185374

Sharing

Copy URL Twitter E-mail

General

Target
185374
Size 903KB
Sample260424-mt9kpse19y
SHA256 0bf977f8ca85503fc9500067fd7269f7def7ce1cae1478bb518a281e94eb4701
MD5 5b62eefc4c32004c1c66b25feea73658
SHA1 a3b0d759bce016fd504cc9ef2694c4bf632c4bdb
SHA512 6a9d106bcf040f7ada34e81d483ec64df89882a6573a85496698b420bfe7281fd71672752e217175cae00f3f2fb287698e29195fb322a6adda8d6db713d077e5
SSDEEP 12288:wM3T9qaKpUfcL1P3cUSA+xr7MzILAFso0mQVZIs49enZzecCIn80e/LT+:iaKGJlZrfASoDQvIs494CInde/LT+
TLSH
T12A157C733DADE07ACB8E4331A91DB31B20B9673399B1C91B27B86F5D2FB41526108D16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

185374

.dll 903KB

IMPHASH 8240007a4ce5bc30c91f79307a1e3ec9
SHA256 0bf977f8ca85503fc9500067fd7269f7def7ce1cae1478bb518a281e94eb4701
MD5 5b62eefc4c32004c1c66b25feea73658
SHA1 a3b0d759bce016fd504cc9ef2694c4bf632c4bdb
SHA512 6a9d106bcf040f7ada34e81d483ec64df89882a6573a85496698b420bfe7281fd71672752e217175cae00f3f2fb287698e29195fb322a6adda8d6db713d077e5
SSDEEP 12288:wM3T9qaKpUfcL1P3cUSA+xr7MzILAFso0mQVZIs49enZzecCIn80e/LT+:iaKGJlZrfASoDQvIs494CInde/LT+
TLSH
T12A157C733DADE07ACB8E4331A91DB31B20B9673399B1C91B27B86F5D2FB41526108D16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

99:5b:d9:a6:39:a0:20:e4:f0:30:0f:47:68:5f:1e:e6:0c:b4:06:24:6b:13:1a:df:5a:2b:c1:6d:0b:47:a0:ee

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

11:af:5b:35:dc:19:60:ea:e2:3d:16:f5:2d:08:cf:1f:c0:9d:f5:ce

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:52:9a:3b:23:aa:dc:7f:b4:6f:00:00:00:00:00:52

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 20, 2015 - Jun 20, 2016

Minor OS version

Major OS version

Entry point

673759

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mscordbi.pdb

msvcrt

strncmp wcscat_s _except_handler4_common _vsnwprintf_s ?terminate@@YAXXZ strcpy_s ??1type_info@@UAE@XZ _initterm _amsg_exit _XcptFilter wcscpy_s wcsncat_s strrchr wcsnlen malloc strchr free _vsnprintf_s strncpy_s _wsplitpath_s _wmakepath_s bsearch qsort printf _errno wcstoul wcsrchr _snwprintf_s memcpy_s wcsncpy_s memmove _purecall _wcsicmp _CxxThrowException __CxxFrameHandler3 memcmp memcpy memset

oleaut32

CreateErrorInfo VariantInit SetErrorInfo

api-ms-win-core-synch-l1-1-0

CreateMutexW CreateSemaphoreExW WaitForSingleObjectEx WaitForSingleObject DeleteCriticalSection ReleaseSemaphore WaitForMultipleObjectsEx ReleaseMutex LeaveCriticalSection ResetEvent SetEvent EnterCriticalSection InitializeCriticalSection CreateEventW SleepEx

api-ms-win-core-libraryloader-l1-1-0

GetModuleFileNameW LoadLibraryExW GetModuleHandleW FreeLibrary GetProcAddress

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException

api-ms-win-core-processthreads-l1-1-0

OpenThread TlsAlloc SuspendThread TerminateProcess CreateThread TlsGetValue TlsSetValue GetCurrentThreadId GetCurrentProcess SwitchToThread OpenProcessToken CreateProcessW GetCurrentProcessId ResumeThread TlsFree

api-ms-win-core-processthreads-l1-1-1

OpenProcess SetThreadContext FlushInstructionCache GetThreadContext

api-ms-win-core-debug-l1-1-1

DebugActiveProcess WaitForDebugEvent ContinueDebugEvent DebugActiveProcessStop

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges

api-ms-win-core-file-l1-1-0

GetFileSize CreateFileW WriteFile GetFileAttributesExW SetFilePointer FlushFileBuffers ReadFile

api-ms-win-core-memory-l1-1-0

MapViewOfFile CreateFileMappingW UnmapViewOfFile ReadProcessMemory WriteProcessMemory VirtualProtect VirtualAlloc VirtualQuery VirtualFree VirtualQueryEx

api-ms-win-core-com-l1-1-0

IIDFromString CoCreateGuid CoTaskMemAlloc CreateStreamOnHGlobal CoTaskMemFree CoCreateFreeThreadedMarshaler

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-heap-l1-1-0

HeapValidate GetProcessHeap HeapFree HeapCreate HeapAlloc HeapDestroy

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount GetSystemInfo

api-ms-win-core-registry-l1-1-0

RegCloseKey RegOpenKeyExW RegQueryValueExW

api-ms-win-core-debug-l1-1-0

DebugBreak

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

GetACP IsDBCSLeadByte FormatMessageW GetCPInfo LCMapStringEx

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-core-stringloader-l1-1-1

LoadStringW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

Sharing

General

Malware Config

Signatures

File Explorer

185374

PE Signature issue

msvcrt

oleaut32

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-stringloader-l1-1-1

api-ms-win-core-profile-l1-1-0

generic