tmpa_igs4bf

Sharing

Copy URL Twitter E-mail

General

Target
tmpa_igs4bf
Size 16.7MB
Sample260601-rhmc9ae18x
SHA256 c36338fbc2b1913fd79443706dedbc9f58adcfaf5af1dab06a592446e8f6dec6
MD5 da67abcb5edaabd2eb3c39758ca3eca2
SHA1 88e3ce4eaa10b8b5ab36b97083432b7f0e5a07ce
SHA512 e55263c47e2bd030f459a5fd381c85da0c457560346a7502b5142cbf9c70439dea460074a5679e0a3830b6ac494c188affae7aa1d3334574a9cc8bb005e17c4b
SSDEEP 393216:5wald/I8JD71Q5ndRKfvVrbQRHQcS7yvfvvtS:5LH/PG5DavlQRw7y34
TLSH
T1210712137690803DE5BA02704C5FAE6491A97D734A318157F6E0FF1D2DF1982BA27B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
tmpa_igs4bf

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
tmpa_igs4bf

File Explorer

tmpa_igs4bf

.exe 16.7MB

IMPHASH f052f84efefe84f64ac7fab273eb8464
SHA256 c36338fbc2b1913fd79443706dedbc9f58adcfaf5af1dab06a592446e8f6dec6
MD5 da67abcb5edaabd2eb3c39758ca3eca2
SHA1 88e3ce4eaa10b8b5ab36b97083432b7f0e5a07ce
SHA512 e55263c47e2bd030f459a5fd381c85da0c457560346a7502b5142cbf9c70439dea460074a5679e0a3830b6ac494c188affae7aa1d3334574a9cc8bb005e17c4b
SSDEEP 393216:5wald/I8JD71Q5ndRKfvVrbQRHQcS7yvfvvtS:5LH/PG5DavlQRw7y34
TLSH
T1210712137690803DE5BA02704C5FAE6491A97D734A318157F6E0FF1D2DF1982BA27B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

97:06:6d:aa:a5:54:5d:e5:df:79:4b:6e:4c:4d:2e:87:c5:fb:20:3a:b8:7a:b9:90:9f:b3:32:64:75:59:82:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=1247700784583,CN=MIKA LLC,O=MIKA LLC,STREET=ul Vysokaya\, 12 pomeshch 14/1,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 9, 2025

Subject

Serial Number

15:36:33:37:ce:1f:dc:16:44:4d:8d:f3

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Feb 8, 2025

Timespan

Dec 30, 2024 - Dec 31, 2025

Subject

CN=Certum Timestamp 2025,O=Asseco Data Systems S.A.,C=PL

Serial Number

9e:9c:04:f6:55:a8:b4:a7:02:6d:49:8c:6c:78:8d:aa

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 9, 2025 - Jan 7, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

276167

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\CodeBases\isdev\redist\Language Independent\i386\ISP\setup.pdb

comctl32

ord17

kernel32

GetProcessHeap CopyFileW GetSystemDefaultUILanguage GlobalAlloc GlobalFree MulDiv GetLocaleInfoW WideCharToMultiByte lstrcpyA GetTickCount ExitThread CreateThread GetExitCodeProcess WaitForSingleObject ReadFile GetCommandLineW GetVersionExW GetTempPathW CreateFileW LoadLibraryA GetSystemDirectoryA HeapFree GlobalUnlock GlobalLock SizeofResource LockResource LoadResource MultiByteToWideChar FormatMessageW VerLanguageNameW GetWindowsDirectoryW HeapAlloc SetFileAttributesW GetFileTime FileTimeToLocalFileTime GetCurrentDirectoryW SetCurrentDirectoryW ExpandEnvironmentStringsW GetUserDefaultLangID GetSystemDefaultLangID CompareStringA CompareStringW IsBadReadPtr MoveFileW GetPrivateProfileIntW LoadLibraryW lstrcatW lstrcpynW lstrcmpiW LoadLibraryExW FreeLibrary FindResourceExW FreeResource GetPrivateProfileSectionNamesA GetPrivateProfileStringA GetPrivateProfileIntA lstrcatA lstrcmpiA FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW SetFilePointerEx GetConsoleMode GetConsoleCP UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery GetSystemInfo GetSystemTimeAsFileTime CreateEventW CreateMutexW ReleaseMutex DeleteCriticalSection InitializeCriticalSectionAndSpinCount QueryPerformanceFrequency SetErrorMode RaiseException WriteFile SetFilePointer GetFileSize GetFileAttributesW GetDiskFreeSpaceExW GetDiskFreeSpaceW FindFirstFileW FindClose FindResourceW CreateDirectoryW GetSystemDirectoryW InterlockedDecrement InterlockedIncrement SetLastError GetLastError RemoveDirectoryW DeleteFileW lstrlenW lstrcpyW GetProcAddress GetModuleHandleW GetModuleFileNameW CreateProcessW Sleep CloseHandle LocalFree IsValidLocale FreeEnvironmentStringsW GetEnvironmentStringsW GetFileType HeapReAlloc GetStdHandle HeapSize ReadConsoleW GetModuleHandleExW ExitProcess GetStringTypeW GetCurrentThreadId GetCPInfo GetOEMCP IsValidCodePage GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter GetACP IsProcessorFeaturePresent IsDebuggerPresent RtlUnwind MoveFileExW FindNextFileW lstrcmpW GetCurrentThread QueryPerformanceCounter lstrcmpA SystemTimeToFileTime ResetEvent SetEvent GetDateFormatW GetTimeFormatW GetTempFileNameW CompareFileTime SetFileTime TerminateProcess InterlockedExchange LoadLibraryExA EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer LCMapStringW GetVersion GetCurrentProcessId GetLocalTime lstrlenA GetProcessTimes OpenProcess GetCurrentProcess

user32

PeekMessageW DispatchMessageW TranslateMessage LoadIconW SetWindowLongW GetWindowLongW MessageBoxW GetWindowRect SetWindowTextW SetForegroundWindow SetActiveWindow SetDlgItemTextW GetDlgItem EndDialog wsprintfW WaitForInputIdle DialogBoxIndirectParamW MoveWindow DrawIcon SystemParametersInfoW GetWindow FillRect GetSysColor MapWindowPoints RemovePropW GetPropW SetPropW EndPaint BeginPaint EnableMenuItem GetSystemMetrics SetFocus ExitWindowsEx CharUpperW wsprintfA CallWindowProcW CreateWindowExW PostMessageW DrawTextW UpdateWindow GetWindowDC InvalidateRect DrawFocusRect CopyRect InflateRect EnumChildWindows GetClassNameW MapDialogRect RegisterClassExW GetDlgItemTextW IntersectRect MonitorFromPoint DefWindowProcW GetMessageW LoadStringW LoadImageW ReleaseDC GetDC CreateDialogParamW GetParent GetWindowTextW CharNextW GetDesktopWindow GetClientRect IsWindowEnabled CreateDialogIndirectParamW IsWindowVisible IsDialogMessageW FindWindowExW ScreenToClient EnableWindow MsgWaitForMultipleObjects SendDlgItemMessageW SetWindowPos ShowWindow DestroyWindow IsWindow SendMessageW

gdi32

SetTextColor SetBkMode SetBkColor SaveDC RestoreDC CreateSolidBrush UnrealizeObject CreateHalftonePalette GetDIBColorTable SelectPalette SelectObject RealizePalette GetSystemPaletteEntries GetDeviceCaps DeleteDC CreatePalette CreateCompatibleDC BitBlt GetObjectW TranslateCharsetInfo DeleteObject CreateFontIndirectW CreateCompatibleBitmap CreateDCW CreatePatternBrush GetStockObject GetTextExtentPoint32W DeleteMetaFile CreateDIBitmap CreateBitmap CreateRectRgn PatBlt PlayMetaFile SelectClipRgn SetMapMode SetMetaFileBitsEx SetPixel StretchBlt SetStretchBltMode SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx TextOutW

advapi32

RegEnumValueW RegQueryValueExW SetEntriesInAclW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateWellKnownSid RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegOpenKeyW OpenProcessToken AdjustTokenPrivileges AllocateAndInitializeSid FreeSid LookupPrivilegeValueW RegEnumKeyW OpenThreadToken GetTokenInformation EqualSid

shell32

ShellExecuteExW SHGetMalloc SHGetFolderPathW SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoInitializeEx CreateStreamOnHGlobal CoInitializeSecurity CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoUninitialize

oleaut32

VarUI4FromStr VariantInit VariantClear VariantChangeType VarBstrCat VarBstrCmp SysAllocString SysFreeString SysStringLen SysAllocStringLen SysReAllocStringLen SysStringByteLen GetErrorInfo SysAllocStringByteLen

shlwapi

PathFileExistsW

rpcrt4

UuidCreate RpcStringFreeW UuidToStringW

gdiplus

GdipGetImageWidth GdipGetImageHeight GdipAlloc GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromResource GdipCreateFromHDC GdipDeleteGraphics GdipSetInterpolationMode GdipDrawImageRectI

Sharing

General

Malware Config

Signatures

File Explorer

tmpa_igs4bf

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

rpcrt4

gdiplus

generic