tmpg9jl4bj8

Sharing

Copy URL Twitter E-mail

General

Target
tmpg9jl4bj8
Size 201KB
Sample260602-e4hkzae17n
SHA256 0031ad68c8a06a67df9b998820cde8e0731481c8a7a3ca9148aed4395c522239
MD5 76fb653be8c51cb3d344a56ed57598b1
SHA1 7b6e0d242e37f31500c5c4db9b0c71180efb3175
SHA512 ef893283a868ae7c280aff293bb62446c2b5d893d8adc41041d8cf78e3c50ac26d5bd7937ec4e732ea149c7009ab6a3e12f6e600fea0bbefb0fc443a992f5885
SSDEEP 6144:Zt++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:2+cff22qZhZcKYhc/
TLSH
T1FA14127313098DA2DD120EB741F1D74219FAE638A3E0D18B6625058B3D56BA33D6CE2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
tmpg9jl4bj8

File Explorer

tmpg9jl4bj8

.exe 201KB

IMPHASH 98aa7065495f35513795744857924eba
SHA256 0031ad68c8a06a67df9b998820cde8e0731481c8a7a3ca9148aed4395c522239
MD5 76fb653be8c51cb3d344a56ed57598b1
SHA1 7b6e0d242e37f31500c5c4db9b0c71180efb3175
SHA512 ef893283a868ae7c280aff293bb62446c2b5d893d8adc41041d8cf78e3c50ac26d5bd7937ec4e732ea149c7009ab6a3e12f6e600fea0bbefb0fc443a992f5885
SSDEEP 6144:Zt++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:2+cff22qZhZcKYhc/
TLSH
T1FA14127313098DA2DD120EB741F1D74219FAE638A3E0D18B6625058B3D56BA33D6CE2F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d6:74:57:84:89:b0:4d:66:bc:4c:5e:6e:d3:3a:d7:24

Digest Algorithm

md5

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Trend Micro\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RD,O=Trend Micro\, Inc.,L=Taipei,ST=Taiwan,C=TW

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Trend Micro\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RD,O=Trend Micro\, Inc.,L=Taipei,ST=Taiwan,C=TW

Serial Number

22:5c:8b:52:64:05:84:16:3e:c1:83:50:17:de:d7:81

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 30, 2007 - Feb 15, 2008

Minor OS version

Major OS version

Entry point

7498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenFile IsBadStringPtrW CreateMailslotW GetEnvironmentVariableA GetWindowsDirectoryW SetUnhandledExceptionFilter lstrcpynW GetTempPathW GetLogicalDriveStringsA ConnectNamedPipe lstrcpyn GetProcAddress GetNumberFormatA GetOEMCP OpenMutexW FileTimeToSystemTime CreateEventW GetModuleHandleA CreateSemaphoreW GetLongPathNameW lstrcpy SetCalendarInfoA GetCommandLineW DosDateTimeToFileTime QueryPerformanceFrequency FileTimeToLocalFileTime

user32

IsDlgButtonChecked GetWindowTextA GetWindowLongA GetAsyncKeyState GetActiveWindow MonitorFromRect GetMenuStringA BringWindowToTop CharUpperA CheckMenuItem GetActiveWindow GetDlgItemTextW GetParent UpdateLayeredWindow GetDCEx GetMessageW GetCursorPos LoadMenuA

gdi32

SetArcDirection ColorMatchToTarget ExtFloodFill LPtoDP SetStretchBltMode SetSystemPaletteUse SetMiterLimit ColorCorrectPalette CopyEnhMetaFileW SetWindowExtEx ExtTextOutW FillRgn IntersectClipRect CreateCompatibleDC GetTextColor SetViewportOrgEx RestoreDC PolylineTo

advapi32

RegReplaceKeyA RegRestoreKeyA RegDeleteValueA RegEnumValueW RegCreateKeyExA

shlwapi

UrlCombineA

comctl32

ImageList_SetFlags

wininet

SetUrlCacheEntryInfoA

winspool.drv

ConvertUnicodeDevModeToAnsiDevmode EnumJobsA AdvancedDocumentPropertiesW SplDriverUnloadComplete ExtDeviceMode QuerySpoolMode SetDefaultPrinterA ConfigurePortA GetPrinterDataExW DeviceCapabilitiesA

wsock32

ntohs dn_expand rexec getservbyport GetNameByTypeA

Name

.text

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.WjTd

Size

1KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Grrl

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Lx

Size

1KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eB

Size

1KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmpg9jl4bj8

PE Signature issue

kernel32

user32

gdi32

advapi32

shlwapi

comctl32

wininet

winspool.drv

wsock32

generic