OpenedFilesView[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
OpenedFilesView.exe
Size 203KB
Sample260628-ep5ryse18k
SHA256 bfb1a374772cccc06440ee3def14d6556d3b51c9e6de95b69917798b235e733b
MD5 7fd126c4884e6d837e2ba80208163cfe
SHA1 ffab981438712d1f5ac681e3ada1c9251efb4134
SHA512 031559ff5b92961ef1575dbe2a5314c91c9712c655d4356d6842aacd6a026be7993bdf5691d2f6440b0a829609ba939acaa5de297162123ed312cfcfb69eca67
SSDEEP 3072:QXRdWqpqvtcwEJrwBvqxuCwcZ29O2653UblfQyR5Tc1e8aMRVUDh0v+U:sJqmlJ529OHmRg1e9I3
TLSH
T1DA144A4673F81198E4B7DA74C9B24A23DBF1B8545A30C35F0BA0899A1F23791FE25727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
sample	Nirsoft

File Explorer

OpenedFilesView.exe

.exe 203KB

OpenedFilesView.exe

IMPHASH 083810189086e24b1701622c1965b81a
SHA256 bfb1a374772cccc06440ee3def14d6556d3b51c9e6de95b69917798b235e733b
MD5 7fd126c4884e6d837e2ba80208163cfe
SHA1 ffab981438712d1f5ac681e3ada1c9251efb4134
SHA512 031559ff5b92961ef1575dbe2a5314c91c9712c655d4356d6842aacd6a026be7993bdf5691d2f6440b0a829609ba939acaa5de297162123ed312cfcfb69eca67
SSDEEP 3072:QXRdWqpqvtcwEJrwBvqxuCwcZ29O2653UblfQyR5Tc1e8aMRVUDh0v+U:sJqmlJ529OHmRg1e9I3
TLSH
T1DA144A4673F81198E4B7DA74C9B24A23DBF1B8545A30C35F0BA0899A1F23791FE25727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.

Digest

d7:d9:60:29:96:c2:76:05:6b:5f:42:be:66:e8:2f:75:ea:41:e9:c6:77:eb:92:c0:b9:3b:d5:8b:6e:b0:15:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

Chains

Aug 31, 2023

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

Serial Number

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 9, 2019 - Sep 9, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

102880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f:\Projects\VS2005\OpenedFilesView\x64\Release\OpenedFilesView.pdb

msvcrt

_initterm __wgetmainargs _wcmdln exit _cexit _exit _c_exit _XcptFilter __C_specific_handler __setusermatherr __dllonexit _msize realloc calloc _wcslwr strlen qsort _purecall modf _wtoi wcstoul _commode _fmode __set_app_type _onexit towupper wcscmp malloc _memicmp free _itow wcsrchr ??3@YAXPEAX@Z ??2@YAPEAX_K@Z memcpy _wcsnicmp memcmp wcsncmp _wcsicmp wcschr wcslen _ultow wcscpy memset wcscat _snwprintf wcsncat

comctl32

ImageList_Add CreateStatusWindowW CreateToolbarEx ImageList_ReplaceIcon ord17 ImageList_Create ImageList_SetImageCount ImageList_AddMasked

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

SetErrorMode GlobalFree DuplicateHandle GetStdHandle GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW ExitProcess ReadProcessMemory TerminateProcess CreateRemoteThread GetStartupInfoW GetProcAddress EnumResourceNamesW DeviceIoControl OpenProcess SystemTimeToFileTime FileTimeToSystemTime GetFileAttributesExW GetCurrentProcessId CompareFileTime GetModuleHandleW LoadLibraryW FreeLibrary GetTickCount GlobalLock GlobalAlloc GlobalUnlock CloseHandle DeleteFileW GetSystemDirectoryW GetFileAttributesW GetTempPathW GetDriveTypeW GetTempFileNameW GetCurrentProcess GetLocaleInfoW GetFileSize CreateDirectoryW SizeofResource GetLastError FormatMessageW GetVersionExW GetTimeFormatW WriteFile ReadFile GetModuleFileNameW FindResourceW LoadResource CreateFileW GetWindowsDirectoryW SystemTimeToTzSpecificLocalTime FileTimeToLocalFileTime LoadLibraryExW GetNumberFormatW lstrlenW LockResource LocalFree WideCharToMultiByte lstrcpyW GetDateFormatW MapViewOfFile UnmapViewOfFile CreateFileMappingW GetLogicalDrives ResumeThread

user32

CreatePopupMenu CallWindowProcW MonitorFromWindow ChildWindowFromPoint ReleaseDC GetDC LoadCursorW GetSysColorBrush SetCursor ShowWindow DrawFrameControl EndDialog GetMonitorInfoW SetWindowTextW GetDlgItem UpdateWindow SendMessageW SetDlgItemTextW GetDlgItemTextW InvalidateRect SetWindowLongPtrW GetSystemMetrics GetWindowPlacement DeferWindowPos GetWindowRect SetDlgItemInt CreateWindowExW GetWindow GetDlgItemInt BeginPaint GetClientRect SetWindowPlacement SendDlgItemMessageW SetWindowPos TranslateAcceleratorW GetForegroundWindow LoadAcceleratorsW DefWindowProcW RegisterClassW MessageBoxW PostMessageW SetMenu SetActiveWindow SetForegroundWindow LoadImageW GetWindowThreadProcessId LoadIconW EnumWindows IsWindowVisible GetSysColor SetWindowLongW GetWindowLongW DestroyIcon SetFocus EndDeferWindowPos BeginDeferWindowPos KillTimer SetTimer GetParent GetClassNameW OpenClipboard CheckMenuItem GetMenuItemCount GetMenuStringW CheckMenuRadioItem SetClipboardData GetCursorPos EnableWindow MapWindowPoints CloseClipboard GetMenu MoveWindow EmptyClipboard EnableMenuItem GetSubMenu GetDesktopWindow DestroyWindow GetWindowTextW LoadMenuW ModifyMenuW GetMenuItemInfoW GetDlgCtrlID DestroyMenu CreateDialogParamW DialogBoxParamW EnumChildWindows LoadStringW GetKeyState IsDialogMessageW SetCapture ReleaseCapture TranslateMessage RegisterWindowMessageW FindWindowW TrackPopupMenu WindowFromPoint PostQuitMessage GetMessageW DispatchMessageW GetFocus EndPaint

gdi32

DeleteObject SetBkMode SetTextColor GetTextExtentPoint32W GetStockObject SetBkColor CreateCompatibleBitmap StretchBlt SetStretchBltMode DeleteDC SetPixel GetPixel SelectObject CreateCompatibleDC GetObjectW CreateFontIndirectW GetDeviceCaps

comdlg32

FindTextW GetSaveFileNameW

advapi32

RegOpenKeyExW RegDeleteKeyW GetTokenInformation OpenProcessToken RegCreateKeyExW RegSetValueExW RegCloseKey

shell32

ShellExecuteExW Shell_NotifyIconW SHGetDesktopFolder SHBindToParent SHGetMalloc SHGetFileInfoW ExtractIconExW ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

OpenedFilesView.exe

msvcrt

comctl32

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

generic