a0a738670441a18765d0b8b4b41bc0303e3e110bdaf6a6065fe10f247ca0074a

Sharing

Copy URL Twitter E-mail

General

Target
a0a738670441a18765d0b8b4b41bc0303e3e110bdaf6a6065fe10f247ca0074a
Size 734KB
Sample260706-nyerkaev21
SHA256 a0a738670441a18765d0b8b4b41bc0303e3e110bdaf6a6065fe10f247ca0074a
MD5 6e2a52759eb3ad91e0020dcafed07fb0
SHA1 fc8897d549cc611591c35d3748bb59fa82212abc
SHA512 6f4d1df95725c63ddc953ab3796096bc3f051ee80af77009033f2d07d254332924ba342fa45d4bef4d336d6c289ed134134f1db25a03c55bf0ec3f76ac846d9c
SSDEEP 12288:XCXpRy1kgIe0ZS3SDByKHqSJnUvQnyxC8M33G9HykVfRBH:XCHyWRe0gtXSJnmQnyxvHyktX
TLSH
T102F4BE2279E1C036D1337170095DC758A2BAF4314A3A4AABB7CC676E2F345D1CB35BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
a0a738670441a18765d0b8b4b41bc0303e3e110bdaf6a6065fe10f247ca0074a

File Explorer

a0a738670441a18765d0b8b4b41bc0303e3e110bdaf6a6065fe10f247ca0074a

.exe 734KB

a0a738670441a18765d0b8b4b41bc0303e3e110bdaf6a6065fe10f247ca0074a

IMPHASH f55eab757908a44d768fab3919a79097
SHA256 a0a738670441a18765d0b8b4b41bc0303e3e110bdaf6a6065fe10f247ca0074a
MD5 6e2a52759eb3ad91e0020dcafed07fb0
SHA1 fc8897d549cc611591c35d3748bb59fa82212abc
SHA512 6f4d1df95725c63ddc953ab3796096bc3f051ee80af77009033f2d07d254332924ba342fa45d4bef4d336d6c289ed134134f1db25a03c55bf0ec3f76ac846d9c
SSDEEP 12288:XCXpRy1kgIe0ZS3SDByKHqSJnUvQnyxC8M33G9HykVfRBH:XCHyWRe0gtXSJnmQnyxvHyktX
TLSH
T102F4BE2279E1C036D1337170095DC758A2BAF4314A3A4AABB7CC676E2F345D1CB35BA6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

fa:da:85:79:c0:62:f4:5f:5b:7d:52:a6:b0:ef:c5:ad:1b:5e:a8:48:97:fa:19:cf:f4:64:9f:73:79:d8:c1:52

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Chains

Dec 18, 2025

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Serial Number

0a:a1:8f:63:f9:6f:11:77:1c:bb:0b:43:e4:d6:90:b8

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 10, 2025 - Jan 11, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

262102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CLSIDFromString StringFromGUID2 IIDFromString OleRun CoUninitialize CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance

shell32

Shell_NotifyIconA ShellExecuteA SHGetFolderPathW

wininet

InternetTimeToSystemTime InternetCrackUrlA InternetTimeFromSystemTime InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetErrorDlg

user32

GetDesktopWindow LoadImageA SetWindowLongA MessageBoxW GetWindowLongA SetForegroundWindow wsprintfA CharNextA LoadStringA GetMessageA GetMessageW TranslateMessage DispatchMessageA DispatchMessageW PeekMessageA PostMessageA DefWindowProcA PostQuitMessage RegisterClassA CreateWindowExA DestroyWindow ShowWindow MsgWaitForMultipleObjectsEx IsWindowUnicode GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu GetCursorPos

version

VerQueryValueW GetFileVersionInfoA GetFileVersionInfoSizeA

kernel32

GetFileInformationByHandle GetDriveTypeW VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetConsoleOutputCP GetSystemTimeAsFileTime GetModuleHandleW GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringEx EncodePointer InitializeCriticalSectionEx GetStringTypeW GetConsoleMode GetCommandLineW GetFileType GetStdHandle GetModuleFileNameW InitializeSListHead WriteConsoleW GetCommandLineA DecodePointer CloseHandle RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection WaitForSingleObject CreateMutexA CreateEventA WaitForMultipleObjects FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryExA LoadResource SizeofResource lstrcmpA lstrcmpiA lstrcatA lstrlenA FindResourceA SetDllDirectoryA SystemTimeToTzSpecificLocalTime MultiByteToWideChar WideCharToMultiByte IsDBCSLeadByte SetEvent ResetEvent GetFullPathNameW lstrcpyA lstrcpynA CreateFileA WriteFile OpenEventA Sleep DeleteFileA GetTempPathA GetCurrentProcess GetVersionExA LocalFree ReadFile FileTimeToSystemTime GetCurrentProcessId GetCurrentThreadId GetLocalTime FormatMessageW GetEnvironmentVariableA FindClose ExitProcess TerminateProcess GetSystemDirectoryA LockResource LoadLibraryA LocalAlloc FormatMessageA SetLastError GetNativeSystemInfo GetModuleHandleExW SetHandleInformation CreatePipe PeekNamedPipe GetExitCodeProcess CreateProcessA SetEndOfFile SetFilePointerEx GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage GetFileAttributesA GetModuleHandleExA LoadLibraryW CreateDirectoryW LoadLibraryExW OpenMutexA QueryPerformanceCounter CreateFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection IsDebuggerPresent OutputDebugStringW SetStdHandle HeapFree HeapAlloc HeapSize HeapReAlloc GetTimeZoneInformation CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetFileSizeEx ReadConsoleW GetCurrentDirectoryW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap CreateThread

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyA CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegQueryValueExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExA RegQueryInfoKeyW RegOpenKeyExA RegNotifyChangeKeyValue RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegCloseKey

oleaut32

GetErrorInfo SysFreeString VarUI4FromStr SysAllocString SysStringByteLen SysAllocStringByteLen VariantInit VariantClear VariantChangeType

shlwapi

ord12

gdi32

GetStockObject

crypt32

CryptUnprotectData CryptProtectData CryptStringToBinaryA CryptBinaryToStringA

msi

ord117 ord189 ord168 ord31 ord159 ord160 ord91 ord115 ord44 ord204 ord137 ord141 ord8 ord67

Sharing

General

Malware Config

Signatures

File Explorer

a0a738670441a18765d0b8b4b41bc0303e3e110bdaf6a6065fe10f247ca0074a

PE Signature issue

ole32

shell32

wininet

user32

version

kernel32

advapi32

oleaut32

shlwapi

gdi32

crypt32

msi

generic