181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db

Sharing

Copy URL Twitter E-mail

General

Target
181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db
Size 2.9MB
Sample260719-3avkfaas21
SHA256 181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db
MD5 2d632f094e7c2f42696c158ae365ca47
SHA1 b62cd4d3e5742a2d061504db75dbb66d73a7af82
SHA512 8fc106a34d63ba25bfb8e3cb44a36513eb2d6bf166d126351f83e38f61a3ea6e29438cbda17ac7cbe1b391dc16a9c391607597d7d51821085d394b87a24d4f35
SSDEEP 24576:PaZuNejWhftaY0jkcKpjaZPVdBzUwrD9vD5M33Una8c2MS1dDctmulYsaXTUmKfF:CZux2jkcKE3oGD5M33UaQDqmu9aNWB
TLSH
T1CDD5122224B4D8B5F061E1F9C8A3E1FFD5E67C42D128824F4D207DBA7E72651AD2B352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db

File Explorer

181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db

.exe 2.9MB

181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db

IMPHASH ce226b868ae2c11cdb5383c13163070c
SHA256 181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db
MD5 2d632f094e7c2f42696c158ae365ca47
SHA1 b62cd4d3e5742a2d061504db75dbb66d73a7af82
SHA512 8fc106a34d63ba25bfb8e3cb44a36513eb2d6bf166d126351f83e38f61a3ea6e29438cbda17ac7cbe1b391dc16a9c391607597d7d51821085d394b87a24d4f35
SSDEEP 24576:PaZuNejWhftaY0jkcKpjaZPVdBzUwrD9vD5M33Una8c2MS1dDctmulYsaXTUmKfF:CZux2jkcKE3oGD5M33UaQDqmu9aNWB
TLSH
T1CDD5122224B4D8B5F061E1F9C8A3E1FFD5E67C42D128824F4D207DBA7E72651AD2B352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8c:0d:78:23:88:47:ca:3d:16:91:f1:4f:36:f4:e9:78:18:a7:ba:af:f1:00:da:49:3d:5c:0b:a6:4a:35:22:fa

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=314202,CN=Wavesor Software (Eightpoint Technologies Ltd. SEZC),O=Wavesor Software (Eightpoint Technologies Ltd. SEZC),L=George Town,C=KY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b59

Chains

Aug 5, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

09:d7:7a:45:c1:c0:97:55:ae:3e:7a:51:53:98:3c:03

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 14, 2023 - Jul 20, 2026

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

109540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

ord17

shell32

SHGetMalloc SHGetSpecialFolderPathW ShellExecuteExW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHGetPathFromIDListW

gdi32

CreateCompatibleDC CreateFontIndirectW DeleteObject DeleteDC GetCurrentObject StretchBlt GetDeviceCaps CreateCompatibleBitmap SelectObject SetStretchBltMode GetObjectW

advapi32

FreeSid AllocateAndInitializeSid CheckTokenMembership

user32

IsWindow EnableWindow MessageBeep LoadIconW LoadImageW SetWindowsHookExW PtInRect CallNextHookEx DefWindowProcW CallWindowProcW DrawIconEx DialogBoxIndirectParamW GetWindow ClientToScreen GetDC DrawTextW ShowWindow SystemParametersInfoW GetSystemMetrics SetFocus UnhookWindowsHookEx GetWindowLongPtrW SetWindowLongPtrW GetClientRect EnableMenuItem GetKeyState MessageBoxA SetWindowTextW wsprintfA GetSysColor GetWindowTextLengthW GetWindowTextW GetClassNameA GetWindowLongW GetMenu SetWindowPos GetWindowDC ReleaseDC CopyImage GetParent GetWindowRect ScreenToClient CreateWindowExW GetSystemMenu GetMessageW DispatchMessageW SetTimer DestroyWindow CharUpperW EndDialog SendMessageW wsprintfW wvsprintfW GetDlgItem KillTimer

ole32

CreateStreamOnHGlobal CoInitialize CoCreateInstance

oleaut32

SysAllocString VariantClear OleLoadPicture

kernel32

EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects SetUnhandledExceptionFilter QueryPerformanceCounter GetTickCount DeleteCriticalSection SetEndOfFile SetFileTime ReadFile SetFilePointer GetFileSize FormatMessageW lstrcpyW LocalFree IsBadReadPtr GetSystemDirectoryW GetCurrentThreadId SuspendThread TerminateThread InitializeCriticalSection ResetEvent SetEvent CreateEventW GetVersionExW GetModuleFileNameW GetCurrentProcess SetProcessWorkingSetSize SetCurrentDirectoryW SetEnvironmentVariableW GetDriveTypeW CreateFileW GetCommandLineW GetStartupInfoW CreateProcessW CreateJobObjectW AssignProcessToJobObject CreateIoCompletionPort SetInformationJobObject ResumeThread GetQueuedCompletionStatus GetExitCodeProcess CloseHandle GetTempPathW GetSystemTimeAsFileTime lstrlenW CompareFileTime SetThreadLocale FindFirstFileW DeleteFileW FindNextFileW FindClose RemoveDirectoryW lstrcmpW ExpandEnvironmentStringsW WideCharToMultiByte VirtualAlloc GlobalMemoryStatusEx GetEnvironmentVariableW lstrcmpiW lstrlenA GetLocaleInfoW MultiByteToWideChar GetUserDefaultUILanguage GetSystemDefaultUILanguage GetSystemDefaultLCID lstrcmpiA GlobalAlloc GlobalFree MulDiv FindResourceExA ExitProcess lstrcatW AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetDiskFreeSpaceExW SetFileAttributesW SetLastError Sleep GetExitCodeThread WaitForSingleObject CreateThread GetLastError SystemTimeToFileTime GetLocalTime GetFileAttributesW CreateDirectoryW WriteFile GetStdHandle VirtualFree GetModuleHandleW GetProcAddress LoadLibraryA LockResource LoadResource SizeofResource GetCurrentProcessId

msvcrt

??3@YAXPEAX@Z ??2@YAPEAX_K@Z _purecall memcmp free memcpy _wtol memmove malloc wcsncmp strncmp _wcsnicmp memset ?_set_new_handler@@YAP6AH_K@ZP6AH0@Z@Z __CxxFrameHandler3 _beginthreadex _CxxThrowException __C_specific_handler _unlock __dllonexit _lock _onexit ??1type_info@@UEAA@XZ __getmainargs _XcptFilter _exit _ismbblead _cexit exit _acmdln _initterm _amsg_exit __setusermatherr _commode _fmode __set_app_type ?terminate@@YAXXZ

Sharing

General

Malware Config

Signatures

File Explorer

181910972449289a003645a257fbfc3f2f04238aabb37534ecb945bfe2b462db

PE Signature issue

comctl32

shell32

gdi32

advapi32

user32

ole32

oleaut32

kernel32

msvcrt

generic