ba428296fa14cc6d18ef2f26c2706aa7504a2f4b4caed92805e64e803bb7de27

Sharing

Copy URL Twitter E-mail

General

Target
ba428296fa14cc6d18ef2f26c2706aa7504a2f4b4caed92805e64e803bb7de27
Size 3.1MB
Sample260706-kap1vact9s
SHA256 ba428296fa14cc6d18ef2f26c2706aa7504a2f4b4caed92805e64e803bb7de27
MD5 c32041103597d0ab7bae0bc9f91d776a
SHA1 aec0c03005c44d2264b9b2029bc14bc9ea9c42a8
SHA512 14f3715179d4a252dfea4790327b09a9303210ade1a36bf3d2fe20d9e2a0af1c1256ffc5445ea42e451dc20d38609d42967ac232e0fa9f1a280a14cc537c4c66
SSDEEP 98304:vAqNWQPr93OhUs2YjwLl3B9jiXVu4aso4Fo:vAqNWQPr1t+jwtB9slaVH
TLSH
T1A2E5AE3A2DA1E464E0420DF660487E7A2C32AA318345EDC34A51F57D35E47F26A7F93E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
ba428296fa14cc6d18ef2f26c2706aa7504a2f4b4caed92805e64e803bb7de27

File Explorer

ba428296fa14cc6d18ef2f26c2706aa7504a2f4b4caed92805e64e803bb7de27

.exe 3.1MB

ba428296fa14cc6d18ef2f26c2706aa7504a2f4b4caed92805e64e803bb7de27

IMPHASH b1919a376fe6c93d6c3400abffb377d8
SHA256 ba428296fa14cc6d18ef2f26c2706aa7504a2f4b4caed92805e64e803bb7de27
MD5 c32041103597d0ab7bae0bc9f91d776a
SHA1 aec0c03005c44d2264b9b2029bc14bc9ea9c42a8
SHA512 14f3715179d4a252dfea4790327b09a9303210ade1a36bf3d2fe20d9e2a0af1c1256ffc5445ea42e451dc20d38609d42967ac232e0fa9f1a280a14cc537c4c66
SSDEEP 98304:vAqNWQPr93OhUs2YjwLl3B9jiXVu4aso4Fo:vAqNWQPr1t+jwtB9slaVH
TLSH
T1A2E5AE3A2DA1E464E0420DF660487E7A2C32AA318345EDC34A51F57D35E47F26A7F93E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

06:07:7a:31:63:1b:72:5a:bd:30:45:14:ec:4f:3d:ba:85:05:51:69:95:cd:d6:2c:ac:07:4f:65:09:81:75:99

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 3, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

06:07:7a:31:63:1b:72:5a:bd:30:45:14:ec:4f:3d:ba:85:05:51:69:95:cd:d6:2c:ac:07:4f:65:09:81:75:99

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 3, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:a6:58:10:67:4b:3d:6c:7c:f6:00:00:00:00:05:a6

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 22, 2024 - Jul 5, 2025

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 6, 2010 - Jul 6, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:0e:2c:cb:28:7d:95:20:75:63:00:01:00:00:02:0e

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:fd:36:44:39:73:0d:dc:02:28:00:00:00:00:03:fd

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 22, 2024 - Aug 20, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f4:17:46:85:c0:cb:3f:39:e5:00:01:00:00:01:f4

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2024 - Oct 22, 2025

Minor OS version

Major OS version

Entry point

745550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

luaStage.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

ntdll

RtlUnwind RtlCaptureContext RtlNtStatusToDosError NtWriteFile

kernel32

GetCPInfo GetOEMCP GetACP CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle GetModuleHandleA GetProcAddress CreateTimerQueue CreateEventW LoadLibraryA WaitForSingleObject SetEvent DeleteTimerQueue Sleep GetLastError RaiseException SetLastError FreeLibrary GetModuleFileNameA GetModuleHandleExA LoadLibraryExA FormatMessageA VirtualAlloc VirtualFree VirtualQuery InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CreateThread VirtualProtect SetStdHandle GetStringTypeW IsValidCodePage FreeEnvironmentStringsW CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread QueryPerformanceCounter GetCurrentProcess ReleaseMutex GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW DecodePointer GetCommandLineW FlushFileBuffers SetFileInformationByHandle DuplicateHandle SetFilePointerEx GetTimeZoneInformation GetFileAttributesExW GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetTimeFormatW HeapSize GetCommandLineA WriteFile GetStdHandle GetCurrentProcessId GetModuleHandleExW LoadLibraryExW WriteFileEx SleepEx ReadFileEx GetExitCodeProcess TerminateProcess QueryPerformanceFrequency TlsFree GetProcessHeap HeapFree HeapReAlloc WaitForSingleObjectEx lstrlenW CreateMutexA FindNextFileW FindClose CreateFileW FindFirstFileExW DeleteFileW MoveFileExW ReadFile GetModuleHandleW FormatMessageW GetModuleFileNameW SetEnvironmentVariableW ExitProcess CreateNamedPipeW GetFullPathNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW WideCharToMultiByte ReadConsoleW GetTempPathW HeapAlloc CreatePipe GetFileType TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer GetStartupInfoW GetDateFormatW CompareStringW SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent SetEndOfFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

__swprintf_l __vswprintf_l _fprintf_l _fprintf_p _fprintf_p_l _fprintf_s_l _fscanf_l _fscanf_s_l _fwprintf_l _fwprintf_p _fwprintf_p_l _fwprintf_s_l _fwscanf_l _fwscanf_s_l _printf_l _printf_p _printf_p_l _printf_s_l _scanf_l _scanf_s_l _scprintf _scprintf_l _scprintf_p _scprintf_p_l _scwprintf _scwprintf_l _scwprintf_p _scwprintf_p_l _snprintf _snprintf_c _snprintf_c_l _snprintf_l _snprintf_s _snprintf_s_l _snscanf _snscanf_l _snscanf_s _snscanf_s_l _snwprintf _snwprintf_l _snwprintf_s _snwprintf_s_l _snwscanf _snwscanf_l _snwscanf_s _snwscanf_s_l _sprintf_l _sprintf_p _sprintf_p_l _sprintf_s_l _sscanf_l _sscanf_s_l _swprintf _swprintf_c _swprintf_c_l _swprintf_l _swprintf_p _swprintf_p_l _swprintf_s_l _swscanf_l _swscanf_s_l _vfprintf_l _vfprintf_p _vfprintf_p_l _vfprintf_s_l _vfscanf_l _vfscanf_s_l _vfwprintf_l _vfwprintf_p _vfwprintf_p_l _vfwprintf_s_l _vfwscanf_l _vfwscanf_s_l _vprintf_l _vprintf_p _vprintf_p_l _vprintf_s_l _vscanf_l _vscanf_s_l _vscprintf _vscprintf_l _vscprintf_p _vscprintf_p_l _vscwprintf _vscwprintf_l _vscwprintf_p _vscwprintf_p_l _vsnprintf _vsnprintf_c _vsnprintf_c_l _vsnprintf_l _vsnprintf_s _vsnprintf_s_l _vsnwprintf _vsnwprintf_l _vsnwprintf_s _vsnwprintf_s_l _vsnwscanf_l _vsnwscanf_s_l _vsprintf_l _vsprintf_p _vsprintf_p_l _vsprintf_s_l _vsscanf_l _vsscanf_s_l _vswprintf _vswprintf_c _vswprintf_c_l _vswprintf_l _vswprintf_p _vswprintf_p_l _vswprintf_s_l _vswscanf_l _vswscanf_s_l _vwprintf_l _vwprintf_p _vwprintf_p_l _vwprintf_s_l _vwscanf_l _vwscanf_s_l _wprintf_l _wprintf_p _wprintf_p_l _wprintf_s_l _wscanf_l _wscanf_s_l fprintf fprintf_s fscanf fscanf_s fwprintf fwprintf_s fwscanf fwscanf_s printf printf_s scanf scanf_s snprintf sprintf sprintf_s sscanf sscanf_s swprintf swprintf_s swscanf swscanf_s vfprintf vfprintf_s vfscanf vfscanf_s vfwprintf vfwprintf_s vfwscanf vfwscanf_s vprintf vprintf_s vscanf vscanf_s vsnprintf vsnprintf_s vsprintf vsprintf_s vsscanf vsscanf_s vswprintf vswprintf_s vswscanf vswscanf_s vwprintf vwprintf_s vwscanf vwscanf_s wprintf wprintf_s wscanf wscanf_s

Sharing

General

Malware Config

Signatures

File Explorer

ba428296fa14cc6d18ef2f26c2706aa7504a2f4b4caed92805e64e803bb7de27

PE Signature issue

PE Signature issue

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

kernel32

bcrypt

advapi32

generic