0178153f14fc26f697bd775a8e9c0fecbabff0f762a6908fb18e1cac7dd8efe3

Sharing

Copy URL Twitter E-mail

General

Target
0178153f14fc26f697bd775a8e9c0fecbabff0f762a6908fb18e1cac7dd8efe3
Size 231KB
Sample260703-qvphpsez4m
SHA256 0178153f14fc26f697bd775a8e9c0fecbabff0f762a6908fb18e1cac7dd8efe3
MD5 54acb26b5046f7b4ccdf93e587858c19
SHA1 5b4f91064820b780ecc3ea26cad4026b2f388db7
SHA512 266e583b8b0d52682d52a1780159e44eb86523b9ef0ba6c246d11175ab115f02edb0122edf40ddcf1132ab48bb0b9ff23521ac857973a29b557a658cb8d011df
SSDEEP 3072:AtTvQgnhyAyur2ILSsTP3Qf3XgoWjxGdKA2ca7yVrwr73whXmXtETwzo:OTvP7rr2ILSGP6WWK4aaXPTz
TLSH
T152349D113AD2C833D96301734DD6C7AAB7B6B9526B32858B7BD01F5DAE301D36A39312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
0178153f14fc26f697bd775a8e9c0fecbabff0f762a6908fb18e1cac7dd8efe3

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
0178153f14fc26f697bd775a8e9c0fecbabff0f762a6908fb18e1cac7dd8efe3

File Explorer

0178153f14fc26f697bd775a8e9c0fecbabff0f762a6908fb18e1cac7dd8efe3

.exe 231KB

0178153f14fc26f697bd775a8e9c0fecbabff0f762a6908fb18e1cac7dd8efe3

IMPHASH 4e875a510075e575ad13ae2756950b11
SHA256 0178153f14fc26f697bd775a8e9c0fecbabff0f762a6908fb18e1cac7dd8efe3
MD5 54acb26b5046f7b4ccdf93e587858c19
SHA1 5b4f91064820b780ecc3ea26cad4026b2f388db7
SHA512 266e583b8b0d52682d52a1780159e44eb86523b9ef0ba6c246d11175ab115f02edb0122edf40ddcf1132ab48bb0b9ff23521ac857973a29b557a658cb8d011df
SSDEEP 3072:AtTvQgnhyAyur2ILSsTP3Qf3XgoWjxGdKA2ca7yVrwr73whXmXtETwzo:OTvP7rr2ILSGP6WWK4aaXPTz
TLSH
T152349D113AD2C833D96301734DD6C7AAB7B6B9526B32858B7BD01F5DAE301D36A39312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d2:db:c6:3b:dc:38:d8:af:95:8c:4b:5f:b9:c1:ee:a9:cd:a1:4c:44:34:4a:82:14:6a:df:5b:2c:fb:b7:5c:15

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Acer Incorporated,O=Acer Incorporated,L=New Taipei City,ST=Taiwan,C=TW

Chains

Jul 9, 2015

CN=Acer Incorporated,O=Acer Incorporated,L=New Taipei City,ST=Taiwan,C=TW

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Acer Incorporated,O=Acer Incorporated,L=New Taipei City,ST=Taiwan,C=TW

Serial Number

7e:ca:1b:93:d0:c7:22:26:8f:a6:94:7d:32:3e:38:f3

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Oct 14, 2015

Timespan

Jul 8, 2015 - Sep 25, 2016

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Minor OS version

Major OS version

Entry point

80069

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

y:\OfficialWork\Projects\Gaia\Code\GAIA_Utility\release\RunCmd.pdb

kernel32

TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree WritePrivateProfileStringW GetModuleHandleA GlobalFlags CompareStringW GlobalAddAtomW GetVersionExA LoadLibraryA GlobalFindAtomW GetCommandLineA HeapFree GetSystemTimeAsFileTime RaiseException RtlUnwind ExitProcess HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetStdHandle TlsAlloc GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount LCMapStringA LCMapStringW GetTimeZoneInformation VirtualAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA CreateFileA GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA InitializeCriticalSection GlobalHandle SetConsoleMode ReadConsoleInputA GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc ReleaseMutex CreateMutexW GetFileTime GetFileAttributesW GetCurrentProcessId GetFullPathNameW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale SetErrorMode GlobalFree GlobalUnlock GlobalDeleteAtom GetCurrentThread ConvertDefaultLocale GetVersion EnumResourceLanguagesW LoadLibraryW CompareStringA InterlockedExchange GlobalLock lstrcmpW GlobalAlloc FreeLibrary GetProcAddress SetLastError GetLocalTime GetCurrentThreadId FileTimeToLocalFileTime FileTimeToSystemTime InterlockedIncrement HeapAlloc lstrlenW FormatMessageW GetProcessHeap InterlockedDecrement GetLastError MultiByteToWideChar CloseHandle GetExitCodeProcess WaitForSingleObject CreateProcessW CreateFileW GetModuleFileNameW GetCurrentProcess GetLocaleInfoW FindClose FindNextFileW DeleteFileW FindFirstFileW CreateDirectoryW GetVolumeInformationW WideCharToMultiByte GetCommandLineW GetModuleHandleW AllocConsole SizeofResource LockResource LoadResource FindResourceW SetCurrentDirectoryW GetFileType LocalFree

user32

RegisterWindowMessageW LoadIconW WinHelpW GetCapture GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow GetClientRect GetMenu CreateWindowExW GetClassInfoW RegisterClassW AdjustWindowRectEx CopyRect DefWindowProcW CallWindowProcW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement LoadCursorW GetSysColorBrush GetWindow GetDlgCtrlID PostQuitMessage UnregisterClassA PostMessageW GetSubMenu GetWindowRect GetClassNameW PtInRect SetWindowTextW GetSysColor ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW ShowWindow DestroyMenu GetClassInfoExW GetMenuItemCount GetMenuItemID GetMenuState GetSystemMetrics CharUpperW MessageBoxW EnableWindow IsWindowEnabled GetLastActivePopup GetWindowLongW GetParent SendMessageW GetWindowThreadProcessId GetWindowTextW UnhookWindowsHookEx ValidateRect SetCursor SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos SetWindowLongW

gdi32

GetStockObject Escape DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx ExtTextOutW TextOutW RectVisible PtVisible DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap GetDeviceCaps SelectObject

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegQueryValueW RegEnumKeyW RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegOpenKeyW RegOpenKeyExW RegCloseKey RegQueryValueExW

shell32

SHGetFolderPathW ShellExecuteExW CommandLineToArgvW

shlwapi

PathFindExtensionW PathFindFileNameW PathStripToRootW PathIsUNCW PathFileExistsW

oleaut32

VariantClear VariantChangeType VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

0178153f14fc26f697bd775a8e9c0fecbabff0f762a6908fb18e1cac7dd8efe3

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

generic