e22e47fd6888fcbdc6792b81dbedaedd72996f2be7113c8a113fa6f5070c88b7

Sharing

Copy URL Twitter E-mail

General

Target
e22e47fd6888fcbdc6792b81dbedaedd72996f2be7113c8a113fa6f5070c88b7
Size 547KB
Sample260706-e6nvrshy3s
SHA256 e22e47fd6888fcbdc6792b81dbedaedd72996f2be7113c8a113fa6f5070c88b7
MD5 d6ad66f88b3c625443374ee203bbe169
SHA1 3700780bb7060c9afa5c73f25ab5c6109a161f08
SHA512 2bf5beac144068169ccf8b95292281e99d75f5d3d3b229b054a1b9735fb0a0a0f299c00758e7071e146a7e32eb23a59fa705dd04f9d7528b6a5febda78be39f4
SSDEEP 12288:oWPminMf8r2dkie2D3JEljdwKrikjUXz0jXTzr5Y5ObDKHBjvrEH784s:vPmino8r4zD3JW+rEH70
TLSH
T1D6C4F70167FA5264F1F22F70387A4296493ABD756F75C0CF7250A50E2835A93AB38B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
e22e47fd6888fcbdc6792b81dbedaedd72996f2be7113c8a113fa6f5070c88b7

File Explorer

e22e47fd6888fcbdc6792b81dbedaedd72996f2be7113c8a113fa6f5070c88b7

.dll 547KB

e22e47fd6888fcbdc6792b81dbedaedd72996f2be7113c8a113fa6f5070c88b7

IMPHASH 8d109f409f704fa7a531485927d1365a
SHA256 e22e47fd6888fcbdc6792b81dbedaedd72996f2be7113c8a113fa6f5070c88b7
MD5 d6ad66f88b3c625443374ee203bbe169
SHA1 3700780bb7060c9afa5c73f25ab5c6109a161f08
SHA512 2bf5beac144068169ccf8b95292281e99d75f5d3d3b229b054a1b9735fb0a0a0f299c00758e7071e146a7e32eb23a59fa705dd04f9d7528b6a5febda78be39f4
SSDEEP 12288:oWPminMf8r2dkie2D3JEljdwKrikjUXz0jXTzr5Y5ObDKHBjvrEH784s:vPmino8r4zD3JW+rEH70
TLSH
T1D6C4F70167FA5264F1F22F70387A4296493ABD756F75C0CF7250A50E2835A93AB38B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c1:0c:64:03:ad:8f:2d:76:4c:fe:ab:93:50:ea:39:78:f4:66:0f:af:eb:59:23:c2:25:ef:3e:1d:a6:95:5a:58

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=schinagl.priv.at,O=schinagl.priv.at,POSTALCODE=8046,STREET=Sonnenhang 14,L=Graz,ST=Styria,C=AT

Chains

Jan 17, 2021

CN=schinagl.priv.at,O=schinagl.priv.at,POSTALCODE=8046,STREET=Sonnenhang 14,L=Graz,ST=Styria,C=AT

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=schinagl.priv.at,O=schinagl.priv.at,POSTALCODE=8046,STREET=Sonnenhang 14,L=Graz,ST=Styria,C=AT

Serial Number

27:2b:d8:f7:7a:18:da:16:94:d4:00:6c:c1:11:74:8d

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 14, 2019 - Oct 13, 2022

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

Major OS version

Entry point

209339

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\data\cpp\git\hardlinks\Bin\Win32\Release\HardlinkShellExt.pdb

shlwapi

PathCompactPathExW PathSkipRootW PathStripToRootW PathRemoveExtensionW PathFindExtensionW PathCombineW PathCanonicalizeW PathRemoveFileSpecW PathRemoveBackslashW StrStrIW PathRelativePathToW PathIsRelativeW PathFindFileNameW PathAddBackslashW PathIsRootW PathIsUNCW

user32

EmptyClipboard SetClipboardData CloseClipboard GetClipboardData MessageBoxW wsprintfW SendMessageW GetParent SetDlgItemTextW GetDlgItemTextW GetDlgItem ShowWindow UpdateWindow SetWindowLongW GetWindowTextLengthW GetWindowLongW GetWindowRect InsertMenuW RegisterClipboardFormatW IsClipboardFormatAvailable OpenClipboard CreatePopupMenu InsertMenuItemW

oleaut32

SysAllocString

ole32

ReleaseStgMedium CoCreateInstance CoUninitialize CoInitialize

mpr

WNetGetUniversalNameW WNetGetResourceInformationW

ntdll

NtQuerySecurityObject NtSetEaFile NtQueryEaFile NtQueryInformationFile NtSetInformationFile NtSetSecurityObject NtQueryDirectoryFile NtOpenFile RtlDosPathNameToNtPathName_U

netapi32

NetShareGetInfo

shell32

SHGetPathFromIDListW ord680 SHCreateItemFromParsingName ShellExecuteW ShellExecuteExW DragQueryFileW

msvcp140

_Mtx_destroy_in_situ _Mtx_init_in_situ _Mtx_unlock ?_Throw_C_error@std@@YAXH@Z _Mtx_lock ?_Xout_of_range@std@@YAXPBD@Z ?global@locale@std@@SA?AV12@ABV12@@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?uncaught_exception@std@@YA_NXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ??0_Locinfo@std@@QAE@HPBD@Z ??1_Locinfo@std@@QAE@XZ ?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z ?_Xruntime_error@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegSetValueExW OpenProcessToken GetTokenInformation LookupAccountSidW ConvertSidToStringSidW ReadEncryptedFileRaw OpenEncryptedFileRawW WriteEncryptedFileRaw CloseEncryptedFileRaw LookupPrivilegeValueW PrivilegeCheck AdjustTokenPrivileges

kernel32

FindClose IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA VirtualQuery VirtualProtect RaiseException FreeLibrary GetFileSize LockResource LoadResource FindResourceW FindResourceExW FindNextFileNameW FindFirstFileNameW UnmapViewOfFile MapViewOfFileEx QueryDosDeviceW MoveFileW OutputDebugStringA LoadLibraryW CreateFileMappingW SetEndOfFile SetFilePointerEx GetFileSizeEx CreateEventW SetEvent WriteFile FileTimeToSystemTime SystemTimeToFileTime GetExitCodeProcess LoadLibraryA GetProcAddress GetModuleHandleW GetModuleHandleA SetLastError GetModuleFileNameW GetVolumeInformationW FormatMessageW LocalFree DeleteFileW SetFileAttributesW CreateDirectoryW GlobalUnlock GlobalLock GlobalAlloc lstrcpynA GetLocalTime WaitForSingleObject GetFileAttributesW GetLastError RemoveDirectoryW lstrcpynW GetVersionExW CreateFileW GetFileInformationByHandle CloseHandle CreateHardLinkW CreateSymbolicLinkW FindFirstFileW FindNextFileW DeviceIoControl GetDriveTypeW GetVolumeNameForVolumeMountPointW SetVolumeMountPointW GetVolumePathNamesForVolumeNameW DeleteVolumeMountPointW GetFullPathNameW CreateThread Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetFileAttributesExW GetTempPathW GetCurrentProcess LocalAlloc GetSystemInfo WaitForMultipleObjects

vcruntime140

__CxxFrameHandler3 __std_terminate wcsstr wcsrchr __std_exception_destroy __std_exception_copy _except_handler4_common _CxxThrowException __std_type_info_destroy_list memset memcpy memmove

api-ms-win-crt-string-l1-1-0

wcsncpy_s strcpy_s towlower iswctype towupper wcstok_s wcsncat_s wcscat_s wcscpy_s wcsncpy _wcsicmp _wcslwr_s _towlower_l wcsncmp

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _initterm_e _configure_narrow_argv _register_onexit_function _errno _cexit _execute_onexit_table _invalid_parameter_noinfo_noreturn _initterm _initialize_onexit_table _crt_atexit _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

fclose _wfopen_s __stdio_common_vfwprintf __stdio_common_vsprintf_s __stdio_common_vfprintf __acrt_iob_func __stdio_common_vswprintf_s

api-ms-win-crt-filesystem-l1-1-0

_wstat64i32 _wsplitpath

api-ms-win-crt-heap-l1-1-0

realloc free calloc malloc _callnewh

api-ms-win-crt-convert-l1-1-0

_wtoi

Sharing

General

Malware Config

Signatures

File Explorer

e22e47fd6888fcbdc6792b81dbedaedd72996f2be7113c8a113fa6f5070c88b7

PE Signature issue

shlwapi

user32

oleaut32

ole32

mpr

ntdll

netapi32

shell32

msvcp140

advapi32

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

generic