c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0.bin
Size 33.9MB
Sample260529-c2fbqabs2j
SHA256 c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0
MD5 667ead6e36314bd21b1fa1fb9f1960b6
SHA1 b14ecebb5df15c8ab0f11663d419c2ccb1944760
SHA512 d8b8f8b128439ae512275a69ec56fdc139c45dbca735077cd287ed6494559a6f497992cf897c68be781149bb88f5461582c35127500f0dcc2549d2de958a5493
SSDEEP 393216:16Csu5h4Lj92HygC5Ou2hFJ4X5g/nC1utUUplcc+Z0B1+IgWxlq5L0acaoaSOXEJ:10urM5oGiQV0B1+IgWx0tHcuUDF
TLSH
T10A77AE17B294C095D1B6D134C62287B6EB717C1AD72196CB37AC7E163F332E08A3A791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0.bin

File Explorer

c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0.bin

.exe 33.9MB
dropper.pyc

1KB

c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0.bin

IMPHASH 7f6374fa43fb59c8c933315a94a24259
SHA256 c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0
MD5 667ead6e36314bd21b1fa1fb9f1960b6
SHA1 b14ecebb5df15c8ab0f11663d419c2ccb1944760
SHA512 d8b8f8b128439ae512275a69ec56fdc139c45dbca735077cd287ed6494559a6f497992cf897c68be781149bb88f5461582c35127500f0dcc2549d2de958a5493
SSDEEP 393216:16Csu5h4Lj92HygC5Ou2hFJ4X5g/nC1utUUplcc+Z0B1+IgWxlq5L0acaoaSOXEJ:10urM5oGiQV0B1+IgWx0tHcuUDF
TLSH
T10A77AE17B294C095D1B6D134C62287B6EB717C1AD72196CB37AC7E163F332E08A3A791
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

6b:1c:7a:e1:14:de:1a:58:f2:1f:37:b2:03:ac:ae:62:92:23:14:10

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91130900335872388P,CN=Hebei Yingtong Pipeline Co.\, Ltd.,O=Hebei Yingtong Pipeline Co.\, Ltd.,L=Cangzhou,ST=Hebei,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 1, 0001

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

Serial Number

7f:71:af:69:23:30:00:2e:03:e1:31:1e:b8:a8:b7:e0

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Jul 4, 2024

Timespan

Jul 4, 2024 - Jul 4, 2025

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

56:b6:29:cd:34:bc:78:f6

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2017 - May 30, 2042

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Minor OS version

Major OS version

Entry point

43824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetWindowThreadProcessId ShowWindow

kernel32

GetModuleFileNameW CreateSymbolicLinkW GetProcAddress GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW GetTempPathW WaitForSingleObject Sleep GetExitCodeProcess CreateProcessW SetDllDirectoryW FreeLibrary LoadLibraryExW SetConsoleCtrlHandler FindClose FindFirstFileExW CloseHandle GetCurrentProcess GetCurrentProcessId LocalFree FormatMessageW MultiByteToWideChar WideCharToMultiByte GetConsoleWindow HeapSize GetLastError WriteConsoleW SetEndOfFile GetStartupInfoW TlsGetValue UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc DecodePointer TlsSetValue TlsFree EncodePointer RaiseException GetCommandLineA CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW RemoveDirectoryW FindNextFileW SetStdHandle DeleteFileW ReadFile GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc CompareStringW LCMapStringW GetCurrentDirectoryW FlushFileBuffers HeapReAlloc GetFileAttributesExW GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation

advapi32

ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

Sharing

General

Malware Config

Signatures

File Explorer

c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0.bin

PE Signature issue

user32

kernel32

advapi32

generic

dropper.pyc