real10g[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
real10g.exe
Size 9.7MB
Sample260625-bfa97sgx2s
SHA256 6576f613a955d9a69567de1760b33963101ff1cdb625c03693544a18641993e1
MD5 e2778fbe44bb68f75d4c4d8fab7975a0
SHA1 605505def3bac480e9b474689a5d7142cc458bb7
SHA512 c038ff084d433767d77a745d9f0f8a0e82fed321f8ba289d47fa90db52b9621ff615e70181e82ea3edeb55952af7627ae00abce1d41028f8db6ce64beb2ba6c6
SSDEEP 196608:A+Je0+0Z55d2t1sVkQDw3zYln/+RyM8vDznzC8VR:ve0+Ejd2/Gw3s8yM8vDznm8v
TLSH
T19DA63323F18280B2C547057509BA7BBABB7D9A145A229BC353F4FC445F363E4E63B225
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
real10g.exe

File Explorer

real10g.exe

.exe 9.7MB

real10g.exe

IMPHASH 6c68f9ff49325f05596f4fa76ff44763
SHA256 6576f613a955d9a69567de1760b33963101ff1cdb625c03693544a18641993e1
MD5 e2778fbe44bb68f75d4c4d8fab7975a0
SHA1 605505def3bac480e9b474689a5d7142cc458bb7
SHA512 c038ff084d433767d77a745d9f0f8a0e82fed321f8ba289d47fa90db52b9621ff615e70181e82ea3edeb55952af7627ae00abce1d41028f8db6ce64beb2ba6c6
SSDEEP 196608:A+Je0+0Z55d2t1sVkQDw3zYln/+RyM8vDznzC8VR:ve0+Ejd2/Gw3s8yM8vDznm8v
TLSH
T19DA63323F18280B2C547057509BA7BBABB7D9A145A229BC353F4FC445F363E4E63B225
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

db:f3:f1:f4:b0:49:dd:eb:aa:90:04:81:c6:07:b8:cc

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=RealNetworks\, Inc.,OU=Software Product Development,O=RealNetworks\, Inc.,L=Seattle,ST=Washington,C=US

Chains

Jan 1, 0001

Subject

CN=RealNetworks\, Inc.,OU=Software Product Development,O=RealNetworks\, Inc.,L=Seattle,ST=Washington,C=US

Serial Number

3d:39:a5

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Sep 17, 2003 - Sep 15, 2004

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Aug 6, 2003 - Aug 5, 2013

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Minor OS version

Major OS version

Entry point

55925

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetErrorMode FreeLibrary GetProcAddress GetVersionExA RemoveDirectoryA DeleteFileA LoadLibraryA GetLastError GetFileAttributesA CreateDirectoryA MoveFileA GetSystemInfo GetVersion GetDriveTypeA FindNextFileA SetUnhandledExceptionFilter TerminateThread WaitForSingleObject CreateThread SetCurrentDirectoryA GetCurrentDirectoryA SetFilePointer GetCurrentProcess GetCurrentProcessId GetThreadContext VirtualQuery IsBadWritePtr OpenProcess GlobalMemoryStatus FindClose GetTempPathA FindFirstFileA GetModuleFileNameA GetWindowsDirectoryA GetDiskFreeSpaceA GetTickCount InterlockedDecrement InterlockedIncrement CreateFileA WriteFile CloseHandle FreeResource FindResourceA LoadResource SizeofResource LockResource LocalAlloc LocalLock LocalUnlock LocalFree FileTimeToSystemTime HeapAlloc GetOEMCP SetEndOfFile SetEnvironmentVariableA CompareStringW HeapFree GetCurrentThreadId HeapReAlloc SetStdHandle VirtualAlloc FlushFileBuffers GetStringTypeW GetStringTypeA LCMapStringA MultiByteToWideChar LCMapStringW ReadFile RaiseException RtlUnwind VirtualFree InitializeCriticalSection HeapDestroy GetEnvironmentVariableA HeapCreate TlsGetValue SetLastError TlsAlloc TlsSetValue SetEnvironmentVariableW GetFullPathNameA FileTimeToLocalFileTime GetModuleHandleA GetStartupInfoA GetCommandLineA ExitProcess EnterCriticalSection LeaveCriticalSection SetFileAttributesA GetCPInfo GetACP CompareStringA FreeEnvironmentStringsA UnhandledExceptionFilter DeleteCriticalSection GetTimeZoneInformation GetSystemTime GetLocalTime TerminateProcess HeapSize GetFileType FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle

user32

DispatchMessageA TranslateMessage CharUpperA DefWindowProcA GetMessageA PostThreadMessageA DestroyWindow CreateWindowExA RegisterClassA PeekMessageA PostQuitMessage IsDialogMessageA SetWindowTextA MessageBoxA LoadStringA FindWindowA GetSysColor IsWindow CreateDialogIndirectParamA GetParent SetWindowPos GetWindowRect ReleaseDC SystemParametersInfoA CharPrevA CharNextA GetSystemMetrics LoadIconA SendMessageA SendDlgItemMessageA InvalidateRect UpdateWindow EndDialog CharLowerA GetDC

advapi32

RegCloseKey RegSetValueExA RegCreateKeyA RegOpenKeyExA RegCreateKeyExA RegDeleteKeyA RegQueryValueExA RegEnumKeyExA RegOpenKeyA RegQueryValueA RegSetValueA RegDeleteValueA RegEnumKeyA

gdi32

CreateSolidBrush DeleteObject SetBkColor SetTextColor GetDeviceCaps

comctl32

ord17

version

GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

real10g.exe

PE Signature issue

kernel32

user32

advapi32

gdi32

comctl32

version

generic