76d6ab9ecfc84c560176710338d60715e253e493d8a0cbe8b2815b864666d686

Sharing

Copy URL Twitter E-mail

General

Target
76d6ab9ecfc84c560176710338d60715e253e493d8a0cbe8b2815b864666d686
Size 9.6MB
Sample260713-asr8tacv21
SHA256 76d6ab9ecfc84c560176710338d60715e253e493d8a0cbe8b2815b864666d686
MD5 276915f9c66e332f9b6794156a8720f3
SHA1 fa0dd90b59dd724113566f119db0943d6593c9ca
SHA512 1ccfd8de962c854c52b3bdcabe4b6facd64e952a10124f46a08f05984b32e2ec55d8e4f2e3b38212bed99aad0f39ac5453b520beeaa76dc386383de2450ec1d4
SSDEEP 98304:C+nOOuPkgicZwYJMjppRPgTgJ7WfU7bDrHkz9YL:7+PfPxJMtpR4Y7ICb0iL
TLSH
T159A6E516A7BE75A8D1B7C07892472B62ED31309C0B3476F7999082293F34BF8697D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
76d6ab9ecfc84c560176710338d60715e253e493d8a0cbe8b2815b864666d686

File Explorer

76d6ab9ecfc84c560176710338d60715e253e493d8a0cbe8b2815b864666d686

.dll 9.6MB

76d6ab9ecfc84c560176710338d60715e253e493d8a0cbe8b2815b864666d686

IMPHASH ea3b4e49d2f21a483b02fba2541360c4
SHA256 76d6ab9ecfc84c560176710338d60715e253e493d8a0cbe8b2815b864666d686
MD5 276915f9c66e332f9b6794156a8720f3
SHA1 fa0dd90b59dd724113566f119db0943d6593c9ca
SHA512 1ccfd8de962c854c52b3bdcabe4b6facd64e952a10124f46a08f05984b32e2ec55d8e4f2e3b38212bed99aad0f39ac5453b520beeaa76dc386383de2450ec1d4
SSDEEP 98304:C+nOOuPkgicZwYJMjppRPgTgJ7WfU7bDrHkz9YL:7+PfPxJMtpR4Y7ICb0iL
TLSH
T159A6E516A7BE75A8D1B7C07892472B62ED31309C0B3476F7999082293F34BF8697D712
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0c:20:1c:c3:c8:4b:7c:6e:6c:ce:79:18:ec:35:1a:5f:8c:a4:4a:b7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Chains

Aug 1, 2015

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Serial Number

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2015 - Jul 26, 2018

Subject

CN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Serial Number

1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6

Issuer

CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2000 - Dec 31, 2099

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Serial Number

1e:b1:32:d5:7e:79:68:96

Issuer

CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2000 - Dec 31, 2099

Minor OS version

Major OS version

Entry point

6800672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Src\MyUtils\RECode\x64\Release\GameUtils.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CloseHandle CompareStringEx CompareStringW CreateDirectoryW CreateEventW CreateFile2 CreateFileW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DisableThreadLibraryCalls EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoA GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapCreate HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDBCSLeadByte IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32EnumProcessModules K32GetModuleFileNameExA K32GetModuleInformation LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingW OpenThread OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetConsoleOutputCP SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetThreadContext SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SuspendThread TerminateProcess Thread32First Thread32Next UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcpynW

user32

CallWindowProcA ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow EmptyClipboard GetAsyncKeyState GetCapture GetClientRect GetClipboardData GetCursorPos GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo IsWindowUnicode LoadCursorW OpenClipboard RegisterClassExW ReleaseCapture ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetWindowLongPtrW TrackMouseEvent UnregisterClassW

shell32

ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear

d3dcompiler_47

D3DCompile

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

ws2_32

WSCDeinstallProvider WSCEnumProtocols WSCGetProviderPath

dxgi

CreateDXGIFactory CreateDXGIFactory1

d3d12

ord101

Name

.text

Size

6.7MB

Virtual Size

6.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.5MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

299KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

45B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

824B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

76d6ab9ecfc84c560176710338d60715e253e493d8a0cbe8b2815b864666d686

PE Signature issue

kernel32

user32

shell32

ole32

oleaut32

d3dcompiler_47

imm32

ws2_32

dxgi

d3d12

generic