81bdf801d09b021882f96d47eb588ddb01c9d088313327bf49f0713bb4bbe922

Sharing

Copy URL Twitter E-mail

General

Target
81bdf801d09b021882f96d47eb588ddb01c9d088313327bf49f0713bb4bbe922
Size 1.1MB
Sample260706-e9sm5adw3k
SHA256 81bdf801d09b021882f96d47eb588ddb01c9d088313327bf49f0713bb4bbe922
MD5 2949be7f8a0ff2fe504cd2394eca9c94
SHA1 2c8e68ef10707504d3377cbb3bb3ba03e9bdfff0
SHA512 c0ec350450703e046cfca8d9409c97d7aa41c6e62afa1f6cf25c54b1532e5bef74892e65a5fba0e2a0299dd706ca83faafc88f61976aabb3c74e4711e985a1a6
SSDEEP 24576:a+uMRS1rkEOwJWPHU/Wb7DDtjVyrfq3sXx6mLjhWuft3UnwTLAZNZMGN0rEH7w:o31rDbWP0/Wb/DtjV8f0ULjhWuflUnwp
TLSH
T1B245AF0375D18075E5B30630A9BDBB25AEFDBA350A32C64E13C82A5E6F71981D73A353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
81bdf801d09b021882f96d47eb588ddb01c9d088313327bf49f0713bb4bbe922

File Explorer

81bdf801d09b021882f96d47eb588ddb01c9d088313327bf49f0713bb4bbe922

.dll 1.1MB

81bdf801d09b021882f96d47eb588ddb01c9d088313327bf49f0713bb4bbe922

IMPHASH 566608fc4e739807cf78f375182a051b
SHA256 81bdf801d09b021882f96d47eb588ddb01c9d088313327bf49f0713bb4bbe922
MD5 2949be7f8a0ff2fe504cd2394eca9c94
SHA1 2c8e68ef10707504d3377cbb3bb3ba03e9bdfff0
SHA512 c0ec350450703e046cfca8d9409c97d7aa41c6e62afa1f6cf25c54b1532e5bef74892e65a5fba0e2a0299dd706ca83faafc88f61976aabb3c74e4711e985a1a6
SSDEEP 24576:a+uMRS1rkEOwJWPHU/Wb7DDtjVyrfq3sXx6mLjhWuft3UnwTLAZNZMGN0rEH7w:o31rDbWP0/Wb/DtjV8f0ULjhWuflUnwp
TLSH
T1B245AF0375D18075E5B30630A9BDBB25AEFDBA350A32C64E13C82A5E6F71981D73A353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b6:0e:7a:1a:0a:f5:6a:9d:0c:e4:3c:dc:47:f9:9b:4b:2a:f1:04:24:be:33:b8:ba:d3:b5:3d:00:52:88:97:91

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US

Chains

May 20, 2026

CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

0e:98:2f:dd:f0:6e:93:e9:11:06:5d:03:7d:4d:d4:82

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 28, 2024 - Aug 6, 2027

Minor OS version

Major OS version

Entry point

630521

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

goopdate_unsigned.pdb

kernel32

TransactNamedPipe SetNamedPipeHandleState VirtualQueryEx WaitNamedPipeW InitOnceComplete InitOnceBeginInitialize CreateDirectoryW SizeofResource SetLastError lstrlenW WriteFile GetPrivateProfileIntW OutputDebugStringA SetFilePointer GetEnvironmentVariableW WaitForSingleObject CreateFileW GetCurrentThreadId ReleaseMutex Sleep GetFileInformationByHandle GetFileAttributesExW OutputDebugStringW LockResource CloseHandle FindResourceExW LoadResource FindResourceW GetLocalTime GetCurrentProcessId lstrcmpiW lstrcmpW FindFirstFileW FindNextFileW GetCurrentProcess RemoveDirectoryW WaitForMultipleObjects FindClose GetFileAttributesW DuplicateHandle FormatMessageW GetCurrentThread DeleteFileW LoadLibraryW GetCurrentDirectoryW GetProcAddress LocalFree GetModuleHandleW FreeLibrary GetTempFileNameW OpenMutexW GetTickCount LoadLibraryExW GetExitCodeProcess ReadFile CompareFileTime SetEndOfFile SetFileAttributesW FileTimeToSystemTime MoveFileExW GetFileSize CopyFileW GetSystemTimeAsFileTime GetFileTime FlushFileBuffers lstrcpynW ExitProcess IsDebuggerPresent WideCharToMultiByte MultiByteToWideChar GetTimeZoneInformation FileTimeToLocalFileTime SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetModuleFileNameW GetTempPathW GetSystemDirectoryW VirtualQuery TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateMutexW CreateEventW SetEvent ResetEvent GetLongPathNameW SetPriorityClass TerminateProcess WaitForMultipleObjectsEx OpenProcess CreateToolhelp32Snapshot ProcessIdToSessionId Process32NextW WaitForSingleObjectEx ReadProcessMemory SetHandleInformation CreatePipe GetSystemPowerStatus GlobalMemoryStatusEx CreateProcessW SetProcessWorkingSetSize GetVersionExW VerSetConditionMask VerifyVersionInfoW LocalAlloc HeapSetInformation GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetStdHandle QueryDosDeviceW GetLogicalDriveStringsW OpenEventW CreateThread SetCurrentDirectoryW OpenThread QueryPerformanceCounter GetCommandLineW GetStringTypeExW GetThreadLocale lstrcmpA GetStringTypeExA SetFilePointerEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead GetStringTypeW TryAcquireSRWLockExclusive CompareStringEx InitializeCriticalSectionEx EncodePointer LCMapStringEx GetCPInfo QueryPerformanceFrequency RtlUnwind InterlockedPushEntrySList InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo VirtualAlloc VirtualProtect GetModuleHandleExW GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFileSizeEx SetStdHandle GetConsoleOutputCP GetConsoleMode ReadConsoleW WriteConsoleW GetProcessId ReleaseSemaphore RtlCaptureContext DeleteTimerQueueTimer CreateTimerQueueTimer LoadLibraryExA VirtualFree FlushInstructionCache InterlockedPopEntrySList MulDiv GlobalHandle CreateTimerQueue DeleteTimerQueueEx GetSystemDefaultLangID GetUserDefaultLangID GetComputerNameExW GetPrivateProfileStringW DeviceIoControl GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount GetSystemTime UnregisterWaitEx RegisterWaitForSingleObject QueueUserWorkItem Thread32First Thread32Next SetProcessShutdownParameters GetProcessShutdownParameters CreateSemaphoreW Process32FirstW HeapFree

oleaut32

SysReAllocStringLen SysAllocString SystemTimeToVariantTime LoadRegTypeLi OleCreateFontIndirect VarBstrCmp VariantChangeType SafeArrayRedim SafeArrayDestroy SafeArrayGetUBound SafeArrayUnlock SafeArrayGetLBound SafeArrayCopy SafeArrayGetVartype SafeArrayLock SafeArrayCreate LoadTypeLi VariantClear VariantInit SysAllocStringLen SysFreeString SysAllocStringByteLen OleLoadPicturePath SysStringLen VarUI4FromStr VariantTimeToSystemTime SysStringByteLen

user32

GetClientRect TranslateMessage MapWindowPoints PeekMessageW GetMonitorInfoW DispatchMessageW CreateWindowExW CloseClipboard EmptyClipboard SetClipboardData SetCapture UnregisterClassW GetParent SetForegroundWindow GetClassNameW SetWindowContextHelpId GetMenuState InflateRect SetActiveWindow OffsetRect IsMenu SetFocus FrameRect IsRectEmpty GetSysColorBrush SystemParametersInfoW UpdateWindow GetCursorPos EnumChildWindows EnableMenuItem EnableWindow IsDialogMessageW GetWindowTextLengthW GetSystemMenu GetFocus GetDC FillRect ScreenToClient EndDialog SetWindowTextW ShowWindow InvalidateRgn MapDialogRect RemoveMenu GetDlgItem GetDesktopWindow CreateDialogIndirectParamW CreateAcceleratorTableW RedrawWindow RegisterWindowMessageW FlashWindow ReleaseCapture PostQuitMessage SetLayeredWindowAttributes OpenClipboard LoadImageW EnumWindows GetSystemMetrics SendMessageW IsWindowVisible GetWindowThreadProcessId PostThreadMessageW CharNextW LoadStringW IsWindow CharLowerBuffA CopyRect CharNextA DestroyIcon ClientToScreen DestroyAcceleratorTable IsChild GetTopWindow GetSysColor MoveWindow InvalidateRect CharUpperW CharLowerW CharLowerBuffW MessageBoxW wvsprintfW wsprintfW GetWindowLongW GetMessageW AllowSetForegroundWindow GetWindow GetWindowRect DestroyWindow SetWindowPos MonitorFromWindow PostMessageW WaitForInputIdle SendDlgItemMessageW CopyImage GetClassInfoExW KillTimer SetWindowLongW LoadCursorW SetTimer RegisterClassExW CallWindowProcW DefWindowProcW CharUpperBuffW GetWindowTextW EndPaint BeginPaint ReleaseDC

iphlpapi

GetIfTable

netapi32

NetGetJoinInformation NetApiBufferFree NetWkstaUserGetInfo NetWkstaGetInfo

psapi

EnumProcesses GetModuleFileNameExW EnumProcessModules

shlwapi

PathAddBackslashW PathRemoveFileSpecW PathRemoveExtensionW PathStripPathW PathCommonPrefixW PathFindFileNameW SHQueryValueExW PathFileExistsW PathAddExtensionW UrlCombineW PathFindExtensionW PathIsDirectoryW PathIsDirectoryEmptyW UrlIsW UrlUnescapeA PathAppendA UrlEscapeW PathCreateFromUrlW PathAppendW PathCanonicalizeW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

userenv

LeaveCriticalPolicySection EnterCriticalPolicySection ExpandEnvironmentStringsForUserW DestroyEnvironmentBlock CreateEnvironmentBlock GetProfileType UnloadUserProfile

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSFreeMemory

advapi32

RegEnumKeyExW ControlService QueryServiceStatus SystemFunction036 DuplicateToken RegOverridePredefKey GetUserNameW SetSecurityDescriptorOwner GetAce RegOpenCurrentUser IsTextUnicode DeregisterEventSource CreateServiceW SetServiceStatus ChangeServiceConfig2W DeleteService RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW QueryServiceConfigW ChangeServiceConfigW QueryServiceConfig2W RegisterEventSourceW ReportEventW TraceEvent GetSecurityInfo CryptAcquireContextW CryptGenRandom CryptReleaseContext GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids GetSidSubAuthorityCount GetSidIdentifierAuthority AllocateAndInitializeSid ImpersonateSelf FreeSid CheckTokenMembership RegNotifyChangeKeyValue RegQueryInfoKeyW RegDeleteKeyW RegCreateKeyExW GetAclInformation RegSetValueExW RegDeleteValueW RegEnumValueW LookupPrivilegeValueW AdjustTokenPrivileges CreateProcessAsUserW ConvertSidToStringSidW DuplicateTokenEx SetSecurityDescriptorDacl RevertToSelf MakeSelfRelativeSD RegQueryValueExW GetSecurityDescriptorLength GetLengthSid RegOpenKeyExW InitializeAcl AddAce IsValidSid GetSecurityDescriptorOwner InitializeSid CopySid GetSecurityDescriptorControl SetNamedSecurityInfoW GetSidLengthRequired GetSidSubAuthority GetSecurityDescriptorGroup RegCloseKey GetSecurityDescriptorDacl GetSecurityDescriptorSacl GetTokenInformation SetSecurityDescriptorGroup MakeAbsoluteSD OpenThreadToken OpenServiceW InitializeSecurityDescriptor StartServiceW OpenProcessToken ImpersonateLoggedOnUser ConvertStringSidToSidW GetNamedSecurityInfoW OpenSCManagerW CloseServiceHandle EqualSid

ntdll

NtDeleteKey

ole32

CoGetCallContext CoRevertToSelf CoTaskMemFree CoSetProxyBlanket IIDFromString CoReleaseServerProcess CoTaskMemAlloc CoInitializeSecurity CoRegisterClassObject CoResumeClassObjects CoImpersonateClient CoTaskMemRealloc CoInitializeEx CoRevokeClassObject CoRegisterPSClsid OleSaveToStream ReadClassStm WriteClassStm CoCreateInstance StringFromGUID2 CoCreateGuid CoSuspendClassObjects CoGetObject CoUninitialize CreateStreamOnHGlobal CoGetClassObject OleUninitialize CLSIDFromProgID OleInitialize CoAddRefServerProcess CLSIDFromString OleLockRunning

shell32

ShellExecuteExW CommandLineToArgvW SHGetFolderPathW ord680

comctl32

InitCommonControlsEx _TrackMouseEvent

crypt32

CryptHashCertificate CryptUnprotectData CryptProtectData CertFreeCertificateContext CryptQueryObject CertDuplicateCertificateContext CertCloseStore CertFindCertificateInStore CertGetNameStringW

msimg32

GradientFill

uxtheme

SetWindowTheme

wininet

InternetCrackUrlW HttpSendRequestW InternetCloseHandle InternetConnectW HttpQueryInfoW InternetQueryDataAvailable InternetReadFile HttpAddRequestHeadersW HttpOpenRequestW InternetOpenW

wintrust

WinVerifyTrust

gdi32

CreateRectRgnIndirect DPtoLP CreateFontIndirectW CreateSolidBrush DeleteObject GetObjectW DeleteDC GetDeviceCaps GetStockObject CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt ExtTextOutW FillRgn CombineRgn SetBkColor SetViewportOrgEx GetRegionData SetTextColor CreateRectRgn OffsetRgn GetTextMetricsW

Sharing

General

Malware Config

Signatures

File Explorer

81bdf801d09b021882f96d47eb588ddb01c9d088313327bf49f0713bb4bbe922

PE Signature issue

kernel32

oleaut32

user32

iphlpapi

netapi32

psapi

shlwapi

version

userenv

wtsapi32

advapi32

ntdll

ole32

shell32

comctl32

crypt32

msimg32

uxtheme

wininet

wintrust

gdi32

generic