f7d30e36803b6103f5b0ebaaf020b941f717ec85951567c3afd074073b0fbb45

Sharing

Copy URL Twitter E-mail

General

Target
f7d30e36803b6103f5b0ebaaf020b941f717ec85951567c3afd074073b0fbb45
Size 2.0MB
Sample260708-ex6dfsbv3p
SHA256 f7d30e36803b6103f5b0ebaaf020b941f717ec85951567c3afd074073b0fbb45
MD5 8c09468f9c6775eb2adae955fca0be47
SHA1 94ca0ef634fda924e5b8be941a72f1b18df2bcf7
SHA512 ddf9ef19a4aa3ae90d545f5092c76907ed61aaf915e11c0d72cb7f76dec65844a232bc86e66c60217c0590f0b59e9c19cab3c7a0abd05fd2221da06e77d39821
SSDEEP 24576:oHhPvGlhhk7g+kq8RpRBr0saiXFkGB9zkdpglcKQGFRgwutbceGlsIVkuV6WlZva:M+677cRFoqFkak3glKbcvkaT1y3ezvNE
TLSH
T13CA5C013B2908035D1A71630AC6D7B265EFDBF340A268A5B53D83D0E6F729C0D63A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
f7d30e36803b6103f5b0ebaaf020b941f717ec85951567c3afd074073b0fbb45

File Explorer

f7d30e36803b6103f5b0ebaaf020b941f717ec85951567c3afd074073b0fbb45

.dll 2.0MB

f7d30e36803b6103f5b0ebaaf020b941f717ec85951567c3afd074073b0fbb45

IMPHASH 31bc554d069c2242ad3b567d1daa0122
SHA256 f7d30e36803b6103f5b0ebaaf020b941f717ec85951567c3afd074073b0fbb45
MD5 8c09468f9c6775eb2adae955fca0be47
SHA1 94ca0ef634fda924e5b8be941a72f1b18df2bcf7
SHA512 ddf9ef19a4aa3ae90d545f5092c76907ed61aaf915e11c0d72cb7f76dec65844a232bc86e66c60217c0590f0b59e9c19cab3c7a0abd05fd2221da06e77d39821
SSDEEP 24576:oHhPvGlhhk7g+kq8RpRBr0saiXFkGB9zkdpglcKQGFRgwutbceGlsIVkuV6WlZva:M+677cRFoqFkak3glKbcvkaT1y3ezvNE
TLSH
T13CA5C013B2908035D1A71630AC6D7B265EFDBF340A268A5B53D83D0E6F729C0D63A767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

43:1b:e5:22:cf:70:b4:c2:c3:cf:cd:c4:41:3e:09:3d:67:af:e6:c7:26:85:61:a6:1c:b0:73:56:22:8c:25:f8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Chains

Jan 10, 2024

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Serial Number

0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 2, 2021 - Jul 10, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1336966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

TEST_goopdate_unsigned.pdb

kernel32

GetPrivateProfileIntW OutputDebugStringA SetFilePointer GetEnvironmentVariableW WaitForSingleObject CreateFileW GetCurrentThreadId ReleaseMutex Sleep GetFileInformationByHandle GetFileAttributesExW OutputDebugStringW LockResource CloseHandle FindResourceExW LoadResource FindResourceW GetLocalTime GetCurrentProcessId lstrcmpiW lstrcmpW FindFirstFileW FindNextFileW GetCurrentProcess RemoveDirectoryW WaitForMultipleObjects FindClose GetFileAttributesW DuplicateHandle FormatMessageW GetCurrentThread DeleteFileW LoadLibraryW GetCurrentDirectoryW GetProcAddress LocalFree GetModuleHandleW WriteFile GetTempFileNameW OpenMutexW GetTickCount LoadLibraryExW GetExitCodeProcess ReadFile CompareFileTime SetEndOfFile SetFileAttributesW FileTimeToSystemTime MoveFileExW GetFileSize CopyFileW GetSystemTimeAsFileTime GetFileTime FlushFileBuffers lstrcpynW ExitProcess IsDebuggerPresent WideCharToMultiByte MultiByteToWideChar GetTimeZoneInformation FileTimeToLocalFileTime SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetModuleFileNameW GetTempPathW GetSystemDirectoryW GetComputerNameW VirtualQuery TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateMutexW CreateEventW SetEvent ResetEvent GetLongPathNameW lstrlenW TerminateProcess WaitForMultipleObjectsEx OpenProcess DeviceIoControl ProcessIdToSessionId Process32NextW WaitForSingleObjectEx Process32FirstW ReadProcessMemory SetHandleInformation CreatePipe GetSystemPowerStatus GlobalMemoryStatusEx CreateProcessW SetProcessWorkingSetSize GetVersionExW VerSetConditionMask VerifyVersionInfoW LocalAlloc HeapSetInformation GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetStdHandle QueryDosDeviceW GetLogicalDriveStringsW OpenEventW CreateThread SetCurrentDirectoryW OpenThread QueryPerformanceCounter lstrcmpA GetCommandLineW GetStringTypeExW GetThreadLocale GetStringTypeExA SetFilePointerEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead GetStringTypeW EncodePointer GetCPInfo SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetSystemInfo VirtualAlloc VirtualProtect GetModuleHandleExW GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFileSizeEx SetStdHandle GetConsoleOutputCP GetConsoleMode ReadConsoleW WriteConsoleW SetLastError SizeofResource CreateDirectoryW GetProcessId ReleaseSemaphore RtlCaptureContext DeleteTimerQueueTimer CreateTimerQueueTimer GetPrivateProfileStringW GetComputerNameExW LoadLibraryExA VirtualFree FlushInstructionCache InterlockedPopEntrySList MulDiv GlobalHandle CreateTimerQueue DeleteTimerQueueEx GetSystemDefaultLangID SetPriorityClass CreateSemaphoreW VirtualQueryEx SetNamedPipeHandleState TransactNamedPipe GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount GetUserDefaultLangID GetSystemTime QueryPerformanceFrequency UnregisterWaitEx RegisterWaitForSingleObject QueueUserWorkItem Thread32First Thread32Next SetProcessShutdownParameters CreateToolhelp32Snapshot GetProcessShutdownParameters FreeLibrary HeapFree WaitNamedPipeW

oleaut32

SafeArrayGetLBound SafeArrayCopy SafeArrayGetVartype SafeArrayLock SafeArrayCreate VariantClear VariantInit SysAllocStringLen SafeArrayGetUBound VariantTimeToSystemTime LoadTypeLi LoadRegTypeLi SystemTimeToVariantTime SysAllocString SysReAllocStringLen VariantChangeType SafeArrayUnlock SafeArrayDestroy SafeArrayRedim OleLoadPicturePath SysFreeString VarBstrCmp VarUI4FromStr SysStringLen SysAllocStringByteLen SysStringByteLen OleCreateFontIndirect

user32

SendMessageW GetSystemMetrics EnumWindows LoadImageW OpenClipboard CloseClipboard EmptyClipboard SetClipboardData FlashWindow CharUpperW CharLowerW GetMenuState InflateRect SetActiveWindow OffsetRect IsMenu GetWindowThreadProcessId FrameRect IsRectEmpty GetSysColorBrush SystemParametersInfoW UpdateWindow GetCursorPos EnumChildWindows EnableMenuItem EnableWindow IsDialogMessageW GetWindowTextLengthW GetSystemMenu GetFocus GetDC FillRect ScreenToClient EndDialog SetWindowTextW ShowWindow InvalidateRgn RedrawWindow DestroyIcon ClientToScreen DestroyAcceleratorTable IsChild GetTopWindow GetSysColor MoveWindow CreateAcceleratorTableW SetLayeredWindowAttributes SetFocus SetWindowContextHelpId GetClassNameW SetCapture MapDialogRect IsWindowVisible PostThreadMessageW CharNextW LoadStringW UnregisterClassW IsWindow CharLowerBuffA CharNextA DispatchMessageW GetMonitorInfoW PeekMessageW MapWindowPoints SetForegroundWindow GetParent PostQuitMessage GetClientRect CopyRect RemoveMenu GetDlgItem GetDesktopWindow CreateDialogIndirectParamW RegisterWindowMessageW ReleaseCapture InvalidateRect ReleaseDC CharLowerBuffW MessageBoxW wvsprintfW wsprintfW GetWindowLongW GetMessageW AllowSetForegroundWindow GetWindow GetWindowRect DestroyWindow SetWindowPos MonitorFromWindow CreateWindowExW TranslateMessage PostMessageW WaitForInputIdle SendDlgItemMessageW CopyImage GetClassInfoExW KillTimer SetWindowLongW LoadCursorW SetTimer RegisterClassExW CallWindowProcW DefWindowProcW CharUpperBuffW GetWindowTextW EndPaint BeginPaint

iphlpapi

GetIfTable

netapi32

NetGetJoinInformation NetApiBufferFree NetWkstaUserGetInfo NetWkstaGetInfo

psapi

GetModuleFileNameExW EnumProcessModules EnumProcesses

shlwapi

PathFindFileNameW PathRemoveExtensionW PathIsDirectoryW PathIsDirectoryEmptyW PathFileExistsW PathCommonPrefixW PathStripPathW PathAddExtensionW UrlCombineW PathFindExtensionW UrlIsW PathRemoveFileSpecW PathAddBackslashW UrlUnescapeA UrlEscapeW SHQueryValueExW PathCanonicalizeW PathAppendW PathAppendA PathCreateFromUrlW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

userenv

UnloadUserProfile ExpandEnvironmentStringsForUserW EnterCriticalPolicySection LeaveCriticalPolicySection CreateEnvironmentBlock GetProfileType DestroyEnvironmentBlock

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQuerySessionInformationW

advapi32

RegDeleteKeyW ControlService QueryServiceStatus SystemFunction036 DuplicateToken RegOverridePredefKey GetUserNameW CryptReleaseContext CryptDestroyHash CryptHashData CryptCreateHash CryptVerifySignatureW CryptDestroyKey AdjustTokenPrivileges CreateProcessAsUserW RegOpenCurrentUser IsTextUnicode DeregisterEventSource CreateServiceW GetSecurityInfo CryptGenRandom CryptAcquireContextW SetServiceStatus ChangeServiceConfig2W DeleteService RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW QueryServiceConfigW ChangeServiceConfigW QueryServiceConfig2W RegisterEventSourceW ReportEventW TraceEvent GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids GetSidSubAuthorityCount GetSidIdentifierAuthority AllocateAndInitializeSid ImpersonateSelf FreeSid CheckTokenMembership RegNotifyChangeKeyValue RegQueryInfoKeyW LookupPrivilegeValueW RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegDeleteValueW RegEnumValueW MakeSelfRelativeSD RegQueryValueExW GetSecurityDescriptorLength GetLengthSid RegOpenKeyExW InitializeAcl AddAce IsValidSid GetSecurityDescriptorOwner InitializeSid CopySid GetSecurityDescriptorControl SetNamedSecurityInfoW GetSidLengthRequired GetSidSubAuthority GetSecurityDescriptorGroup RegCloseKey GetSecurityDescriptorDacl GetSecurityDescriptorSacl GetTokenInformation SetSecurityDescriptorGroup MakeAbsoluteSD OpenThreadToken OpenServiceW InitializeSecurityDescriptor StartServiceW OpenProcessToken ImpersonateLoggedOnUser ConvertStringSidToSidW GetNamedSecurityInfoW OpenSCManagerW CloseServiceHandle EqualSid GetAce SetSecurityDescriptorOwner GetAclInformation RevertToSelf SetSecurityDescriptorDacl DuplicateTokenEx ConvertSidToStringSidW

ntdll

NtDeleteKey

ole32

CoReleaseServerProcess CoTaskMemAlloc CoUninitialize StringFromGUID2 CoResumeClassObjects CoSuspendClassObjects CoTaskMemRealloc CoRevertToSelf CoGetClassObject CoRegisterPSClsid OleSaveToStream ReadClassStm WriteClassStm OleUninitialize CoGetCallContext CoImpersonateClient CoGetObject CoCreateGuid CoAddRefServerProcess CoRevokeClassObject CoTaskMemFree IIDFromString CoInitializeSecurity CoInitializeEx CoCreateInstance CreateStreamOnHGlobal CoRegisterClassObject CLSIDFromProgID OleInitialize CLSIDFromString CoSetProxyBlanket OleLockRunning

shell32

ShellExecuteExW CommandLineToArgvW SHGetFolderPathW ord680

comctl32

InitCommonControlsEx _TrackMouseEvent

crypt32

CryptProtectData CryptDecodeObjectEx CryptImportPublicKeyInfo CertFreeCertificateContext CryptQueryObject CertDuplicateCertificateContext CertCloseStore CertFindCertificateInStore CertGetNameStringW CryptHashCertificate CryptUnprotectData

msimg32

GradientFill

uxtheme

SetWindowTheme

wininet

InternetQueryDataAvailable InternetOpenW HttpQueryInfoW InternetCrackUrlW HttpSendRequestW InternetCloseHandle InternetConnectW InternetReadFile HttpAddRequestHeadersW HttpOpenRequestW

wintrust

WinVerifyTrust

gdi32

DPtoLP CreateFontIndirectW CreateSolidBrush DeleteObject GetObjectW DeleteDC GetDeviceCaps GetStockObject CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt ExtTextOutW FillRgn CombineRgn SetBkColor SetViewportOrgEx GetRegionData SetTextColor CreateRectRgn OffsetRgn GetTextMetricsW CreateRectRgnIndirect

Sharing

General

Malware Config

Signatures

File Explorer

f7d30e36803b6103f5b0ebaaf020b941f717ec85951567c3afd074073b0fbb45

PE Signature issue

kernel32

oleaut32

user32

iphlpapi

netapi32

psapi

shlwapi

version

userenv

wtsapi32

advapi32

ntdll

ole32

shell32

comctl32

crypt32

msimg32

uxtheme

wininet

wintrust

gdi32

generic