tmp5wiq383v

Sharing

Copy URL Twitter E-mail

General

Target
tmp5wiq383v
Size 266KB
Sample260602-flvy1sft2k
SHA256 1883662353b22c7a25924fa469446dba17bca0bbb7a39f10a4a98b00a3dba33a
MD5 005b406a682e79ea6c6792c0fb1961ae
SHA1 b87685dfda7a8600d737674b58d957148050d2b0
SHA512 91c00be50acab1c3531e9a839841ad309126390ba091f0b681d370e353ba0eb75490a050ff678ad8ef04539123809a6c8d2b5c40ffb67811309ee58a2758db98
SSDEEP 6144:jr6ijXWSYPgQ9PTG/QfWUUQGeT//5mgWui4ksbiuEm++:jtXWS67w/QeUUQf/5mgbkHo++
TLSH
T167440242A2DCE279FC8FA1304382FA3BDA3EE8F24D06F56398424509B9567776371572
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
tmp5wiq383v

File Explorer

tmp5wiq383v

.exe 266KB

IMPHASH ff7f9586e5be16b05fe10e23464ce776
SHA256 1883662353b22c7a25924fa469446dba17bca0bbb7a39f10a4a98b00a3dba33a
MD5 005b406a682e79ea6c6792c0fb1961ae
SHA1 b87685dfda7a8600d737674b58d957148050d2b0
SHA512 91c00be50acab1c3531e9a839841ad309126390ba091f0b681d370e353ba0eb75490a050ff678ad8ef04539123809a6c8d2b5c40ffb67811309ee58a2758db98
SSDEEP 6144:jr6ijXWSYPgQ9PTG/QfWUUQGeT//5mgWui4ksbiuEm++:jtXWS67w/QeUUQf/5mgbkHo++
TLSH
T167440242A2DCE279FC8FA1304382FA3BDA3EE8F24D06F56398424509B9567776371572
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

68:4f:db:05:81:c5:1b:47:a1:d8:90:11:d2:76:16:da:d1:40:79:3b

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=ArcaBit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ArcaBit,O=ArcaBit Ltd.,L=Warsaw,ST=Warsaw,C=PL

Chains

Oct 15, 2009

CN=ArcaBit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ArcaBit,O=ArcaBit Ltd.,L=Warsaw,ST=Warsaw,C=PL

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=ArcaBit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ArcaBit,O=ArcaBit Ltd.,L=Warsaw,ST=Warsaw,C=PL

Serial Number

11:b4:d9:2c:db:bc:4d:35:f7:96:eb:93:94:cb:f8:3d

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 11, 2009 - Oct 1, 2012

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

Major OS version

Entry point

48294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

GetDeviceCaps

kernel32

IsProcessorFeaturePresent EnterCriticalSection RaiseException FreeLibrary UnhandledExceptionFilter HeapReAlloc HeapAlloc SizeofResource DeleteCriticalSection SetLastError FindResourceW CloseHandle IsDebuggerPresent FindResourceExW OutputDebugStringW VirtualFree GetSystemTimeAsFileTime ProcessIdToSessionId LoadLibraryExW SetUnhandledExceptionFilter VirtualAlloc LeaveCriticalSection HeapSize OpenProcess HeapFree LoadResource ReadFile WaitForSingleObject GetProcessHeap lstrlenW GetModuleHandleW LockResource FlushInstructionCache GetCurrentThreadId FormatMessageW LocalFree LocalAlloc QueryPerformanceFrequency CreateFileW GetFileSize HeapDestroy WideCharToMultiByte lstrcmpiW GetFullPathNameA VirtualAllocEx

oleaut32

VarUI4FromStr

user32

MapWindowPoints GetWindowRect UnregisterClassA ReleaseDC InvalidateRect SetWindowsHookExW TrackPopupMenu GetDesktopWindow GetWindow SetTimer GetCursorPos RegisterClassExW GetForegroundWindow GetClassInfoExW SetWindowPos IsDialogMessageW IsWindow PeekMessageW UnhookWindowsHookEx AppendMenuW PostThreadMessageW GetClientRect SetMenuInfo GetWindowLongW LoadCursorW CallWindowProcW DestroyMenu MonitorFromPoint LoadImageW GetDoubleClickTime PostQuitMessage AttachThreadInput IsWindowVisible SetWindowTextW DispatchMessageW ShowWindow DestroyWindow IsChild AllowSetForegroundWindow PostMessageW GetDC SetMenuDefaultItem MonitorFromWindow GetMonitorInfoW SetWindowLongW LoadMenuW SendMessageW GetParent GetWindowThreadProcessId SystemParametersInfoW SetForegroundWindow LoadAcceleratorsW CallNextHookEx LoadIconW WaitForInputIdle RegisterWindowMessageW CreateWindowExW CharNextW TranslateMessage FindWindowW GetSystemMetrics DefWindowProcW GetMessageW CreateMenu LoadStringW KillTimer

ole32

OleUninitialize CoTaskMemAlloc StringFromCLSID PropVariantClear CoCreateInstance CoTaskMemRealloc CoTaskMemFree OleInitialize

atl

AtlModuleInit AtlAxGetControl DllGetClassObject AtlModuleExtractCreateWndData AtlUnmarshalPtr AtlModuleRegisterWndClassInfoA AtlModuleRegisterWndClassInfoW

upnphost

DllRegisterServer ServiceMain DllGetClassObject DllCanUnloadNow

Name

.rpoJsSv

Size

2KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.text

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.gsNz

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ABWmj

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.umGUGts

Size

512B

Virtual Size

313B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dHzlnvk

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

8KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.BLAdep

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

209KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.HLOV

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.TJdzA

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gUbLH

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ygLJlSm

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.JnTc

Size

512B

Virtual Size

439B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmp5wiq383v

PE Signature issue

gdi32

kernel32

oleaut32

user32

ole32

atl

upnphost

generic