bf4aaff92daa9ff45c78f32a18741e1308049fb59027801f029599e9a518a43f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
bf4aaff92daa9ff45c78f32a18741e1308049fb59027801f029599e9a518a43f.exe
Size 2.3MB
Sample260702-hchy7sds71
SHA256 bf4aaff92daa9ff45c78f32a18741e1308049fb59027801f029599e9a518a43f
MD5 77157863615a796b6bf82f7a1dad7d02
SHA1 adb7c8cffe5923152dc4abc294b7ecf404b879d5
SHA512 ba36116dadbecf291c2a042aecadbd0fe0468e3ac9f945bb4127e0d02a4ed645d796a972a6ef0dcea2d0171d7e49600298d5916bddd3702edd0fadbd441f9ce8
SSDEEP 49152:AooV18A9h6xky1tSCfGuLPTEtxwKkcgD5jCL6S3RP:YV189xky1tSCfGyPTEtxwKkcgD5jQhP
TLSH
T1C4B57D137E9240A7D5330638596DF234B3ADBD34293D45FB13D0A6582B379C28929BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
bf4aaff92daa9ff45c78f32a18741e1308049fb59027801f029599e9a518a43f.exe

File Explorer

bf4aaff92daa9ff45c78f32a18741e1308049fb59027801f029599e9a518a43f.exe

.exe 2.3MB

bf4aaff92daa9ff45c78f32a18741e1308049fb59027801f029599e9a518a43f.exe

IMPHASH f65b09086a6b9872c23dbdbcef0bfdbe
SHA256 bf4aaff92daa9ff45c78f32a18741e1308049fb59027801f029599e9a518a43f
MD5 77157863615a796b6bf82f7a1dad7d02
SHA1 adb7c8cffe5923152dc4abc294b7ecf404b879d5
SHA512 ba36116dadbecf291c2a042aecadbd0fe0468e3ac9f945bb4127e0d02a4ed645d796a972a6ef0dcea2d0171d7e49600298d5916bddd3702edd0fadbd441f9ce8
SSDEEP 49152:AooV18A9h6xky1tSCfGuLPTEtxwKkcgD5jCL6S3RP:YV189xky1tSCfGyPTEtxwKkcgD5jQhP
TLSH
T1C4B57D137E9240A7D5330638596DF234B3ADBD34293D45FB13D0A6582B379C28929BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

f6:5c:7f:60:3b:24:6d:1a:88:b3:3e:05:ee:8f:34:a2:6f:af:52:2d:bd:b9:9a:25:e5:ca:11:1a:ec:30:91:63

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=CANON INC.,OU=Digital Printing Business,O=CANON INC.,L=Kawasaki,ST=Kanagawa,C=JP

Chains

Aug 22, 2023

CN=CANON INC.,OU=Digital Printing Business,O=CANON INC.,L=Kawasaki,ST=Kanagawa,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=CANON INC.,OU=Digital Printing Business,O=CANON INC.,L=Kawasaki,ST=Kanagawa,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=CANON INC.,OU=Digital Printing Business,O=CANON INC.,L=Kawasaki,ST=Kanagawa,C=JP

Serial Number

02:d6:56:33:31:3c:85:b3:e3:81:25:6f:15:32:37:b6

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 26, 2022 - Oct 26, 2023

Minor OS version

Major OS version

Entry point

1315180

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\temp\Jenkins_tmp\WorkSpace\CNSG2_v2.33\CNSG2_NW\MakePackage\BootStrapper\Win32\Release\setup.pdb

shell32

SHAppBarMessage CommandLineToArgvW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation DragFinish SHGetDesktopFolder SHGetFileInfoW ShellExecuteW SHBrowseForFolderW DragQueryFileW

msi

ord160 ord118 ord113 ord159 ord32 ord92 ord8

kernel32

GetConsoleMode GetConsoleCP GetTimeZoneInformation LCMapStringW ExitProcess GetStdHandle GetFileType SetStdHandle GetSystemTimeAsFileTime VirtualQuery VirtualAlloc GetSystemInfo HeapQueryInformation GetModuleHandleExW SetFilePointerEx ExitThread CreateThread GetCommandLineA RtlUnwind QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent GetTempFileNameW InitializeSListHead GetStartupInfoW FreeLibraryAndExitThread SystemTimeToTzSpecificLocalTime WriteConsoleW GetFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime SetErrorMode GetProfileIntW GetTickCount GetTempPathW SearchPathW GetWindowsDirectoryW lstrcmpiW DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW FlushFileBuffers FindFirstFileW FindClose DeleteFileW GetFileSize GetFileAttributesW CreateFileW VerifyVersionInfoW VerSetConditionMask lstrcpyW VirtualProtect GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW GlobalFlags FileTimeToSystemTime GlobalGetAtomNameW GetCurrentProcessId LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW ResumeThread SetThreadPriority IsDebuggerPresent CreateEventW SetEvent CompareStringA lstrcmpA GetVersionExW GetCurrentThread InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection CompareStringW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryA GetCurrentThreadId EncodePointer LoadLibraryW GetModuleHandleA FreeResource OutputDebugStringA MultiByteToWideChar WideCharToMultiByte SetLastError CopyFileW FormatMessageW MulDiv GlobalFree GlobalUnlock GlobalLock GlobalSize GlobalAlloc FreeLibrary GetProcAddress LoadLibraryExW GetSystemDirectoryW GetSystemDefaultLangID DeleteCriticalSection DecodePointer RaiseException GetLastError InitializeCriticalSectionEx GetCurrentDirectoryW Sleep CloseHandle WaitForSingleObject CreateProcessW OutputDebugStringW LocalFree GetCommandLineW GetModuleFileNameW GetCurrentProcess IsWow64Process GetModuleHandleW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource LockResource SizeofResource FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW QueryPerformanceFrequency

user32

GetUpdateRect SubtractRect MapVirtualKeyExW IsCharLowerW TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar IsClipboardFormatAvailable SetMenuDefaultItem UpdateLayeredWindow CharUpperBuffW SetRect UnionRect DrawIcon FrameRect CopyIcon SetCursorPos DrawFrameControl DrawEdge GetKeyNameTextW InvertRect HideCaret EnableScrollBar GetIconInfo DrawIconEx DrawFocusRect GetNextDlgGroupItem GetMenuDefaultItem SetClassLongW LockWindowUpdate RegisterClipboardFormatW EnumChildWindows CopyAcceleratorTableW DestroyAcceleratorTable CreateAcceleratorTableW MapVirtualKeyW GetKeyboardState GetKeyboardLayout ToUnicodeEx WaitMessage PostThreadMessageW ModifyMenuW NotifyWinEvent WindowFromPoint SetWindowRgn DeleteMenu GetSystemMenu KillTimer SetTimer SetCapture CharUpperW IsRectEmpty DrawStateW EmptyClipboard SetClipboardData CloseClipboard OpenClipboard EnumDisplayMonitors SetLayeredWindowAttributes MonitorFromPoint SetParent ReuseDDElParam UnpackDDElParam IntersectRect InsertMenuItemW CreatePopupMenu LoadAcceleratorsW ReleaseCapture BringWindowToTop LoadImageW DestroyIcon InvalidateRect TrackMouseEvent MapDialogRect GetAsyncKeyState CopyImage InflateRect GetMenuItemInfoW DestroyMenu RealChildWindowFromPoint FillRect ClientToScreen GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetWindowThreadProcessId LoadCursorW GetSysColorBrush ReleaseDC GetDC GetSystemMetrics SetCursor ShowOwnedPopups GetCursorPos TranslateMessage GetMessageW PostQuitMessage SystemParametersInfoW MessageBeep IsZoomed OffsetRect SetRectEmpty SendDlgItemMessageA LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageW SetWindowTextW GetComboBoxInfo EnableWindow SendMessageW UnregisterClassW GetMenuStringW CheckDlgButton MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo LoadIconW CallNextHookEx UnhookWindowsHookEx GetDoubleClickTime CreateMenu DestroyCursor GetWindowRgn TranslateAcceleratorW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu IsWindow DestroyWindow CreateDialogIndirectParamW EndDialog GetDlgItem GetNextDlgTabItem GetActiveWindow IsWindowEnabled SetActiveWindow GetWindowLongW GetDesktopWindow GetParent LoadMenuW GetWindowRect RegisterWindowMessageW DispatchMessageW PeekMessageW GetMessagePos GetMessageTime PostMessageW DefWindowProcW CallWindowProcW RegisterClassW GetClassInfoW GetWindow GetClassInfoExW CreateWindowExW IsMenu IsChild SetWindowPos GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos IsWindowVisible IsIconic GetDlgCtrlID SetFocus GetFocus GetKeyState GetCapture GetMenu SetMenu TrackPopupMenu UpdateWindow GetForegroundWindow SetForegroundWindow BeginPaint EndPaint ValidateRect RedrawWindow ScrollWindow SetScrollPos GetScrollPos SetScrollRange GetScrollRange ShowScrollBar SetPropW GetPropW RemovePropW GetWindowTextW GetWindowTextLengthW GetClientRect AdjustWindowRectEx MessageBoxW ScreenToClient MapWindowPoints GetSysColor CopyRect EqualRect PtInRect SetWindowLongW GetClassLongW GetClassNameW GetTopWindow GetLastActivePopup SetWindowsHookExW

gdi32

CreateCompatibleBitmap CreateDIBitmap CreateRectRgnIndirect EnumFontFamiliesW GetTextCharsetInfo CombineRgn GetDIBits PatBlt RealizePalette SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateRoundRectRgn GetRgnBox OffsetRgn GetTextColor SetRectRgn DPtoLP EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries GetBkColor CreateEllipticRgn Ellipse CreatePolygonRgn Polygon Polyline LPtoDP GetTextMetricsW Rectangle RoundRect ExtFloodFill SetPaletteEntries GetViewportOrgEx GetWindowOrgEx FillRgn FrameRgn GetBoundsRect PtInRegion GetTextFaceW SetPixelV MoveToEx GetTextExtentPoint32W CreateFontIndirectW ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW CreateHatchBrush SetTextAlign SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetObjectType GetClipBox ExcludeClipRect Escape DeleteObject CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CopyMetaFileW CreateDCW GetDeviceCaps SetBkColor SetTextColor GetObjectW CreateBitmap DeleteDC BitBlt CreateCompatibleDC TextOutW

msimg32

TransparentBlt AlphaBlend

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegEnumValueW RegEnumKeyExW RegSetValueExW RegDeleteValueW RegCreateKeyExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey

shlwapi

PathStripToRootW PathIsUNCW PathFindFileNameW PathFindExtensionW StrFormatKBSizeW PathRemoveFileSpecW

uxtheme

DrawThemeBackground GetCurrentThemeName GetThemeSysColor GetWindowTheme IsAppThemed GetThemePartSize DrawThemeText DrawThemeParentBackground OpenThemeData CloseThemeData GetThemeColor IsThemeBackgroundPartiallyTransparent

ole32

OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator RevokeDragDrop OleLockRunning OleGetClipboard DoDragDrop RegisterDragDrop CoLockObjectExternal CreateStreamOnHGlobal CoInitializeEx CoInitialize CoCreateInstance CoCreateGuid CoUninitialize ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoDisconnectObject

oleaut32

VariantClear VariantChangeType SysAllocString LoadTypeLi SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SysAllocStringLen VariantCopy VarBstrFromDate SysFreeString VariantInit

oleacc

CreateStdAccessibleObject LresultFromObject AccessibleObjectFromWindow

gdiplus

GdipBitmapUnlockBits GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

bf4aaff92daa9ff45c78f32a18741e1308049fb59027801f029599e9a518a43f.exe

PE Signature issue

shell32

msi

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shlwapi

uxtheme

ole32

oleaut32

oleacc

gdiplus

imm32

winmm

generic