f1e2b0b60edb657e8d6f9ecd68af875067649d4b8c22cb7e49e32b80fc7de07e

Sharing

Copy URL Twitter E-mail

General

Target
f1e2b0b60edb657e8d6f9ecd68af875067649d4b8c22cb7e49e32b80fc7de07e
Size 2.0MB
Sample260710-y9hmpsbs8x
SHA256 f1e2b0b60edb657e8d6f9ecd68af875067649d4b8c22cb7e49e32b80fc7de07e
MD5 d66c2ff5cde1b2f7cec7c240d8d98335
SHA1 05d0a61e74fcb3955412c9ed11a59baea3e337bf
SHA512 cc26341121a29c4fd0d4c524260fb0c52dfbb33bc8470557034b3fa171cd0bb133b17bb022ff204f015982c9650f5d415b8848fd67402d52decb484c5e3f4abb
SSDEEP 24576:YSdgnW4B3ICkwK9QZt0LKd939n7/f78qtMhbV+CNsmKF5mbNM9c7XcWTW29ROevZ:Dgb3IP9QZt0M5VjurKFXcrrF9ROevzh3
TLSH
T1EFA5BF13B2A14031D1B31770A86DB72A2EFDBE3406258A5B57D43E0D6FB2981D73A367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
f1e2b0b60edb657e8d6f9ecd68af875067649d4b8c22cb7e49e32b80fc7de07e

File Explorer

f1e2b0b60edb657e8d6f9ecd68af875067649d4b8c22cb7e49e32b80fc7de07e

.dll 2.0MB

f1e2b0b60edb657e8d6f9ecd68af875067649d4b8c22cb7e49e32b80fc7de07e

IMPHASH 3e4d5b139b8e0e0578eecd67e7c07fee
SHA256 f1e2b0b60edb657e8d6f9ecd68af875067649d4b8c22cb7e49e32b80fc7de07e
MD5 d66c2ff5cde1b2f7cec7c240d8d98335
SHA1 05d0a61e74fcb3955412c9ed11a59baea3e337bf
SHA512 cc26341121a29c4fd0d4c524260fb0c52dfbb33bc8470557034b3fa171cd0bb133b17bb022ff204f015982c9650f5d415b8848fd67402d52decb484c5e3f4abb
SSDEEP 24576:YSdgnW4B3ICkwK9QZt0LKd939n7/f78qtMhbV+CNsmKF5mbNM9c7XcWTW29ROevZ:Dgb3IP9QZt0M5VjurKFXcrrF9ROevzh3
TLSH
T1EFA5BF13B2A14031D1B31770A86DB72A2EFDBE3406258A5B57D43E0D6FB2981D73A367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

72:41:24:7f:47:24:f5:55:bc:7d:cb:fa:14:55:ba:fc:f9:1a:a1:43:6f:ed:d6:53:2f:5b:6b:a7:69:bd:54:4d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Chains

May 30, 2023

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Serial Number

0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 2, 2021 - Jul 10, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1328062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

TEST_goopdate_unsigned.pdb

kernel32

GetPrivateProfileIntW OutputDebugStringA SetFilePointer GetEnvironmentVariableW WaitForSingleObject CreateFileW GetCurrentThreadId ReleaseMutex Sleep GetFileInformationByHandle GetFileAttributesExW OutputDebugStringW LockResource CloseHandle FindResourceExW LoadResource FindResourceW GetLocalTime GetCurrentProcessId lstrcmpiW lstrcmpW FindFirstFileW FindNextFileW GetCurrentProcess RemoveDirectoryW WaitForMultipleObjects FindClose GetFileAttributesW DuplicateHandle FormatMessageW GetCurrentThread DeleteFileW LoadLibraryW GetCurrentDirectoryW GetProcAddress LocalFree GetModuleHandleW WriteFile GetTempFileNameW OpenMutexW GetTickCount LoadLibraryExW GetExitCodeProcess ReadFile CompareFileTime SetEndOfFile SetFileAttributesW FileTimeToSystemTime MoveFileExW GetFileSize CopyFileW GetSystemTimeAsFileTime GetFileTime FlushFileBuffers lstrcpynW ExitProcess IsDebuggerPresent WideCharToMultiByte MultiByteToWideChar GetTimeZoneInformation FileTimeToLocalFileTime SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetModuleFileNameW GetTempPathW GetSystemDirectoryW GetComputerNameW VirtualQuery TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateMutexW CreateEventW SetEvent ResetEvent GetLongPathNameW lstrlenW TerminateProcess WaitForMultipleObjectsEx OpenProcess DeviceIoControl ProcessIdToSessionId Process32NextW WaitForSingleObjectEx Process32FirstW ReadProcessMemory SetHandleInformation CreatePipe GetSystemPowerStatus GlobalMemoryStatusEx CreateProcessW SetProcessWorkingSetSize GetVersionExW VerSetConditionMask VerifyVersionInfoW LocalAlloc HeapSetInformation GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetStdHandle QueryDosDeviceW GetLogicalDriveStringsW OpenEventW CreateThread SetCurrentDirectoryW OpenThread QueryPerformanceCounter lstrcmpA GetCommandLineW GetStringTypeExW GetThreadLocale GetStringTypeExA SetFilePointerEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead GetStringTypeW EncodePointer GetCPInfo SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetSystemInfo VirtualAlloc VirtualProtect GetModuleHandleExW GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFileSizeEx SetStdHandle GetConsoleOutputCP GetConsoleMode ReadConsoleW WriteConsoleW SetLastError SizeofResource CreateDirectoryW GetProcessId ReleaseSemaphore RtlCaptureContext DeleteTimerQueueTimer CreateTimerQueueTimer GetPrivateProfileStringW GetComputerNameExW LoadLibraryExA VirtualFree FlushInstructionCache InterlockedPopEntrySList MulDiv GlobalHandle CreateTimerQueue DeleteTimerQueueEx GetSystemDefaultLangID SetPriorityClass CreateSemaphoreW VirtualQueryEx SetNamedPipeHandleState TransactNamedPipe GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount GetUserDefaultLangID GetSystemTime QueryPerformanceFrequency UnregisterWaitEx RegisterWaitForSingleObject QueueUserWorkItem Thread32First Thread32Next SetProcessShutdownParameters CreateToolhelp32Snapshot GetProcessShutdownParameters FreeLibrary HeapFree WaitNamedPipeW

oleaut32

SafeArrayGetLBound SafeArrayCopy SafeArrayGetVartype SafeArrayLock SafeArrayCreate VariantClear VariantInit SysAllocStringLen SysStringLen SafeArrayGetUBound LoadTypeLi LoadRegTypeLi SystemTimeToVariantTime SysAllocString SysReAllocStringLen VariantChangeType SysAllocStringByteLen SysStringByteLen SafeArrayUnlock SafeArrayDestroy SafeArrayRedim OleLoadPicturePath SysFreeString VarBstrCmp VariantTimeToSystemTime VarUI4FromStr OleCreateFontIndirect

user32

GetWindowThreadProcessId IsWindowVisible SendMessageW GetSystemMetrics EnumWindows LoadImageW OpenClipboard CloseClipboard EmptyClipboard SetClipboardData FlashWindow GetMenuState InflateRect SetActiveWindow OffsetRect CharNextW CopyRect FrameRect IsRectEmpty GetSysColorBrush SystemParametersInfoW UpdateWindow GetCursorPos EnumChildWindows EnableMenuItem EnableWindow IsDialogMessageW GetWindowTextLengthW GetSystemMenu GetFocus GetDC FillRect ScreenToClient EndDialog SetWindowTextW ShowWindow InvalidateRgn RedrawWindow DestroyIcon ClientToScreen DestroyAcceleratorTable IsChild GetTopWindow GetSysColor MoveWindow CreateAcceleratorTableW SetLayeredWindowAttributes SetFocus SetWindowContextHelpId GetClassNameW MonitorFromWindow PostThreadMessageW LoadStringW IsWindow CharLowerBuffA CharNextA CreateWindowExW UnregisterClassW DispatchMessageW GetMonitorInfoW PeekMessageW MapWindowPoints SetForegroundWindow GetParent PostQuitMessage GetClientRect IsMenu SetCapture MapDialogRect RemoveMenu GetDlgItem GetDesktopWindow CreateDialogIndirectParamW RegisterWindowMessageW ReleaseCapture CharUpperW CharLowerW CharLowerBuffW MessageBoxW wvsprintfW wsprintfW GetWindowLongW GetMessageW AllowSetForegroundWindow GetWindow GetWindowRect DestroyWindow SetWindowPos TranslateMessage PostMessageW WaitForInputIdle SendDlgItemMessageW CopyImage GetClassInfoExW KillTimer SetWindowLongW LoadCursorW SetTimer RegisterClassExW CallWindowProcW DefWindowProcW CharUpperBuffW GetWindowTextW EndPaint BeginPaint ReleaseDC InvalidateRect

iphlpapi

GetIfTable

netapi32

NetGetJoinInformation NetApiBufferFree NetWkstaUserGetInfo NetWkstaGetInfo

psapi

GetModuleFileNameExW EnumProcessModules EnumProcesses

shlwapi

PathRemoveExtensionW PathIsDirectoryEmptyW PathFindFileNameW SHQueryValueExW PathStripPathW PathCommonPrefixW PathFileExistsW PathAddExtensionW UrlCombineW PathFindExtensionW PathRemoveFileSpecW PathAddBackslashW UrlUnescapeA UrlEscapeW PathIsDirectoryW PathCanonicalizeW PathAppendW PathAppendA PathCreateFromUrlW UrlIsW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

userenv

UnloadUserProfile ExpandEnvironmentStringsForUserW EnterCriticalPolicySection LeaveCriticalPolicySection CreateEnvironmentBlock GetProfileType DestroyEnvironmentBlock

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQuerySessionInformationW

advapi32

RegDeleteKeyW ControlService QueryServiceStatus SystemFunction036 DuplicateToken RegOverridePredefKey GetUserNameW CryptReleaseContext CryptDestroyHash CryptHashData CryptCreateHash CryptVerifySignatureW CryptDestroyKey AdjustTokenPrivileges CreateProcessAsUserW RegOpenCurrentUser IsTextUnicode DeregisterEventSource CreateServiceW GetSecurityInfo CryptGenRandom CryptAcquireContextW SetServiceStatus ChangeServiceConfig2W DeleteService RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW QueryServiceConfigW ChangeServiceConfigW QueryServiceConfig2W RegisterEventSourceW ReportEventW TraceEvent GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids GetSidSubAuthorityCount GetSidIdentifierAuthority AllocateAndInitializeSid ImpersonateSelf FreeSid CheckTokenMembership RegNotifyChangeKeyValue RegQueryInfoKeyW LookupPrivilegeValueW RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegDeleteValueW RegEnumValueW MakeSelfRelativeSD RegQueryValueExW GetSecurityDescriptorLength GetLengthSid RegOpenKeyExW InitializeAcl AddAce IsValidSid GetSecurityDescriptorOwner InitializeSid CopySid GetSecurityDescriptorControl SetNamedSecurityInfoW GetSidLengthRequired GetSidSubAuthority GetSecurityDescriptorGroup RegCloseKey GetSecurityDescriptorDacl GetSecurityDescriptorSacl GetTokenInformation SetSecurityDescriptorGroup MakeAbsoluteSD OpenThreadToken OpenServiceW InitializeSecurityDescriptor StartServiceW OpenProcessToken ImpersonateLoggedOnUser ConvertStringSidToSidW GetNamedSecurityInfoW OpenSCManagerW CloseServiceHandle EqualSid GetAce SetSecurityDescriptorOwner GetAclInformation RevertToSelf SetSecurityDescriptorDacl DuplicateTokenEx ConvertSidToStringSidW

ole32

CoReleaseServerProcess CoTaskMemAlloc CoUninitialize CoRegisterClassObject CoInitializeSecurity CoSuspendClassObjects CoTaskMemRealloc CoInitializeEx CoSetProxyBlanket CoRegisterPSClsid OleSaveToStream ReadClassStm WriteClassStm OleUninitialize CoTaskMemFree CoRevertToSelf CoGetCallContext CoCreateInstance StringFromGUID2 CoCreateGuid CoGetClassObject CoImpersonateClient CoGetObject CoRevokeClassObject IIDFromString CreateStreamOnHGlobal CoResumeClassObjects CLSIDFromProgID OleInitialize CLSIDFromString CoAddRefServerProcess OleLockRunning

shell32

ShellExecuteExW CommandLineToArgvW SHGetFolderPathW ord680

comctl32

InitCommonControlsEx _TrackMouseEvent

crypt32

CryptProtectData CryptDecodeObjectEx CryptImportPublicKeyInfo CertFreeCertificateContext CryptQueryObject CertDuplicateCertificateContext CertCloseStore CertFindCertificateInStore CertGetNameStringW CryptHashCertificate CryptUnprotectData

msimg32

GradientFill

uxtheme

SetWindowTheme

wininet

InternetQueryDataAvailable InternetOpenW HttpQueryInfoW InternetCrackUrlW HttpSendRequestW InternetCloseHandle InternetConnectW InternetReadFile HttpAddRequestHeadersW HttpOpenRequestW

wintrust

WinVerifyTrust

gdi32

DPtoLP CreateFontIndirectW CreateSolidBrush DeleteObject GetObjectW DeleteDC GetDeviceCaps GetStockObject CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt ExtTextOutW FillRgn CombineRgn SetBkColor SetViewportOrgEx GetRegionData SetTextColor CreateRectRgn OffsetRgn GetTextMetricsW CreateRectRgnIndirect

Sharing

General

Malware Config

Signatures

File Explorer

f1e2b0b60edb657e8d6f9ecd68af875067649d4b8c22cb7e49e32b80fc7de07e

PE Signature issue

kernel32

oleaut32

user32

iphlpapi

netapi32

psapi

shlwapi

version

userenv

wtsapi32

advapi32

ole32

shell32

comctl32

crypt32

msimg32

uxtheme

wininet

wintrust

gdi32

generic