aaae59af9ed9d7a454c7e671df8d2ee06bb153e5e95f4add222e099bcb2fa94a

General

Target
aaae59af9ed9d7a454c7e671df8d2ee06bb153e5e95f4add222e099bcb2fa94a
Size 11.1MB
Sample260707-jweassc181
SHA256 aaae59af9ed9d7a454c7e671df8d2ee06bb153e5e95f4add222e099bcb2fa94a
MD5 1fef1c8b15a1b4e2ddc76f117917df03
SHA1 b2cf79143d13320849ec3ce65ad534deb9f7868c
SHA512 da94c0790b13f6a286697098edec536243027b49b8bc32343beec5fe8b94006b1a9ee4f45f50c0f827e3a10b9105f42aec82eb98df5c32ecb93c2f01e27fd101
SSDEEP 196608:UV6dQaJpSVCpTtNkZNEwFnlrOvNtkdiZAL6+stTUSV:UcJdpTtNkLHBOS+ALlstlV
TLSH
T145C69E23E5418061E1A3327DCC3AEE68506DBE16873455CB12687C1B6573EC3EA3DBA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
aaae59af9ed9d7a454c7e671df8d2ee06bb153e5e95f4add222e099bcb2fa94a

File Explorer

aaae59af9ed9d7a454c7e671df8d2ee06bb153e5e95f4add222e099bcb2fa94a

.exe 11.1MB

aaae59af9ed9d7a454c7e671df8d2ee06bb153e5e95f4add222e099bcb2fa94a

IMPHASH 22e0f4961c0b4147a312d0e692729164
SHA256 aaae59af9ed9d7a454c7e671df8d2ee06bb153e5e95f4add222e099bcb2fa94a
MD5 1fef1c8b15a1b4e2ddc76f117917df03
SHA1 b2cf79143d13320849ec3ce65ad534deb9f7868c
SHA512 da94c0790b13f6a286697098edec536243027b49b8bc32343beec5fe8b94006b1a9ee4f45f50c0f827e3a10b9105f42aec82eb98df5c32ecb93c2f01e27fd101
SSDEEP 196608:UV6dQaJpSVCpTtNkZNEwFnlrOvNtkdiZAL6+stTUSV:UcJdpTtNkLHBOS+ALlstlV
TLSH
T145C69E23E5418061E1A3327DCC3AEE68506DBE16873455CB12687C1B6573EC3EA3DBA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

97:cc:5d:46:9c:21:0b:16:cd:76:00:85:a4:36:16:6f:fe:d8:1d:56:cb:c6:13:60:6c:04:45:54:e8:18:52:da

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Dec 6, 2021

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

09:c1:ca:c4:ac:05:dd:06:02:10:20:f8:87:7a:e7:e8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2020 - Dec 22, 2022

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

5

Entry point

4404179

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\r\ws\St_Make\code\build\win\results\standalone\Release_Debugger\Win32\FlashPlayer.pdb

kernel32

GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetStartupInfoW GetCommandLineA GetCommandLineW GetSystemDirectoryW GetTempPathW GetTempFileNameW CreateDirectoryW RemoveDirectoryW CreateFileA CreateFileW GetFileAttributesA DeleteFileW FindFirstFileW CopyFileW DebugBreak HeapAlloc HeapFree HeapSize GetProcessHeap GetSystemTime GetTimeZoneInformation SystemTimeToFileTime OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency CreateThread OpenThread SetThreadPriority QueueUserAPC TlsAlloc TlsFree SleepEx VirtualAlloc VirtualFree VirtualProtect VirtualQuery FreeLibrary GetProcessTimes GetCurrentProcess GlobalAlloc GlobalSize GlobalLock GlobalUnlock LoadLibraryA GetModuleHandleExW SetCurrentDirectoryW GetCurrentDirectoryW GetACP MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId SetUnhandledExceptionFilter FindNextFileW GetCPInfo IsDBCSLeadByte VerSetConditionMask LockResource GlobalFree ExitThread LoadResource CreateProcessA FindResourceExA FindResourceExW GetSystemDirectoryA GetFileAttributesW MoveFileExW GetVersionExW VerifyVersionInfoW GetUserDefaultUILanguage GetUserDefaultLangID GetLongPathNameW GetFileInformationByHandle GetFileSizeEx DeviceIoControl SetFilePointerEx lstrlenW LoadLibraryW CreateProcessW ExpandEnvironmentStringsA ExpandEnvironmentStringsW GetTempPathA GetTempFileNameA GetSystemWow64DirectoryW CreateDirectoryA GetFullPathNameW GetFileAttributesExW DeleteFileA GetVolumeInformationW SetLastError SetEvent ResetEvent WaitForMultipleObjects GetTickCount CreateEventW GetCurrentThread GetExitCodeThread DuplicateHandle MapViewOfFile UnmapViewOfFile TerminateThread CreateWaitableTimerW LCMapStringW GetLocaleInfoW ReleaseSemaphore CreateSemaphoreW SetThreadAffinityMask ReleaseMutex CreateFileMappingA CompareFileTime IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent LoadLibraryExA UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime RtlUnwind LoadLibraryExW GetStdHandle GetDateFormatW GetTimeFormatW CompareStringW GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode SetConsoleCtrlHandler GetStringTypeW HeapReAlloc FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle WriteConsoleW ReadConsoleW FormatMessageW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW ReadConsoleA SetConsoleMode TlsSetValue TlsGetValue GetSystemInfo CloseHandle FindClose SetFilePointer SetEndOfFile ReadFile WriteFile GetFileSize Sleep WaitForSingleObject DeleteCriticalSection TryEnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError GetCurrentThreadId SwitchToThread RaiseException GetExitCodeProcess ExitProcess GetProcAddress InterlockedCompareExchange InterlockedExchange InterlockedDecrement InterlockedIncrement CreateMutexA CreateEventA CreateWaitableTimerA SetWaitableTimer CancelWaitableTimer InterlockedExchangeAdd GetVersionExA GetVersion VerifyVersionInfoA GetNumberFormatW GetCurrencyFormatW GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FreeLibraryAndExitThread DecodePointer GetProcessAffinityMask

advapi32

RegOpenKeyA CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptAcquireContextW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegCreateKeyExW RegCreateKeyExA RegCloseKey CryptGenRandom CryptReleaseContext CryptAcquireContextA

generic

count=43, id=241, version=40116,

count=178, id=243, version=40116,

count=36, id=242, version=40116,

count=1, id=199, version=41118,

count=26, id=259, version=24123,

count=20, id=260, version=24123,

count=3, id=261, version=23013,

count=18, id=264, version=24233,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=766, id=260, version=24233,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=649, id=1, productName=Unmarked objects,

count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=46, id=261, version=24123,

count=913, id=261, version=24233,

count=1, id=256, version=24233,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=2, id=151,

count=1, id=258, version=24233,

Sharing

General

Malware Config

Signatures

File Explorer

aaae59af9ed9d7a454c7e671df8d2ee06bb153e5e95f4add222e099bcb2fa94a

PE Signature issue

kernel32

advapi32

generic