185273

Sharing

Copy URL Twitter E-mail

General

Target
185273
Size 107KB
Sample260424-mt58aae14x
SHA256 0b9104fa6efa71fcdff04591a0c0c762f5f4f34d28199cac32ab7f158fd71afe
MD5 b955d52c067ac17b01b42fba3b29b96e
SHA1 0acc0491c2fce1d187db33f4f900693c73d7e953
SHA512 e8a2f0c5c90402367c85887060892897e1c7a875d2ad90b722469bec41db787eda48856c90218e1097effcbba689ad9f9549f6788ed294412c926051bc552389
SSDEEP 3072:+j8AqY/r0FAmZZJ270YOoYTIIIIIIIIIQf:mF+ZZJ/YOowf
TLSH
T1E7B3C4127BF88979F1F32BF1ADBA814189B6FD606D35C21F2254454F0E66A82CD62337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
185273

File Explorer

185273

.exe 107KB

IMPHASH 93991178a09e3d5937b5ef32201af6f2
SHA256 0b9104fa6efa71fcdff04591a0c0c762f5f4f34d28199cac32ab7f158fd71afe
MD5 b955d52c067ac17b01b42fba3b29b96e
SHA1 0acc0491c2fce1d187db33f4f900693c73d7e953
SHA512 e8a2f0c5c90402367c85887060892897e1c7a875d2ad90b722469bec41db787eda48856c90218e1097effcbba689ad9f9549f6788ed294412c926051bc552389
SSDEEP 3072:+j8AqY/r0FAmZZJ270YOoYTIIIIIIIIIQf:mF+ZZJ/YOowf
TLSH
T1E7B3C4127BF88979F1F32BF1ADBA814189B6FD606D35C21F2254454F0E66A82CD62337
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fc:fc:64:e0:6f:fe:65:2d:8d:88:46:67:b5:3f:f1:9d:24:16:f4:f9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LAN Access Division,O=Intel Corporation,L=Hillsboro,ST=Oregon,C=US

Chains

Dec 6, 2010

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LAN Access Division,O=Intel Corporation,L=Hillsboro,ST=Oregon,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LAN Access Division,O=Intel Corporation,L=Hillsboro,ST=Oregon,C=US

Serial Number

05:82:58:57:16:70:ab:2b:1b:ac:50:67:9c:ec:49:a1

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 26, 2009 - May 30, 2012

Minor OS version

Major OS version

Entry point

39140

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW SetupDiOpenDevRegKey SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

kernel32

GetLocalTime LocalFree FormatMessageW GetEnvironmentVariableW GetACP GetLocaleInfoW GetProcAddress LoadLibraryW QueryPerformanceCounter GetCurrentDirectoryW WaitForSingleObject CreateEventW lstrlenA DeviceIoControl SetLastError InterlockedExchange GetCurrentThreadId GetCurrentProcessId OutputDebugStringW CreateFileW MultiByteToWideChar lstrlenW CreateThread CloseHandle ExitThread GetTickCount Sleep GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection InterlockedCompareExchange TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetSystemTimeAsFileTime

user32

LoadStringW

advapi32

RegisterServiceCtrlHandlerW CreateServiceW ChangeServiceConfig2W QueryServiceStatusEx StartServiceW ControlService SetServiceStatus RegCreateKeyExW RegDeleteValueW RegDeleteKeyW RegEnumValueW RegSetValueExW RegFlushKey RegQueryValueExW RegOpenKeyExW RegQueryInfoKeyW RegEnumKeyExW RegCloseKey OpenSCManagerW OpenServiceW CloseServiceHandle StartServiceCtrlDispatcherW DeleteService

ole32

CoSetProxyBlanket CoUninitialize CoInitializeEx CoInitializeSecurity CoCreateInstance

oleaut32

SysStringLen SysFreeString VarBstrCat SysAllocStringLen VarBstrCmp SysAllocStringByteLen SysStringByteLen VariantClear

msvcp90

?_Xran@_String_base@std@@SAXXZ ??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z ?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHABV12@@Z ?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z ?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB ?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z ?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ ?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ ?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z ?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z ??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z ?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ ?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z ?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z ??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z ?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z ?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z

msvcr90

wcsstr __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm __initenv exit _controlfp_s _invoke_watson _crt_debugger_hook _except_handler4_common ?_type_info_dtor_internal_method@type_info@@QAEXXZ __set_app_type ??3@YAXPAX@Z ??_V@YAXPAX@Z _itow_s memset _vsnwprintf_s __CxxFrameHandler3 _purecall ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@XZ ??2@YAPAXI@Z free _CxxThrowException memcpy_s _invalid_parameter_noinfo ??0exception@std@@QAE@ABV01@@Z memmove_s strtoul wcsrchr fclose fflush fwprintf _snwprintf_s _filelength _fileno _wfopen _wcsicmp wcslen malloc _XcptFilter wcscpy_s _set_invalid_parameter_handler wcscat_s _wcsupr _wcslwr _wtoi _vsnwprintf strcmp strlen memcpy ?terminate@@YAXXZ _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer _amsg_exit __getmainargs _cexit _exit __p__fmode

??0CNcsDebug@@QAE@ABV0@@Z ??0CNcsDebug@@QAE@XZ ??0CNcsRegKey@@QAE@ABV0@@Z ??0CNcsRegKey@@QAE@PAUHKEY__@@@Z ??0CNcsRegKey@@QAE@XZ ??0CNcsString@@QAE@ABH@Z ??0CNcsString@@QAE@ABV0@@Z ??0CNcsString@@QAE@PB_W@Z ??0CNcsString@@QAE@QA_W@Z ??0CNcsString@@QAE@XZ ??1CNcsDebug@@UAE@XZ ??1CNcsRegKey@@UAE@XZ ??1CNcsString@@QAE@XZ ??4CNcsDebug@@QAEAAV0@ABV0@@Z ??4CNcsRegKey@@QAEAAV0@ABV0@@Z ??4CNcsRegKey@@QAEAAV0@PAUHKEY__@@@Z ??4CNcsString@@QAEAAV0@ABH@Z ??4CNcsString@@QAEAAV0@ABV0@@Z ??4CNcsString@@QAEAAV0@PB_W@Z ??8CNcsString@@QBE_NABV0@@Z ??8CNcsString@@QBE_NPB_W@Z ??BCNcsString@@QBEPB_WXZ ??HCNcsString@@QAE?AV0@ABV0@@Z ??MCNcsString@@QBE_NABV0@@Z ??_7CNcsDebug@@6B@ ??_7CNcsRegKey@@6B@ ?AddValueToMultiString@CNcsRegKey@@QAE_NABVCNcsString@@0@Z ?Close@CNcsRegKey@@QAEXXZ ?CompareI@CNcsString@@QAE_NV1@@Z ?Configure@CNcsDebug@@QAEHPB_W0KHK0@Z ?Create@CNcsRegKey@@QAE_NPAUHKEY__@@ABVCNcsString@@_N2@Z ?DeleteSubKey@CNcsRegKey@@QAE_NPB_W@Z ?DeleteValue@CNcsRegKey@@QAE_NABVCNcsString@@@Z ?Empty@CNcsString@@QAEXXZ ?EnumSubKey@CNcsRegKey@@QAE_NAAVCNcsString@@@Z ?EnumValue@CNcsRegKey@@QAE_NAAVCNcsString@@@Z ?Error@CNcsDebug@@QAAXPA_WHPB_WZZ ?FlushKey@CNcsRegKey@@QAEJXZ ?FormatString@CNcsString@@QAAHPB_WZZ ?GetCurrentLogLevel@CNcsDebug@@QAEKXZ ?GetHKey@CNcsRegKey@@QAEPAUHKEY__@@XZ ?GetRegType@CNcsRegKey@@QAEKABVCNcsString@@@Z ?GetValue@CNcsRegKey@@QAE_NABVCNcsString@@AAK@Z ?GetValue@CNcsRegKey@@QAE_NABVCNcsString@@AAV2@@Z ?GetValue@CNcsRegKey@@QAE_NABVCNcsString@@AAV?$vector@VCNcsString@@V?$allocator@VCNcsString@@@std@@@std@@@Z ?GetValue@CNcsRegKey@@QAE_NABVCNcsString@@PAEAAK@Z ?Init@CNcsRegKey@@AAEXXZ ?IsAlphaChar@CNcsString@@AAE_N_W@Z ?IsConfigured@CNcsDebug@@QAE_NXZ ?IsEmpty@CNcsString@@QBEHXZ ?IsHexadecimal@CNcsString@@AAE_N_W@Z ?IsNumericChar@CNcsString@@AAE_N_W@Z ?IsStringHexadecimal@CNcsString@@QAE_NXZ ?IsStringType@CNcsString@@QAE_NK@Z ?IsSubStringValueInMultiString@CNcsRegKey@@QAE_NABVCNcsString@@0AAV2@@Z ?IsSymbolicChar@CNcsString@@AAE_N_W@Z ?IsValueInMultiString@CNcsRegKey@@QAE_NABVCNcsString@@0@Z ?LastResult@CNcsRegKey@@QAEJXZ ?Length@CNcsString@@QBEIXZ ?LoadStringW@CNcsString@@AAEHPAUHINSTANCE__@@KW4LangRes@1@@Z ?LoadStringW@CNcsString@@QAEHPAUHINSTANCE__@@K@Z ?MakeLower@CNcsString@@QAEXXZ ?MakeUpper@CNcsString@@QAEXXZ ?Open@CNcsRegKey@@QAE_NPAUHKEY__@@ABVCNcsString@@_N@Z ?Print@CNcsDebug@@QAAXPB_WZZ ?PrintLastError@CNcsDebug@@QAEXH@Z ?RemoveSubKey@CNcsRegKey@@AAEKPB_W@Z ?RemoveValueFromMultiString@CNcsRegKey@@QAE_NABVCNcsString@@0@Z ?ResetEnumeration@CNcsRegKey@@QAEXXZ ?SetValue@CNcsRegKey@@QAE_NABVCNcsString@@AAV2@_N@Z ?SetValue@CNcsRegKey@@QAE_NABVCNcsString@@K@Z ?SetValue@CNcsRegKey@@QAE_NABVCNcsString@@PAEK@Z ?SetValue@CNcsRegKey@@QAE_NABVCNcsString@@V?$vector@VCNcsString@@V?$allocator@VCNcsString@@@std@@@std@@@Z ?Split@CNcsString@@QAE_NDAAV?$vector@VCNcsString@@V?$allocator@VCNcsString@@@std@@@std@@@Z ?SubKeyExists@CNcsRegKey@@QAE_NABVCNcsString@@@Z GetCodePage

Sharing

General

Malware Config

Signatures

File Explorer

185273

PE Signature issue

setupapi

kernel32

user32

advapi32

ole32

oleaut32

msvcp90

msvcr90

generic