tmpmmnvvy9m

Sharing

Copy URL Twitter E-mail

General

Target
tmpmmnvvy9m
Size 205KB
Sample260602-eqkheadw5x
SHA256 16eb78957dc05a8fefabbc5e63f82f715ea9077404a6bbb09333559fed9e8de1
MD5 dbb3f3485253ad102e2b7ebac51f234c
SHA1 cee68e03ef6444b8af899c40b90e97c64b9bac5a
SHA512 8507930587180f0a15a1976e8ef71eb285a930446deab77128239d1a47e8172bb7471d51d81d7405e9dbbeef76e6267d301989b71c1bbdcaae1ebf8373b8e093
SSDEEP 3072:qO/6nl92ILkt6i2ox7c39b1a0J86W8xXCKNWOHU/ezYMVWtG4SPUkxbgl:qgFtboVBJtNWyPnYG4fUbk
TLSH
T1952412B33B944017CD5DEF7785ABB3050B39E11B2E51C2270414846C6EA6BF17FAAA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
tmpmmnvvy9m

File Explorer

tmpmmnvvy9m

.exe 205KB

IMPHASH 430af33f4ce9475c62e2d9321d894f4c
SHA256 16eb78957dc05a8fefabbc5e63f82f715ea9077404a6bbb09333559fed9e8de1
MD5 dbb3f3485253ad102e2b7ebac51f234c
SHA1 cee68e03ef6444b8af899c40b90e97c64b9bac5a
SHA512 8507930587180f0a15a1976e8ef71eb285a930446deab77128239d1a47e8172bb7471d51d81d7405e9dbbeef76e6267d301989b71c1bbdcaae1ebf8373b8e093
SSDEEP 3072:qO/6nl92ILkt6i2ox7c39b1a0J86W8xXCKNWOHU/ezYMVWtG4SPUkxbgl:qgFtboVBJtNWyPnYG4fUbk
TLSH
T1952412B33B944017CD5DEF7785ABB3050B39E11B2E51C2270414846C6EA6BF17FAAA1E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

91:d4:94:59:58:c4:e3:47:2d:1f:6f:82:8b:f0:14:26:31:82:ba:31

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=BITDEFENDER LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BITDEFENDER LLC,L=Fort Lauderdale,ST=Florida,C=US

Chains

May 7, 2010

CN=BITDEFENDER LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BITDEFENDER LLC,L=Fort Lauderdale,ST=Florida,C=US

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=BITDEFENDER LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BITDEFENDER LLC,L=Fort Lauderdale,ST=Florida,C=US

Serial Number

1c:2d:d6:1a:35:e6:5d:f6:29:97:01:ff:9b:e5:ca:44

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 20, 2010 - Jan 24, 2012

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

Major OS version

Entry point

6863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVersionExA OpenMutexW LocalAlloc lstrcatW FindAtomW GetAtomNameA GetCurrentThread InitializeCriticalSection CompareStringA WinExec lstrcpy GetComputerNameA GetExpandedNameA FileTimeToDosDateTime GetAtomNameW SetUnhandledExceptionFilter GetLongPathNameA DuplicateHandle SetLastError SetThreadPriority GlobalGetAtomNameW SearchPathA IsBadCodePtr CreateNamedPipeA GetStartupInfoW GetTempPathA GetLogicalDrives FindAtomA GetSystemDefaultLCID GetProcAddress GetModuleHandleA FindResourceA GetTimeFormatW GetHandleInformation EndUpdateResourceA GetProcessHeap CreateMailslotW GetThreadLocale GetExpandedNameW SetCalendarInfoA GetCurrentDirectoryA OpenEventA GetLogicalDriveStringsA lstrcmp ExitThread GetVersionExW CreateSemaphoreA

user32

GetDCEx LoadCursorA CreatePopupMenu GetCapture CreateCaret LoadBitmapW TrackPopupMenu DefFrameProcW GetAsyncKeyState CharUpperA CreateDesktopW CreateAcceleratorTableW MessageBoxIndirectW SetCursorPos InsertMenuW DeleteMenu InvalidateRgn mouse_event ActivateKeyboardLayout PeekMessageA ReleaseDC CopyIcon CharUpperW MonitorFromWindow LoadMenuIndirectA CreateWindowExA GetMenuItemInfoW LoadCursorW CopyImage IsChild MoveWindow CharLowerW EndDialog DefDlgProcW GetActiveWindow DestroyWindow CheckMenuRadioItem SetCursor MonitorFromRect CreateDialogIndirectParamW EnableMenuItem SetDlgItemTextW UpdateWindow LoadIconA ArrangeIconicWindows SendMessageW EmptyClipboard GetMessageA SetWindowPos

gdi32

RemoveFontResourceExW SetPaletteEntries EnumObjects StrokeAndFillPath GetEnhMetaFileHeader RestoreDC CreateMetaFileW Polygon GetBkMode SetLayout TranslateCharsetInfo PolyBezierTo

advapi32

RegCreateKeyExA RegCreateKeyW RegReplaceKeyW

comdlg32

ReplaceTextA FindTextW FindTextA

oleaut32

VarBoolFromDisp GetRecordInfoFromGuids LoadTypeLib

version

VerInstallFileW GetFileVersionInfoSizeA

urlmon

ReleaseBindInfo BindAsyncMoniker HlinkGoForward CDLGetLongPathNameW URLDownloadA CompareSecurityIds IsAsyncMoniker URLOpenPullStreamA URLOpenStreamW RegisterFormatEnumerator

winmm

mmTaskCreate midiInGetID NotifyCallbackData midiOutMessage

inetcomm

MimeOleSMimeCapsToDlg MimeOleSetBodyPropA MimeOleSetDefaultCharset DllGetClassObject

oledlg

OleUIChangeSourceA OleUIAddVerbMenuA OleUIInsertObjectW OleUIPasteSpecialA

Name

.text

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.MBqyqw

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Xp

Size

1KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.iVZWys

Size

2KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.av

Size

4KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.TD

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CXg

Size

512B

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CDN

Size

512B

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

162KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmpmmnvvy9m

PE Signature issue

kernel32

user32

gdi32

advapi32

comdlg32

oleaut32

version

urlmon

winmm

inetcomm

oledlg

generic