185311

Sharing

Copy URL Twitter E-mail

General

Target
185311
Size 225KB
Sample260424-mt7fcae17s
SHA256 0bb165f691b3d66bf7b5ea1dcb1d439ce3c9a37a635d859b712ef6e0d6555290
MD5 961ab37c5b9e1bb8329b1038743cceba
SHA1 7f60ef2d6e00e054f20a009d3174cf1c52f06783
SHA512 a0e64b8cb82f9afe92264dfcca1185a82cfb3ed72a2aefc69007b0e0624887fda3dec5acc45cc3425346c096826d775612dbb52673895db0c128de8393ffcf58
SSDEEP 3072:Ca9t9pMymMzeymkMGnQmKb00eZwP2CTrFzctTFxwRmtp+tipsox7v4Y7:/oy7QXbWyF3mtHprP7
TLSH
T139347C203AD0C0B2EAAB46B017F18B25A936BD816F74D0DF2390379E5E717D25D3235A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
185311

File Explorer

185311

.exe 225KB

IMPHASH 2013d8a285b679453b93c40a2f6e7445
SHA256 0bb165f691b3d66bf7b5ea1dcb1d439ce3c9a37a635d859b712ef6e0d6555290
MD5 961ab37c5b9e1bb8329b1038743cceba
SHA1 7f60ef2d6e00e054f20a009d3174cf1c52f06783
SHA512 a0e64b8cb82f9afe92264dfcca1185a82cfb3ed72a2aefc69007b0e0624887fda3dec5acc45cc3425346c096826d775612dbb52673895db0c128de8393ffcf58
SSDEEP 3072:Ca9t9pMymMzeymkMGnQmKb00eZwP2CTrFzctTFxwRmtp+tipsox7v4Y7:/oy7QXbWyF3mtHprP7
TLSH
T139347C203AD0C0B2EAAB46B017F18B25A936BD816F74D0DF2390379E5E717D25D3235A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

cd:21:ca:33:20:57:34:bd:70:5c:1b:a3:32:0c:f8:b4:0f:ac:0e:ec

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sierra Wireless Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Sierra Wireless Inc.,L=Richmond,ST=British Columbia,C=CA

Chains

Sep 13, 2010

CN=Sierra Wireless Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Sierra Wireless Inc.,L=Richmond,ST=British Columbia,C=CA

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Sierra Wireless Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Sierra Wireless Inc.,L=Richmond,ST=British Columbia,C=CA

Serial Number

50:7e:28:4a:e7:ef:e2:d7:ea:a5:fc:5d:af:3d:8a:02

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 25, 2009 - Nov 25, 2012

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

Major OS version

Entry point

67143

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\PRODUCT_BUILDS\3G_SDK\3G_SDK_10_Build2761\OutNet\Win32\release\SwiCardDetect.pdb

shlwapi

PathAppendW

setupapi

CM_Get_Parent SetupDiGetDeviceRegistryPropertyW CM_Get_Device_IDW CM_Get_Child CM_Get_Sibling SetupDiOpenDeviceInfoW SetupDiCreateDeviceInfoList SetupDiSetClassInstallParamsW SetupDiOpenDeviceInterfaceW SetupDiCallClassInstaller SetupDiGetDeviceInterfaceDetailW SetupDiGetDeviceInfoListDetailW CM_Get_DevNode_Status_Ex SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo CM_Request_Device_EjectW SetupDiGetClassDevsW CM_Get_DevNode_Status SetupDiOpenDevRegKey CM_Reenumerate_DevNode

kernel32

InitializeCriticalSection CreateDirectoryW DeleteCriticalSection WriteFile InterlockedExchangeAdd CreateFileW InterlockedIncrement DeviceIoControl GetTickCount GetModuleHandleW GetProcAddress HeapAlloc GetProcessHeap OpenProcess lstrcmpiW HeapFree GetLastError GetVersionExW lstrlenW CloseHandle Sleep WaitForSingleObject EnterCriticalSection CancelIo GetModuleFileNameW OutputDebugStringW DisconnectNamedPipe ReadFileEx CreateEventW GetOverlappedResult ConnectNamedPipe WaitForMultipleObjectsEx SetEvent WaitForMultipleObjects ResetEvent CreateNamedPipeW GetCommState SetCommState GetCommTimeouts LeaveCriticalSection PurgeComm ReadFile MultiByteToWideChar WideCharToMultiByte GetFileSize SetFilePointer FlushFileBuffers GetLocalTime GetDateFormatW CopyFileW SetEndOfFile GetFileAttributesW QueryPerformanceFrequency GetCurrentThreadId QueryPerformanceCounter DeleteFileW SetFileAttributesW LoadLibraryW GetCurrentProcessId FreeLibrary LocalAlloc InterlockedDecrement LocalFree CreateThread SetHandleCount GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetFileType GetStartupInfoA GetStringTypeA GetStringTypeW GetLocaleInfoA LoadLibraryA GetTimeZoneInformation GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA CompareStringA CompareStringW SetCommTimeouts GetEnvironmentStrings FreeEnvironmentStringsA HeapSize HeapCreate HeapDestroy HeapReAlloc VirtualAlloc VirtualFree GetModuleFileNameA GetStdHandle GetDateFormatA GetTimeFormatA ExitProcess GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread GetVersionExA RaiseException RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError LCMapStringA LCMapStringW

user32

wsprintfW UnregisterDeviceNotification RegisterDeviceNotificationW

advapi32

RegCloseKey RegCreateKeyExW RegNotifyChangeKeyValue SetSecurityDescriptorDacl InitializeSecurityDescriptor RegisterServiceCtrlHandlerExW SetServiceStatus QueryServiceStatus DeleteService ControlService OpenServiceW StartServiceW ChangeServiceConfig2W CreateServiceW OpenSCManagerW StartServiceCtrlDispatcherW CloseServiceHandle RegOpenKeyExW RegEnumValueW RegSetValueExW RegQueryValueExW

shell32

SHCreateDirectoryExW SHGetFolderPathW

ole32

CoInitializeEx CoUninitialize CoCreateInstance CLSIDFromString CoTaskMemFree

oleaut32

SysStringLen SysAllocStringLen SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

185311

PE Signature issue

shlwapi

setupapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic