3b859db3c828efa8624fb63fc07dd79e87d4c2fa6b1c13a9595f0f59ae22a41f

Sharing

Copy URL Twitter E-mail

General

Target
3b859db3c828efa8624fb63fc07dd79e87d4c2fa6b1c13a9595f0f59ae22a41f
Size 251KB
Sample260719-hmfxlagy21
SHA256 3b859db3c828efa8624fb63fc07dd79e87d4c2fa6b1c13a9595f0f59ae22a41f
MD5 d038258fdbd076fce32d92f4bd0c4371
SHA1 1eca99ec468a52bd8f791db091225deea5e7dc48
SHA512 538ca0ab2da35677631faf2466eae30fcccb67d94141b307ad29276d26a0871a87c7ac64c53d4e756fb7f0c890f0c2195f8db818cd13f4649569e9d8b886f4e5
SSDEEP 6144:1ZSW+EmWqJpJ2/dellJMDP8h8OOBV+UdvrEFp7hKdFC:GXWqTJ2/dellJMoxOBjvrEH79
TLSH
T1A544E443AACC3FEAC4344270337F97D5C7AEDE681AA2C08F96D0029599BC54379627D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
3b859db3c828efa8624fb63fc07dd79e87d4c2fa6b1c13a9595f0f59ae22a41f

File Explorer

3b859db3c828efa8624fb63fc07dd79e87d4c2fa6b1c13a9595f0f59ae22a41f

.exe 251KB

3b859db3c828efa8624fb63fc07dd79e87d4c2fa6b1c13a9595f0f59ae22a41f

IMPHASH e910e5b538d4958ba3fcb33a110c3c01
SHA256 3b859db3c828efa8624fb63fc07dd79e87d4c2fa6b1c13a9595f0f59ae22a41f
MD5 d038258fdbd076fce32d92f4bd0c4371
SHA1 1eca99ec468a52bd8f791db091225deea5e7dc48
SHA512 538ca0ab2da35677631faf2466eae30fcccb67d94141b307ad29276d26a0871a87c7ac64c53d4e756fb7f0c890f0c2195f8db818cd13f4649569e9d8b886f4e5
SSDEEP 6144:1ZSW+EmWqJpJ2/dellJMDP8h8OOBV+UdvrEFp7hKdFC:GXWqTJ2/dellJMoxOBjvrEH79
TLSH
T1A544E443AACC3FEAC4344270337F97D5C7AEDE681AA2C08F96D0029599BC54379627D9
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

01:a8:61:a7:42:17:ff:de:fd:ab:2d:28:d9:d4:8a:05:2a:35:2c:64:3c:80:1a:5e:29:4e:48:96:bd:93:96:57

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,OU=SYS BG-PC BU-SW RD Ctr,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 29, 2024

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

04:f8:6c:94:51:84:95:19:44:26:a7:cd:ac:0d:ba:3c

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 4, 2021 - May 8, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

50311

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Tool\ASUS Smart Display Control\ASUS Smart Display Control V2.10.0\Release\ASUSSmartDisplayControl.pdb

kernel32

CreateThread WaitForSingleObject HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap Sleep CreateEventW ResetEvent GetSystemPowerStatus OpenMutexW CreateMutexW CreateDirectoryW GetProcAddress GetModuleHandleW GetCurrentProcess DeviceIoControl GetFileAttributesW ReadDirectoryChangesW FindResourceExW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringW IsDebuggerPresent CloseHandle SizeofResource FindResourceW LockResource LoadResource DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException MultiByteToWideChar CreateFileW LocalFree

user32

SendMessageTimeoutW EndDialog PostQuitMessage UnregisterPowerSettingNotification EndPaint RegisterClassExW DefWindowProcW DestroyWindow DialogBoxParamW RegisterDeviceNotificationW CreateWindowExW ShowWindow BeginPaint PostMessageW RegisterWindowMessageW RegisterPowerSettingNotification UpdateWindow ChangeDisplaySettingsExW LoadAcceleratorsW EnumDisplaySettingsW EnumDisplayDevicesW TranslateMessage DispatchMessageW GetMessageW LoadStringW LoadCursorW LoadIconW TranslateAcceleratorW

advapi32

RegOpenKeyExW RegEnumKeyExW RegNotifyChangeKeyValue RegQueryValueExW RegSetValueExW RegGetValueW RegCloseKey

ole32

CoUninitialize CoInitializeSecurity CoSetProxyBlanket CoInitializeEx CoCreateInstance

oleaut32

VariantClear SysFreeString SysAllocString

shlwapi

StrStrW

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?uncaught_exception@std@@YA_NXZ

cfgmgr32

CM_Locate_DevNodeW CM_Reenumerate_DevNode

vcruntime140

__std_exception_destroy __std_exception_copy _except_handler4_common _CxxThrowException memset memmove __std_terminate __CxxFrameHandler3 wcschr memcpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free realloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_cexit terminate _seh_filter_exe _set_app_type _register_onexit_function _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _invalid_parameter_noinfo _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _errno _controlfp_s _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwscanf __stdio_common_vswprintf_s __stdio_common_vswprintf _set_fmode __p__commode __stdio_common_vfprintf __stdio_common_vfwprintf fgets fopen_s __stdio_common_vfscanf fclose

api-ms-win-crt-string-l1-1-0

wcstok_s wcsspn wmemcpy_s _wcsicmp iswspace _wcsupr_s wcscspn

api-ms-win-crt-filesystem-l1-1-0

_access

api-ms-win-crt-convert-l1-1-0

_itoa wcstol _wtoi _wtol

api-ms-win-crt-math-l1-1-0

__setusermatherr _libm_sse2_pow_precise round

api-ms-win-crt-time-l1-1-0

_time64 asctime _localtime64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

3b859db3c828efa8624fb63fc07dd79e87d4c2fa6b1c13a9595f0f59ae22a41f

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

wtsapi32

msvcp140

cfgmgr32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic