6a6d4d4dc8f3e9c50150d786182e332506a12af9e8f743ff529897eb7d09a940

Sharing

Copy URL Twitter E-mail

General

Target
6a6d4d4dc8f3e9c50150d786182e332506a12af9e8f743ff529897eb7d09a940
Size 3.4MB
Sample260706-j4ftlabz8s
SHA256 6a6d4d4dc8f3e9c50150d786182e332506a12af9e8f743ff529897eb7d09a940
MD5 9219006d7fe46ce63ea3231b904b3b38
SHA1 505e67e610ab47108c4282c1c864c74a8acbb097
SHA512 a1e7e9fdfae90cf53ed40f9c2657d36d5527d36e116f9631b4b22d7f220d604edbc33fddb7512ba7a3cbaee5228b2341e979a65e246f8a1d8faf2895bc6c29c5
SSDEEP 49152:RPRylG9Kwd7yd4SB2ixA04hWfkd+FSwaMmUgXdEfLjexe5H1P:RPRv9KwdudeMFSwaMmUgXAye5R
TLSH
T1B7F5E041FED386B7C98F0879846FB33A9B3694098B20CA87FBE45D35F9523614DE9109
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
6a6d4d4dc8f3e9c50150d786182e332506a12af9e8f743ff529897eb7d09a940

File Explorer

6a6d4d4dc8f3e9c50150d786182e332506a12af9e8f743ff529897eb7d09a940

.exe 3.4MB

6a6d4d4dc8f3e9c50150d786182e332506a12af9e8f743ff529897eb7d09a940

IMPHASH f6de9678691508ce1323e3512d6133ba
SHA256 6a6d4d4dc8f3e9c50150d786182e332506a12af9e8f743ff529897eb7d09a940
MD5 9219006d7fe46ce63ea3231b904b3b38
SHA1 505e67e610ab47108c4282c1c864c74a8acbb097
SHA512 a1e7e9fdfae90cf53ed40f9c2657d36d5527d36e116f9631b4b22d7f220d604edbc33fddb7512ba7a3cbaee5228b2341e979a65e246f8a1d8faf2895bc6c29c5
SSDEEP 49152:RPRylG9Kwd7yd4SB2ixA04hWfkd+FSwaMmUgXdEfLjexe5H1P:RPRv9KwdudeMFSwaMmUgXAye5R
TLSH
T1B7F5E041FED386B7C98F0879846FB33A9B3694098B20CA87FBE45D35F9523614DE9109
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

96:22:a8:1b:89:23:0f:ef:1a:91:fc:3c:9b:d2:1c:31:28:7c:53:3c:9a:5b:94:96:8f:ae:2f:ff:e6:ca:84:e3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024945

Chains

Oct 21, 2024

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024945

Serial Number

37:c5:0a:3c:1d:a0:03:71:c7:0d:c7:c6:26:90:2f:e5

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 28, 2024 - Aug 28, 2027

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

997327

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

gui.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetProcessHeap HeapFree HeapReAlloc SwitchToThread SetFilePointerEx FlushFileBuffers SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx HeapSize CreateIoCompletionPort SetFileCompletionNotificationModes LCMapStringW UnmapViewOfFile GetCurrentThread SetThreadStackGuarantee CompareStringW AddVectoredExceptionHandler VirtualQuery MapViewOfFile CloseHandle GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW VirtualAlloc GetEnvironmentStringsW GetCPInfo CreateFileMappingW LoadLibraryA CreateFileW GetCommandLineW SetPriorityClass GetCurrentProcess VirtualProtect GetLastError GetModuleHandleW GetACP IsValidCodePage SetHandleInformation FindNextFileW FindFirstFileExW GetCurrentDirectoryW RtlCaptureContext ReleaseMutex WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP FindClose WaitForSingleObject MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW GetModuleHandleA CreateWaitableTimerExW SetWaitableTimer Sleep QueryPerformanceFrequency FormatMessageW GetModuleFileNameW GetCommandLineA GetModuleHandleExW ExitProcess CreateThread QueryPerformanceCounter GetSystemTimePreciseAsFileTime HeapAlloc PostQueuedCompletionStatus WriteFile RaiseException GetProcAddress LoadLibraryExW FreeLibrary TlsFree GetOEMCP TlsSetValue FreeEnvironmentStringsW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwind EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue DecodePointer

ws2_32

WSASocketW shutdown ioctlsocket closesocket connect getsockopt bind setsockopt getaddrinfo freeaddrinfo WSAStartup WSAIoctl WSACleanup recv send getpeername getsockname WSAGetLastError WSASend

ntdll

NtCancelIoFileEx NtCreateFile RtlNtStatusToDosError NtDeviceIoControlFile NtWriteFile

crypt32

CertCloseStore CertDuplicateCertificateChain CertAddCertificateContextToStore CertEnumCertificatesInStore CertOpenStore CertDuplicateStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateContext CertDuplicateCertificateContext

secur32

AcceptSecurityContext EncryptMessage DeleteSecurityContext InitializeSecurityContextW FreeContextBuffer QueryContextAttributesW AcquireCredentialsHandleA ApplyControlToken DecryptMessage FreeCredentialsHandle

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

6a6d4d4dc8f3e9c50150d786182e332506a12af9e8f743ff529897eb7d09a940

PE Signature issue

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ws2_32

ntdll

crypt32

secur32

advapi32

generic