190010

Sharing

Copy URL Twitter E-mail

General

Target
190010
Size 2.1MB
Sample260427-psa2vset7j
SHA256 20b3c6e8136e1476d58db048c96ae98ad5f207c74b49fbe4ddc6e7fd920c1107
MD5 ac8ec6525651bb427c34ee4372fe84b0
SHA1 d7107aee05307cdee6092216c7fc49d37ba35035
SHA512 5b7ad138c70b41fcab61b927cf9242c6ae2b62d982db23135fae8cadb068b781b1a2049d16412eaa72029aa6a16967bc557406efa9cc4548801719c99ce245bb
SSDEEP 6144:+Gu/+FYYGBRK9sBM0S8Mv8vs7ZprtJGpuoRMqeOBKBwqqOCrEDwKcmRZCZB+pqOV:+GuUYjTBuPph8pW0gWqW4Dw8fCHhs
TLSH
T1A7A5DD3036FA6208D9765B701D3AA2C526BB7E777F04CA2D6459021CED33A538B11BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

190010

.dll 2.1MB

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 20b3c6e8136e1476d58db048c96ae98ad5f207c74b49fbe4ddc6e7fd920c1107
MD5 ac8ec6525651bb427c34ee4372fe84b0
SHA1 d7107aee05307cdee6092216c7fc49d37ba35035
SHA512 5b7ad138c70b41fcab61b927cf9242c6ae2b62d982db23135fae8cadb068b781b1a2049d16412eaa72029aa6a16967bc557406efa9cc4548801719c99ce245bb
SSDEEP 6144:+Gu/+FYYGBRK9sBM0S8Mv8vs7ZprtJGpuoRMqeOBKBwqqOCrEDwKcmRZCZB+pqOV:+GuUYjTBuPph8pW0gWqW4Dw8fCHhs
TLSH
T1A7A5DD3036FA6208D9765B701D3AA2C526BB7E777F04CA2D6459021CED33A538B11BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

b6:89:23:46:b8:91:5f:9c:0f:1f:ae:f6:1f:3f:47:4c:22:93:47:ae:45:c3:93:04:e2:ae:6e:bf:a9:17:4f:d4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 26, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

d0:2c:55:c5:9b:b1:89:1a:83:e8:6f:ec:34:ef:68:97:7c:ce:8e:ac

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 26, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9d:42:68:ee:31:1c:d7:56:bd:00:00:00:00:00:9d

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:89:49:f5:0c:e4:f1:8b:94:b3:00:00:00:00:00:89

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 30, 2016 - Jun 30, 2017

Minor OS version

Major OS version

Entry point

2141966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

190010

PE Signature issue

mscoree

dotnet