pingplotter_v5_23_3-(PRO-Indiana Department of Administration)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
pingplotter_v5_23_3-(PRO-Indiana Department of Administration).exe
Size 20.9MB
Sample260703-dpcwhaay3w
SHA256 36c5eb2e8f95081f40912af74268f78030352cca3cbfc30f0839135ba95b6a42
MD5 9846e17fdb56a7a562422343876c97db
SHA1 4dee26aec0a3b5491da548dfd5894f20b286819a
SHA512 ba874a190ca13d4c71d552e78d7c1348af9e259381868acdcab436a2cec0107a24bdf6cf20571acfa405deb7830ee68f688dbb1ccc95dfab44796d32047de1d3
SSDEEP 393216:7StR9MlyPA/o0rT/cdVgI2uhP7dKdROoIgKaAJN8VgronoK:7Sb9K//3UbhPIugKahdno
TLSH
T15A2733C53293B0D3E2669D70EF965272C00DACD491719E2A7B2EFC3031762A855BBE53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
pingplotter_v5_23_3-(PRO-Indiana Department of Administration).exe
unpack001/$PLUGINSDIR/DotNetChecker.dll
unpack001/$PLUGINSDIR/StdUtils.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsisdl.dll

File Explorer

pingplotter_v5_23_3-(PRO-Indiana Department of Administration).exe

.exe 20.9MB
$PLUGINSDIR/DotNetChecker.dll

.dll 84KB
$PLUGINSDIR/StdUtils.dll

.dll 37KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/nsisdl.dll

.dll 15KB
$_4_

.msi 66.8MB

pingplotter_v5_23_3-(PRO-Indiana Department of Administration).exe

IMPHASH e221f4f7d36469d53810a4b5f9fc8966
SHA256 36c5eb2e8f95081f40912af74268f78030352cca3cbfc30f0839135ba95b6a42
MD5 9846e17fdb56a7a562422343876c97db
SHA1 4dee26aec0a3b5491da548dfd5894f20b286819a
SHA512 ba874a190ca13d4c71d552e78d7c1348af9e259381868acdcab436a2cec0107a24bdf6cf20571acfa405deb7830ee68f688dbb1ccc95dfab44796d32047de1d3
SSDEEP 393216:7StR9MlyPA/o0rT/cdVgI2uhP7dKdROoIgKaAJN8VgronoK:7Sb9K//3UbhPIugKahdno
TLSH
T15A2733C53293B0D3E2669D70EF965272C00DACD491719E2A7B2EFC3031762A855BBE53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW SetFileAttributesW ExpandEnvironmentStringsW SetErrorMode LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW GetCommandLineW GetTempPathW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/DotNetChecker.dll

IMPHASH 97f7d9845e06a5a728269d7279e09e03
SHA256 39c43d67f546fc898f7406d213b73dcb1bc30fc811ddfa3a02b6b50c29d11f91
MD5 f18364fa5084add86c6e73e457404f18
SHA1 6d87c4b9dbf78af88fddf0d4d5febe845c8e4e6a
SHA512 716892492390fe4314f3289286f733d07b8b84de1f5af0676b26e68c0be01808682d35ad2bb9e9491247b7bb5a0ea297a6850e26de9baf88621c789206107db3
SSDEEP 1536:AZBjgSXlkq8su+OudgGpGlmQSMqJS4HGsorJKQUDs0OsWPIcdGbk2HeJ:AYvo7PMqEuiKQGbk2HeJ
TLSH
T14D835B1076D0C1B5E57F1D3948A6D661076EB810EFE4CDEB279A03690E702C1BE3AE23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\sean.fleming\source\repos\NsisDotNetChecker\plugin\Release\DotNetChecker.pdb

kernel32

FreeLibrary LoadLibraryExW GetProcAddress CreateFileW DecodePointer LoadLibraryW GetSystemInfo SetErrorMode lstrcpynW GlobalAlloc WideCharToMultiByte MultiByteToWideChar UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetModuleFileNameA HeapFree HeapAlloc GetStringTypeW GetACP LCMapStringW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetStdHandle GetFileType HeapSize HeapReAlloc SetStdHandle WriteFile FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx CloseHandle WriteConsoleW RaiseException

user32

GetSystemMetrics wsprintfW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

$PLUGINSDIR/StdUtils.dll

IMPHASH dda53b55a0bf89654a47326daafd5297
SHA256 23da25dbf9f9392e29652084881d7ecedec770bc672800d8300b3f902594e890
MD5 0493dcc333f413ae01afb74652128fe8
SHA1 c6c5d131279da08a54efc7ec565ec03863f62baf
SHA512 113c81010a55181d2ed9dd6cf197fc7c14c3caea06fb4bfe56534eb6075969d2ef4a86ab516217c6a26e2eab892c3d5a0d446b80038d5972fbb8ea8e09093f0e
SSDEEP 384:SRHnRp1w0RUPEACdnlfyXNEkbLitX44KmIQxMkioOcJAMzT8P5nwHkzkBOoWzpf3:cRp1kP8NgWk6tohm7xFi4iMfdOoWRA
TLSH
T13703198756B08866F3FA5A71BAFA3E138A7DBD2871E0842E8F53154C4C32261E4553B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10337

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

iswspace _msize ??2@YAPAXI@Z ??3@YAXPAX@Z iswalpha _snprintf swscanf abort iswcntrl _beginthreadex time srand rand iswalnum __wgetmainargs wcsncpy _wcsnicmp wcschr calloc free _wcsicmp _snwprintf memset

shlwapi

ord176

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

GetCommandLineW InterlockedExchange HeapValidate InterlockedDecrement InterlockedIncrement GetSystemTime OutputDebugStringA DeleteCriticalSection GetExitCodeProcess InitializeCriticalSection SystemTimeToFileTime TerminateThread WaitForSingleObject GetProcAddress GetVersion GetFileAttributesW LoadLibraryW GetModuleHandleW FreeLibrary CloseHandle GetFileSizeEx CreateFileW ReadFile WriteFile SetFilePointerEx GlobalAlloc lstrcpynW GlobalFree LeaveCriticalSection EnterCriticalSection GetTickCount Sleep VerSetConditionMask GetVersionExW VerifyVersionInfoW GetLastError LocalAlloc LocalFree

user32

AllowSetForegroundWindow MessageBoxA GetWindowThreadProcessId CreateWindowExW LoadStringW UnregisterClassW SetTimer DestroyWindow wsprintfW MessageBoxW MsgWaitForMultipleObjects PeekMessageW KillTimer DispatchMessageW RegisterClassW

shell32

ShellExecuteExW SHFileOperationW ShellExecuteW

ole32

CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
MD5 ca332bb753b0775d5e806e236ddcec55
SHA1 f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA512 2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
SSDEEP 192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6
TLSH
T1C3325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE20BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisdl.dll

IMPHASH d09878220c1fdc2c2325ac1b89d388da
SHA256 1dd9cf437ce9a98db66d1132c8e116531d0b0c08b06226045652382918a23dbc
MD5 39b76431ab111d118f6759c1946a89b4
SHA1 ae3704cc4d1585c79a0ca5e757c95d5288790b97
SHA512 9d65b6a004c5fbd0e9bfcef5319e32993d41c3023f82bfa4b946cadb6d8946694efec2d6808fba82f3c9542020527b1b80a90f5f043ebaa076fe78d224ee5fe8
SSDEEP 384:shyd8Y6pu8ZaLf6Uksnw1g8BUcyHisU/b:shyd8Y67WGg8B/Eiv
TLSH
T142623C45AA6084F2C7A3167034E33A3E6BB19F751A1485C38BF34D4EAE15307B33A987
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_4_

SHA256 8ada96aca5b85f96d189b1fbc15d911439be1e12a2aa0d2985db19e577373978
MD5 6ef858e8b8574159de4fafcd63a2cc61
SHA1 dab43b1230ddb64004a33b2c167bf9c094737025
SHA512 702b0aa6a9066f81e8eb1464f4e387bf778cbb3f79b5b392fe6aede8e62e2752b70c8704270982173920d4e16bca870dc97925a25e949a70ac2bbd630b624a92
SSDEEP 393216:ieMb+49eAIY8fAhws35V7hMYq64yKccQBDL+7b1h0OTE69JNBpK+mWySbmgVgvft:ibb8Aws/hjNL+7b1zI0FMdVb
TLSH
T16BE7BF0273A48A36C5BF5372A5750A0493B1F5096B13D78F368CE6F91EA37814E217BB
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

1478562c7a9bf812bfe851ad19c26b975968103a0147bcd1b2edc9fc10be76f0

Digest Algorithm

sha256

Digest Matches

Trusted

Prehash

Signing Certificate

CN=Pingman Tools LLC,O=Pingman Tools LLC,L=Boise,ST=Idaho,C=US

Chains

Jun 9, 2022

CN=Pingman Tools LLC,O=Pingman Tools LLC,L=Boise,ST=Idaho,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Pingman Tools LLC,O=Pingman Tools LLC,L=Boise,ST=Idaho,C=US

Serial Number

0e:35:5a:7a:3d:83:43:09:80:be:01:ea:f1:02:fe:83

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 31, 2022 - Apr 3, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

pingplotter_v5_23_3-(PRO-Indiana Department of Administration).exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/DotNetChecker.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/StdUtils.dll

msvcrt

shlwapi

version

kernel32

user32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsisdl.dll

kernel32

user32

advapi32

wsock32

generic

$_4_