sub_9ac629ed8e07[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
sub_9ac629ed8e07.bin
Size 1.1MB
Sample260524-ccvecaey7l
SHA256 9ac629ed8e07b6c99b05edd46b86e1795e5f96908ab1fe85a06282b0a982cd1b
MD5 20017810fba85ef8ac6e4230d0e67a07
SHA1 d7b6530a4c7d685e9ee6765231bab14fecdadeba
SHA512 87e59608b4c13d17279c9d39098564caa4b19419d02c952d754dec02c234f3614c7ab8d5d3153bf7feaea4d42b0b22f2deacc33845a991cdb4e37923c7e99706
SSDEEP 24576:Tus8z4ChDlxLRa9LCdaj3zv6joREW7+3Is6oW:CsOZI5Cd2somQ2IsA
TLSH
T1E1351261BDA0807BD27746305CECBA7156FDEA2213B2820BBB4C26551F706E2D76C367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
sub_9ac629ed8e07.bin

File Explorer

sub_9ac629ed8e07.bin

.exe 1.1MB

sub_9ac629ed8e07.bin

IMPHASH 2e838409987529c95afc2990bcd62f7c
SHA256 9ac629ed8e07b6c99b05edd46b86e1795e5f96908ab1fe85a06282b0a982cd1b
MD5 20017810fba85ef8ac6e4230d0e67a07
SHA1 d7b6530a4c7d685e9ee6765231bab14fecdadeba
SHA512 87e59608b4c13d17279c9d39098564caa4b19419d02c952d754dec02c234f3614c7ab8d5d3153bf7feaea4d42b0b22f2deacc33845a991cdb4e37923c7e99706
SSDEEP 24576:Tus8z4ChDlxLRa9LCdaj3zv6joREW7+3Is6oW:CsOZI5Cd2somQ2IsA
TLSH
T1E1351261BDA0807BD27746305CECBA7156FDEA2213B2820BBB4C26551F706E2D76C367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

be:91:93:80:47:63:42:61:d2:9c:d9:86:b4:29:56:0a:55:ab:4e:2f:ff:ad:b4:61:49:53:ef:8f:39:45:25:bb

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=912 309 975,CN=Vivaldi Technologies AS,O=Vivaldi Technologies AS,STREET=Mølleparken 6,L=Oslo,ST=Oslo,C=NO,1.3.6.1.4.1.311.60.2.1.3=#13024e4f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 31, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

0e:61:94:e2:77:9d:53:1f:89:69:50:ff

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 10, 2023 - Dec 18, 2026

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

122573

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

kernel32

SetLastError GetDiskFreeSpaceExW SetFileAttributesW Sleep GetExitCodeThread CreateThread SystemTimeToFileTime GetLocalTime GetFileAttributesW CreateDirectoryW lstrlenA WriteFile GetStdHandle GetModuleHandleW LockResource LoadResource SizeofResource FindResourceExA MulDiv GlobalFree GlobalAlloc lstrcmpiA GetSystemDefaultLCID GetSystemDefaultUILanguage GetUserDefaultUILanguage MultiByteToWideChar GetLocaleInfoW lstrcmpiW GetEnvironmentVariableW SetCurrentDirectoryW lstrcmpW RemoveDirectoryW FindClose FindNextFileW DeleteFileW FindFirstFileW GetCurrentDirectoryW GetTempPathW WideCharToMultiByte CompareFileTime ExpandEnvironmentStringsW GetSystemTimeAsFileTime SetThreadLocale LoadLibraryA SetEnvironmentVariableW CreateFileW GetDriveTypeW SetProcessWorkingSetSize GetCurrentProcess GetModuleFileNameW GetVersionExW LoadLibraryW CreateEventW SetEvent ResetEvent InitializeCriticalSection GetCurrentThreadId GetSystemDirectoryW TerminateThread SuspendThread GetCommandLineW LocalFree lstrcpyW FormatMessageW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection VirtualAlloc VirtualFree GetFileSize SetFilePointer ReadFile SetFileTime SetEndOfFile GetFileInformationByHandle WaitForMultipleObjects DecodePointer EncodePointer ExitThread RtlUnwind RaiseException HeapAlloc HeapFree HeapReAlloc GetCommandLineA HeapSetInformation HeapSize ExitProcess IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess InitializeCriticalSectionAndSpinCount HeapCreate GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetStringTypeW LCMapStringW GetStartupInfoW CreateProcessW GetLastError CreateJobObjectW ResumeThread AssignProcessToJobObject CreateIoCompletionPort SetInformationJobObject GetQueuedCompletionStatus WaitForSingleObject CloseHandle GetExitCodeProcess GetProcAddress lstrlenW GetTickCount IsBadReadPtr

user32

GetClientRect SetWindowLongW UnhookWindowsHookEx SetFocus GetSystemMetrics SystemParametersInfoW DrawTextW GetDC ClientToScreen GetWindow DialogBoxIndirectParamW DrawIconEx CallWindowProcW DefWindowProcW CallNextHookEx PtInRect SetWindowsHookExW LoadImageW LoadIconW MessageBeep EnableWindow GetDlgItem GetSystemMenu CreateWindowExA wvsprintfW wsprintfW GetParent ScreenToClient CreateWindowExW GetDesktopWindow GetWindowRect SetWindowPos SetTimer GetMessageW DispatchMessageW KillTimer CharUpperW SendMessageW ShowWindow BringWindowToTop EndDialog IsWindow GetKeyState MessageBoxA DestroyWindow GetSysColor SetWindowTextW GetWindowTextW GetWindowTextLengthW wsprintfA GetClassNameA GetWindowLongW GetMenu GetWindowDC ReleaseDC EnableMenuItem CopyImage

gdi32

SelectObject CreateCompatibleDC CreateCompatibleBitmap GetDeviceCaps DeleteObject CreateFontIndirectW SetStretchBltMode StretchBlt GetCurrentObject GetObjectW DeleteDC

advapi32

FreeSid AllocateAndInitializeSid CheckTokenMembership

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc ShellExecuteW SHGetSpecialFolderPathW ShellExecuteExW SHGetFileInfoW

ole32

CoInitialize CreateStreamOnHGlobal CoCreateInstance

oleaut32

OleLoadPicture SysAllocString SysAllocStringLen VariantClear SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

sub_9ac629ed8e07.bin

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic