authority,O=Equifax,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 16, 2006 - Feb 19, 2016

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

OU=Equifax Secure Certificate Authority,O=Equifax,C=US

Serial Number

61:0b:dc:8f:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Intel Corporation - Software and Firmware Products,OU=Intel Architecture Group,O=Intel Corporation

Serial Number

2f:9b:73:e1:00:01:00:00:90:80

Issuer

CN=Intel External Basic Issuing CA 3A,O=Intel Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 6, 2012 - May 15, 2015

Subject

CN=Intel External Basic Issuing CA 3A,O=Intel Corporation,C=US

Serial Number

61:1e:80:b7:00:00:00:00:00:07

Issuer

CN=Intel External Basic Policy CA,O=Intel Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 15, 2009 - May 15, 2015

Minor OS version

Major OS version

Entry point

5602

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\ccViews\autobuild1_BR-1303-0188_2.0_Snapshot\USB3_Sakura\driver\Monitor\exe\Release\iusb3mon_exe.pdb

comctl32

ImageList_Create ImageList_ReplaceIcon

iusb3mon

_USB3MON_GetHostInfoW@20 _USB3MON_Create@12 _USB3MON_GetDeviceInfoW@20 _USB3MON_GetInterfaceVersion@8 _USB3MON_DeviceChange@12 _USB3MON_ForwardMessage@16 _USB3MON_Close@4

kernel32

FreeLibrary InterlockedIncrement WaitForSingleObject SetEvent GlobalAlloc lstrcmpW lstrlenW ReleaseSemaphore InterlockedExchange GetLastError GlobalFree CreateSemaphoreW CreateEventW WaitForMultipleObjects OpenEventW GetUserDefaultUILanguage ReleaseMutex CloseHandle ResumeThread CreateThread LoadLibraryExW ExitThread ResetEvent SuspendThread GetConsoleOutputCP CreateMutexW HeapSize LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetLocaleInfoA MultiByteToWideChar GetConsoleMode GetConsoleCP SetFilePointer HeapReAlloc VirtualAlloc HeapAlloc RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryA IsValidCodePage GetOEMCP SetStdHandle WriteConsoleA WriteConsoleW CreateFileA FlushFileBuffers GetACP GetCPInfo GetCurrentThreadId GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError InterlockedDecrement Sleep ExitProcess HeapFree WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection

user32

GetWindowRect GetDlgItem EndDialog GetDesktopWindow SetWindowPos SetDlgItemTextW SendMessageW DestroyWindow SetTimer GetMessageW PostQuitMessage PostMessageW KillTimer DialogBoxParamW LoadCursorW RegisterClassExW LoadIconW LoadStringW ShowWindow CreateWindowExW UpdateWindow SetWindowTextW DefWindowProcW DispatchMessageW TranslateMessage

gdi32

GetStockObject

advapi32

RegQueryValueExW SetNamedSecurityInfoW RegOpenKeyExW RegSetValueExW RegCloseKey RegCreateKeyExW

shell32

Shell_NotifyIconW

Sharing

General

Malware Config

Signatures

File Explorer

183136

PE Signature issue

comctl32

iusb3mon

kernel32

user32

gdi32

advapi32

shell32

generic