878d9b8ff869a06fce1ab82f45541272e906c8406cc32efc69d1494cd041f182

Sharing

Copy URL Twitter E-mail

General

Target
878d9b8ff869a06fce1ab82f45541272e906c8406cc32efc69d1494cd041f182
Size 452KB
Sample260722-san3jstvbw
SHA256 878d9b8ff869a06fce1ab82f45541272e906c8406cc32efc69d1494cd041f182
MD5 b3d2092321803ed797cd35578040c8fc
SHA1 8a7dccdfda283f6fe474300e7a824c2512384823
SHA512 7aae701c08887656a3a6053351b17e7a2130ffe281538a9ed59c15756d1e20e4015a73333947a2be1d24691557fbd6257b8a803e3de74b560804e7543a6c5e33
SSDEEP 6144:DWdC+v3cpQvYJvKPSwv2nPEuJ1fHbIop44Sm5FpxyN90vEbsN7:SEpQQJvKPSwvY1fHTHy90w67
TLSH
T1DFA48C16B7D4C039D6A30630B8ADA76692FEFD706574420BB7D07B9A2C71982DB30B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
878d9b8ff869a06fce1ab82f45541272e906c8406cc32efc69d1494cd041f182

File Explorer

878d9b8ff869a06fce1ab82f45541272e906c8406cc32efc69d1494cd041f182

.exe 452KB

878d9b8ff869a06fce1ab82f45541272e906c8406cc32efc69d1494cd041f182

IMPHASH 2dfc2c74864b84f5530ab40a343c56d8
SHA256 878d9b8ff869a06fce1ab82f45541272e906c8406cc32efc69d1494cd041f182
MD5 b3d2092321803ed797cd35578040c8fc
SHA1 8a7dccdfda283f6fe474300e7a824c2512384823
SHA512 7aae701c08887656a3a6053351b17e7a2130ffe281538a9ed59c15756d1e20e4015a73333947a2be1d24691557fbd6257b8a803e3de74b560804e7543a6c5e33
SSDEEP 6144:DWdC+v3cpQvYJvKPSwv2nPEuJ1fHbIop44Sm5FpxyN90vEbsN7:SEpQQJvKPSwvY1fHTHy90w67
TLSH
T1DFA48C16B7D4C039D6A30630B8ADA76692FEFD706574420BB7D07B9A2C71982DB30B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

96:23:b8:a2:de:74:29:91:4a:14:17:0b:84:39:7f:b1:02:c4:45:8e

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2006

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 4, 2006 - Apr 26, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:46:9e:cb:00:04:00:00:00:65

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 4, 2006 - Oct 4, 2007

Minor OS version

Major OS version

Entry point

14695

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

t:\setupexe\x86\ship\0\setup.pdb

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

advapi32

RegQueryValueExA RegFlushKey RegCloseKey RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegOpenKeyExA

kernel32

lstrcmpW GetCommandLineW SetCurrentDirectoryW GlobalFree GetModuleFileNameW TlsFree LoadLibraryExW TlsSetValue TlsGetValue DeleteCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection HeapFree GetProcessHeap HeapAlloc HeapReAlloc VerifyVersionInfoW VerSetConditionMask RemoveDirectoryW GetTempPathW GetFullPathNameW CopyFileW DeleteFileW SetFileAttributesW GetFileAttributesW lstrlenW GetThreadLocale FreeLibrary GetModuleHandleW GetProcAddress lstrlenA WriteFile CreateFileW SetFilePointer FindFirstFileW FindClose IsProcessorFeaturePresent GlobalMemoryStatus GetCurrentProcess CompareStringW CompareStringA FormatMessageW ExpandEnvironmentStringsW MultiByteToWideChar WideCharToMultiByte GetVersion CloseHandle LocalFree GetTimeZoneInformation GetSystemTime SystemTimeToTzSpecificLocalTime GetCurrentProcessId GetTickCount GetCurrentThreadId SetErrorMode GetVersionExW GetLastError FindNextFileW SetLastError TlsAlloc GetCommandLineA GetVersionExA GetStartupInfoA RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException GetSystemTimeAsFileTime GetModuleHandleA ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType InterlockedIncrement InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter Sleep HeapSize GetCPInfo GetACP GetOEMCP VirtualAlloc InterlockedExchange LoadLibraryA InitializeCriticalSection GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers CreateFileA OutputDebugStringA GetSystemInfo

ole32

CoUninitialize CoCreateInstance CLSIDFromString CLSIDFromProgID OleRun CoInitializeEx

shell32

CommandLineToArgvW SHCreateDirectoryExW

user32

CharNextA MessageBoxW CharUpperA CharUpperW CharLowerA CharLowerW

shlwapi

PathGetCharTypeW

wintrust

WinVerifyTrust

dbghelp

SymGetSymFromAddr64 SymInitialize SymGetLineFromAddr64

oleaut32

GetErrorInfo VariantChangeType SysStringLen SysStringByteLen SysAllocStringByteLen SysAllocString SysFreeString VariantInit VariantClear

msi

ord8 ord159 ord160 ord110 ord117 ord91 ord67 ord172 ord180 ord95 ord31 ord65 ord71 ord141

Sharing

General

Malware Config

Signatures

File Explorer

878d9b8ff869a06fce1ab82f45541272e906c8406cc32efc69d1494cd041f182

PE Signature issue

version

advapi32

kernel32

ole32

shell32

user32

shlwapi

wintrust

dbghelp

oleaut32

msi

generic