8cfd04ba4eb6517e766f3992a67582053b40b8d53cab65546d55555b2723e304

Sharing

Copy URL Twitter E-mail

General

Target
8cfd04ba4eb6517e766f3992a67582053b40b8d53cab65546d55555b2723e304
Size 102KB
Sample260722-q6fpyafe23
SHA256 8cfd04ba4eb6517e766f3992a67582053b40b8d53cab65546d55555b2723e304
MD5 f8e40273a5863fa72fca95119115ebc8
SHA1 3b64db954e661f152a3e68630b7d82fa7c00b57b
SHA512 18797073ae0e228c48d9d3c74f3d44b5c27604d39c33d106e857fa6210ab4446b2f4746345a064aa9c9743b9608f33d9c60ee0295a186076fed0f3288de51ed1
SSDEEP 1536:EV1RJzn+w9f/TPx3msSPWemIb4fFrRVHbkFcYeonX2gwLB/90+SJOod:EV1RJz+OnTPx3eO7IiTHwFcNoX88+S
TLSH
T13AA35B1773A110F8E0E682388CE2EA56FBB1B8455B31638F52A4475E2F637D19E3D325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
8cfd04ba4eb6517e766f3992a67582053b40b8d53cab65546d55555b2723e304

File Explorer

8cfd04ba4eb6517e766f3992a67582053b40b8d53cab65546d55555b2723e304

.exe 102KB

8cfd04ba4eb6517e766f3992a67582053b40b8d53cab65546d55555b2723e304

IMPHASH 101188fdd06e430cf51f908f0e01c6cd
SHA256 8cfd04ba4eb6517e766f3992a67582053b40b8d53cab65546d55555b2723e304
MD5 f8e40273a5863fa72fca95119115ebc8
SHA1 3b64db954e661f152a3e68630b7d82fa7c00b57b
SHA512 18797073ae0e228c48d9d3c74f3d44b5c27604d39c33d106e857fa6210ab4446b2f4746345a064aa9c9743b9608f33d9c60ee0295a186076fed0f3288de51ed1
SSDEEP 1536:EV1RJzn+w9f/TPx3msSPWemIb4fFrRVHbkFcYeonX2gwLB/90+SJOod:EV1RJz+OnTPx3eO7IiTHwFcNoX88+S
TLSH
T13AA35B1773A110F8E0E682388CE2EA56FBB1B8455B31638F52A4475E2F637D19E3D325
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

5f:23:71:d8:b4:9b:58:a4:1e:96:d7:b4:d9:07:73:3a:2c:06:42:39

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Renesas Electronics Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Quality Assurancs Division,O=Renesas Electronics Corporation,L=Kawasaki,ST=Kanagawa,C=JP

Chains

Sep 16, 2011

CN=Renesas Electronics Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Quality Assurancs Division,O=Renesas Electronics Corporation,L=Kawasaki,ST=Kanagawa,C=JP

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Renesas Electronics Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Quality Assurancs Division,O=Renesas Electronics Corporation,L=Kawasaki,ST=Kanagawa,C=JP

Serial Number

75:f8:62:2a:53:13:5e:50:83:7b:a7:45:1c:83:6d:99

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 12, 2011 - Apr 11, 2012

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

14116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Build\Server\Server2010\x64\Release\UServer.pdb

user32

wsprintfA ShowWindow CreateWindowExW PostQuitMessage EndPaint BeginPaint DefWindowProcW RegisterClassExW LoadCursorW KillTimer SetTimer DispatchMessageW GetMessageW UpdateWindow TranslateMessage

ntdll

RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind RtlCaptureContext NtQueryInformationProcess RtlAllocateHeap RtlFreeHeap NtClose NtDuplicateObject DbgUiSetThreadDebugObject NtRemoveProcessDebug

rpcrt4

NdrAsyncClientCall RpcStringBindingComposeW RpcBindingFree RpcBindingFromStringBindingW RpcBindingSetAuthInfoExW RpcStringFreeW RpcAsyncInitializeHandle RpcAsyncCompleteCall RpcRaiseException

kernel32

Process32NextW TerminateProcess GetModuleFileNameA lstrcatW WaitForDebugEvent lstrcpyW ContinueDebugEvent UpdateProcThreadAttribute InitializeProcThreadAttributeList CreateProcessAsUserW DeleteProcThreadAttributeList LocalAlloc LocalFree CreateEventW WaitForSingleObject CreateToolhelp32Snapshot GetProcessHeap CloseHandle GetProcessId DuplicateHandle lstrcmpiW GetStringTypeW MultiByteToWideChar RaiseException GetLastError HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer EncodePointer GetCommandLineW GetStartupInfoW HeapSetInformation GetVersion HeapCreate WriteFile GetStdHandle GetModuleFileNameW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LCMapStringW GetCurrentProcess FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc Sleep HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WideCharToMultiByte GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc Process32FirstW

advapi32

StartServiceW LookupPrivilegeValueW OpenProcessToken CreateWellKnownSid OpenServiceW QueryServiceStatus AdjustTokenPrivileges OpenSCManagerW EnumServicesStatusExW CloseServiceHandle

shell32

IsUserAnAdmin ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

8cfd04ba4eb6517e766f3992a67582053b40b8d53cab65546d55555b2723e304

PE Signature issue

user32

ntdll

rpcrt4

kernel32

advapi32

shell32

generic