swflash[.]cab | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
swflash.cab
Size 225KB
Sample260619-wwpsrabw21
SHA256 eea074db3f86fed73a36d9e6c734af8080a4d2364e817eecd5cb37cb9ec9dc0b
MD5 b3e138191eeca0adcc05cb90bb4c76ff
SHA1 2d83b50b5992540e2150dfcaddd10f7c67633d2c
SHA512 82b4c76201697d7d25f2e4f454aa0dd8d548cdfd3ebfa0dd91845536f74f470e57d66a73750c56409510d787ee2483839f799fef5d5a77972cd4435a157a21a4
SSDEEP 6144:vaSusyjE8qpy5T52Advnoa7lsyxrXGbUG0y75HkF:vrRyjRb59xTtXGbmy9e
TLSH
T1DA34124CCF19687016BA8F3DB065D6F842D1F78C4609C6950E3FEA94065E7E31D943AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

swflash.cab

.cab 225KB
FP_AX_CAB_INSTALLER64.exe

.exe 757KB
swflash64.inf

218B

swflash.cab

SHA256 eea074db3f86fed73a36d9e6c734af8080a4d2364e817eecd5cb37cb9ec9dc0b
MD5 b3e138191eeca0adcc05cb90bb4c76ff
SHA1 2d83b50b5992540e2150dfcaddd10f7c67633d2c
SHA512 82b4c76201697d7d25f2e4f454aa0dd8d548cdfd3ebfa0dd91845536f74f470e57d66a73750c56409510d787ee2483839f799fef5d5a77972cd4435a157a21a4
SSDEEP 6144:vaSusyjE8qpy5T52Advnoa7lsyxrXGbUG0y75HkF:vrRyjRb59xTtXGbmy9e
TLSH
T1DA34124CCF19687016BA8F3DB065D6F842D1F78C4609C6950E3FEA94065E7E31D943AB
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

a5ac2338f161f770097561f7a13930745f3bdb86ccc5bf66ad37fcdd22c1eb18

Digest Algorithm

sha256

Digest Matches

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 24, 2020

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

0d:2c:ac:cd:3e:9e:ec:06:73:84:10:ba:31:bf:65:95

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 31, 2019 - Feb 3, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

FP_AX_CAB_INSTALLER64.exe

IMPHASH c1be9c728b397b56da39d1bd446310a2
SHA256 c8c8cff5dc0a3f205e59f0bbfe30b6ade490c10b9ecc7043f264ec67ef9b6a11
MD5 47f240e7f969bc507334f79b42b3b718
SHA1 8ec5c3294b3854a32636529d73a5f070d5bcf627
SHA512 10999161970b874db326becd51d5917f17fece7021e27b2c2dfbee42cb4e992c4d5dbeac41093a345ad098c884f6937aa941ec76fb0c9587e9470405ecb67161
SSDEEP 12288:7is1VxmuejWRd56dN/hDeNh6jUVyTkTcAAAAAAAAAAAAAAAXAbAAAAAAAAAAAAAm:7is1Vxmueq6eb6jPTkG9
TLSH
T175F48411A3F99EA1C5A239F84563A7D507B93F5A0E3AC1ED5F833D4CD834A4349386E2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

29:90:99:99:59:12:46:64:ae:30:2e:9f:d6:f6:97:71:87:95:90:d9:16:45:f8:7f:93:ee:a9:13:30:40:7b:dd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

Chains

Nov 24, 2020

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

0d:2c:ac:cd:3e:9e:ec:06:73:84:10:ba:31:bf:65:95

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 31, 2019 - Feb 3, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

167051

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\r\ws\St_Make\code\build\win\int\Morphology.build\Release\Win32\Morpheme.pdb

kernel32

GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileExW GetVersionExA WideCharToMultiByte SetThreadLocale GetUserDefaultUILanguage CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateThread ExitThread QueueUserAPC ReleaseMutex GetFileSize ReadFile CreateWaitableTimerW SetWaitableTimer FreeResource LockResource TerminateProcess Sleep LoadResource SizeofResource WriteFile SetFilePointer FindResourceW GetThreadLocale CreateProcessW LoadLibraryA OutputDebugStringW FindResourceA GetSystemDirectoryA InterlockedIncrement InterlockedDecrement GlobalAddAtomW DecodePointer HeapReAlloc SetFileAttributesW FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA SetEndOfFile WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW GetACP GetStdHandle GetModuleFileNameA GetModuleHandleExW GetFileType GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx DuplicateHandle LoadLibraryExW TlsFree TlsSetValue TlsGetValue CreateFileW MultiByteToWideChar RemoveDirectoryW CreateDirectoryW SetDllDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW GetSystemWow64DirectoryW GetTempFileNameW GetSystemDirectoryW GetEnvironmentVariableW GetCommandLineW GetModuleHandleW GetModuleFileNameW LoadLibraryW CreateMutexW SystemTimeToFileTime GetSystemTime CloseHandle FindClose GetFileSizeEx WaitForSingleObject GetLastError GetExitCodeProcess ExitProcess GetCurrentProcessId GetCurrentProcess OpenProcess GetProcessHeap HeapFree HeapAlloc LocalFree LocalAlloc GetProcAddress FreeLibrary HeapSize TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError RaiseException EncodePointer RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter

user32

MessageBoxW GetForegroundWindow EndPaint LoadStringW DrawTextW SetRect ClientToScreen LoadCursorW GetWindow GetParent SetWindowLongW GetWindowLongW FillRect MapWindowPoints SetCursor GetWindowRect SetWindowPos SetWindowTextW GetPropW SetPropW InvalidateRect GetClientRect BeginPaint ReleaseDC GetDC SetForegroundWindow SetTimer ReleaseCapture SetCapture GetKeyState MoveWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW DispatchMessageW TranslateMessage GetMessageW

gdi32

SetTextColor SetBkMode GetTextExtentExPointW CreateFontA CreateDIBSection StretchBlt SelectObject DeleteObject DeleteDC CreateSolidBrush CreateCompatibleDC BitBlt CreateCompatibleBitmap

advapi32

RegSetValueExW RegQueryValueExW RegDeleteValueW OpenServiceW OpenSCManagerW ControlService CloseServiceHandle CryptHashData CryptGetHashParam CryptReleaseContext RegSetValueExA RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegEnumKeyExW RegCreateKeyExW RegCloseKey CheckTokenMembership FreeSid AllocateAndInitializeSid

shell32

ord680 CommandLineToArgvW SHFileOperationW ShellExecuteExW ShellExecuteW SHGetFolderPathW

ole32

CoInitializeEx StringFromGUID2 CoCreateGuid CoInitializeSecurity CoCreateInstance CoInitialize CoUninitialize

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

swflash.cab

FP_AX_CAB_INSTALLER64.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic

swflash64.inf