30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

Sharing

Copy URL Twitter E-mail

General

Target
30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
Size 128KB
Sample260706-h4eqvsbs2x
SHA256 30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
MD5 231ce1e1d7d98b44371ffff407d68b59
SHA1 25510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA512 520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
SSDEEP 3072:zar2xXibKcf5K67+k02XbFbosspwUUgcR:Nibl7+k02XZb9UA
TLSH
T1D9D3F817FB9068D9E4FA873188B74326BB72FB94275247CF051881161E233CA8F75A9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

.exe 128KB

30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

IMPHASH ae602ececd2a94196c949ced947dec0b
SHA256 30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
MD5 231ce1e1d7d98b44371ffff407d68b59
SHA1 25510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA512 520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
SSDEEP 3072:zar2xXibKcf5K67+k02XbFbosspwUUgcR:Nibl7+k02XZb9UA
TLSH
T1D9D3F817FB9068D9E4FA873188B74326BB72FB94275247CF051881161E233CA8F75A9D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

e1:81:a6:6e:5b:9b:f1:1b:1c:24:88:34:bd:9f:cc:ec:ad:9f:86:03:2d:9a:35:58:95:75:7f:bb:17:3e:26:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2014

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 1, 2014 - Oct 1, 2015

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:00:4f:ad:e8:54:95:50:28:94:67:00:00:00:00:00:4f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 23, 2014 - Aug 23, 2015

Minor OS version

Major OS version

Entry point

105248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

easinvoker.pdb

advapi32

TraceMessage RegGetValueW OpenProcessToken OpenThreadToken GetTokenInformation MakeAbsoluteSD ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW GetTraceEnableFlags GetTraceLoggerHandle UnregisterTraceGuids GetTraceEnableLevel RegisterTraceGuidsW GetLengthSid CopySid CreateWellKnownSid GetSecurityDescriptorDacl RegOpenKeyExW RegCreateKeyExW RegCloseKey RegQueryInfoKeyW RegEnumValueW RegOpenKeyExA RegQueryValueExA RegDeleteValueW PrivilegeCheck CheckTokenMembership RegSetValueExW EventUnregister EventRegister

kernel32

GetModuleHandleW SetUnhandledExceptionFilter Sleep QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount UnhandledExceptionFilter TerminateProcess LocalAlloc FreeLibrary LoadLibraryExW GetProcAddress CreateFileW GetSystemWindowsDirectoryW HeapAlloc HeapFree GetProcessHeap GetComputerNameExW LocalFree CloseHandle CreateEventW GetLastError GetCurrentThread SetEvent WaitForSingleObject GetCurrentProcess GetVersionExW

msvcrt

??3@YAXPEAX@Z ??2@YAPEAX_K@Z _vsnwprintf _XcptFilter _amsg_exit _wcsnicmp _wcsicmp memcpy _purecall _wtoi __wgetmainargs __set_app_type exit _exit _cexit __setusermatherr _initterm __C_specific_handler _fmode _commode _lock _unlock __dllonexit _onexit ?terminate@@YAXXZ memset

ntdll

RtlSubAuthorityCountSid NtOpenProcessToken RtlCopySid RtlLengthSid RtlGetNtProductType RtlInitUnicodeString RtlSubAuthoritySid RtlInitializeSid RtlDeleteResource RtlReleaseResource RtlAcquireResourceExclusive RtlEqualSid RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtDuplicateToken NtQueryInformationToken NtQuerySystemInformation NtGetCachedSigningLevel RtlInitializeResource NtOpenThreadToken NtClose

ole32

CoReleaseServerProcess CoInitializeSecurity CoTaskMemFree CoTaskMemAlloc CoRevokeClassObject CoRegisterClassObject CoCreateInstance CoInitializeEx CoUninitialize CoAddRefServerProcess

user32

SystemParametersInfoW UpdatePerUserSystemParameters

rpcrt4

RpcBindingCreateW RpcBindingBind I_RpcExceptionFilter RpcSsDestroyClientContext RpcBindingFree RpcStringBindingComposeW RpcBindingFromStringBindingW RpcStringFreeW NdrClientCall3 I_RpcMapWin32Status

samlib

SamFreeMemory SamConnect SamOpenDomain SamCloseHandle SamQuerySecurityObject SamQueryInformationUser SamOpenUser SamQueryInformationDomain

winbio

WinBioGetLogonSetting WinBioGetEnabledSetting WinBioRemoveAllCredentials WinBioGetDomainLogonSetting

samcli

NetUserGetInfo

netutils

NetApiBufferFree

authz

AuthzFreeContext AuthzAccessCheck AuthzAddSidsToContext AuthzInitializeContextFromSid AuthzInitializeResourceManager AuthzFreeResourceManager

Name

.text

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.imrsiv

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

1KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

advapi32

kernel32

msvcrt

ntdll

ole32

user32

rpcrt4

samlib

winbio

samcli

netutils

authz

generic