77926[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
77926.exe
Size 907KB
Sample260720-sqdxhset2l
SHA256 4adf2ecf694884886667c15a1b86b5d937c35089a97afc585ad524660d85c1b5
MD5 92d912a3434d265c479ea83999def656
SHA1 9d4ebf011a4045a4e3c7c74f5427fc4724a2956b
SHA512 04ddd9645bcbc98f450811ec9210d176bb7f7f387c93534a8affcca563207a358f2dcf3f136559f2c70d1da9479afe4ff070c1c7d22c6ee74d42c6a46b07b394
SSDEEP 12288:ov5WvMivaIioO0lBs6sF/u7YVnKjZT4c/IzFJo0LcSPdz:jHjs65YVnKN8cARJpPdz
TLSH
T145154A497B9488B8E6B78539DE5A4012C5BB3D840F3A95DF0790339A8F37EC45E36B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
77926.exe

File Explorer

77926.exe

.exe 907KB

77926.exe

IMPHASH ef797a795f6d2e21538eb406839cbb8a
SHA256 4adf2ecf694884886667c15a1b86b5d937c35089a97afc585ad524660d85c1b5
MD5 92d912a3434d265c479ea83999def656
SHA1 9d4ebf011a4045a4e3c7c74f5427fc4724a2956b
SHA512 04ddd9645bcbc98f450811ec9210d176bb7f7f387c93534a8affcca563207a358f2dcf3f136559f2c70d1da9479afe4ff070c1c7d22c6ee74d42c6a46b07b394
SSDEEP 12288:ov5WvMivaIioO0lBs6sF/u7YVnKjZT4c/IzFJo0LcSPdz:jHjs65YVnKN8cARJpPdz
TLSH
T145154A497B9488B8E6B78539DE5A4012C5BB3D840F3A95DF0790339A8F37EC45E36B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

7e:7b:63:ba:34:c0:26:7f:9a:3e:e9:b1:cf:f9:0a:9f:19:90:ed:51

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Electronic Arts\, Inc.,OU=Origin Client,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US

Chains

Aug 5, 2020

CN=Electronic Arts\, Inc.,OU=Origin Client,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Electronic Arts\, Inc.,OU=Origin Client,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US

Serial Number

40:34:f5:c0:88:00:36:de:88:fd:5d:ef:72:6b:f5:94

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 16, 2020 - Jul 16, 2021

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

239968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

kernel32

LoadLibraryA FormatMessageA QueryPerformanceFrequency GetTempPathW DuplicateHandle CreateProcessA ReadConsoleW Sleep WriteFile FlushFileBuffers SetFilePointer CloseHandle GetDriveTypeW CreateDirectoryW CreateFileW GetProcAddress GetLongPathNameW OpenProcess GetLastError LoadResource GetFileSize ReadFile FindClose GetSystemInfo lstrlenW LoadLibraryW GetModuleFileNameW GetModuleHandleW FindResourceExW GetCurrentDirectoryW RemoveDirectoryW QueryDosDeviceW SetFileAttributesW GetFileAttributesW FindFirstFileW FindNextFileW GetVersionExW WideCharToMultiByte GetUserDefaultLangID CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GetCurrentThreadId CreateThread ReleaseMutex WaitForSingleObject CreateMutexW CreateProcessW CopyFileW GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetFileAttributesExW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW LocalFree RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleFileNameA ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetFileType GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStringTypeW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle GetProcessHeap HeapSize HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW MoveFileExW CreatePipe DeleteFileW GetSystemDirectoryW GetEnvironmentVariableW IsProcessorFeaturePresent MultiByteToWideChar SetEndOfFile

shell32

SHCreateDirectoryExW SHGetFolderPathW ShellExecuteW ord165

ole32

CoCreateInstance CoUninitialize CoInitialize CoTaskMemFree

oleaut32

VariantClear SysFreeString SysAllocString

shlwapi

PathRemoveFileSpecW

msi

ord113

user32

GetDC GetDlgItem SetWindowPlacement DestroyWindow SetWindowTextW GetSystemMetrics MessageBoxW IsWindow SetWindowsHookExW PostMessageW DispatchMessageW IsDialogMessageW SetDlgItemTextW CreateDialogParamW SendMessageW ShowWindow TranslateMessage GetMessageW LoadIconW CallNextHookEx UnhookWindowsHookEx GetWindowPlacement

gdi32

GetTextExtentPoint32W

advapi32

AllocateAndInitializeSid FreeSid CheckTokenMembership RegCloseKey RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW RegQueryValueExW RegDeleteValueW RegSetValueExW RegCreateKeyExW

Name

.text

Size

431KB

Virtual Size

431KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

127KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

312KB

Virtual Size

312KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

77926.exe

PE Signature issue

kernel32

shell32

ole32

oleaut32

shlwapi

msi

user32

gdi32

advapi32

generic