f5f6e7bfa966040585c586253784bf66a2c930e1c1ca136d01378d8deb7e228c

Sharing

Copy URL Twitter E-mail

General

Target
f5f6e7bfa966040585c586253784bf66a2c930e1c1ca136d01378d8deb7e228c
Size 1.8MB
Sample260722-sfxxmsgb99
SHA256 f5f6e7bfa966040585c586253784bf66a2c930e1c1ca136d01378d8deb7e228c
MD5 473f044e0c3e2e22421f410aa34db06b
SHA1 ef166da246a779578de74a80cd8c8a1c3661d36a
SHA512 0c6cb4f4e3e8a36c191ba87e04708e7f20b905ac46d81c95cc4cd596148e2e9f828dccfc129464295eb2e2f1e5385e5fc3342c6104562d119750713fa98dbb09
SSDEEP 24576:p/m1otJlCxy4iKaRSGdb22dJ0Nd4ksGZPdb55qfYONZOu4t79PxMBl0YgiHZHnGA:41w4xQKaRzpENQ2lXqQGZ3T03M9nE0
TLSH
T1AE95330294E44237E9EAC7F440DA75E3D3ECF9986E903697964E42C3CD163DA7E3811A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
f5f6e7bfa966040585c586253784bf66a2c930e1c1ca136d01378d8deb7e228c

File Explorer

f5f6e7bfa966040585c586253784bf66a2c930e1c1ca136d01378d8deb7e228c

.exe 1.8MB

f5f6e7bfa966040585c586253784bf66a2c930e1c1ca136d01378d8deb7e228c

IMPHASH 0ebb3c09b06b1666d307952e824c8697
SHA256 f5f6e7bfa966040585c586253784bf66a2c930e1c1ca136d01378d8deb7e228c
MD5 473f044e0c3e2e22421f410aa34db06b
SHA1 ef166da246a779578de74a80cd8c8a1c3661d36a
SHA512 0c6cb4f4e3e8a36c191ba87e04708e7f20b905ac46d81c95cc4cd596148e2e9f828dccfc129464295eb2e2f1e5385e5fc3342c6104562d119750713fa98dbb09
SSDEEP 24576:p/m1otJlCxy4iKaRSGdb22dJ0Nd4ksGZPdb55qfYONZOu4t79PxMBl0YgiHZHnGA:41w4xQKaRzpENQ2lXqQGZ3T03M9nE0
TLSH
T1AE95330294E44237E9EAC7F440DA75E3D3ECF9986E903697964E42C3CD163DA7E3811A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

98:54:5a:18:d6:1b:d2:40:11:8a:65:5d:ac:ef:28:6a:a8:d1:46:63

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 1, 2005

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 23, 2002 - Sep 25, 2011

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:87:58:00:03:00:00:00:5a

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 5, 2005 - Apr 5, 2006

Minor OS version

Major OS version

Entry point

25692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

FreeSid AllocateAndInitializeSid EqualSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA RegCloseKey RegDeleteValueA RegOpenKeyExA RegSetValueExA RegQueryValueExA RegCreateKeyExA RegQueryInfoKeyA

kernel32

LocalFree LocalAlloc GetLastError GetCurrentProcess lstrlenA GetModuleFileNameA GetSystemDirectoryA _lclose _llseek _lopen WritePrivateProfileStringA GetWindowsDirectoryA CreateDirectoryA GetFileAttributesA ExpandEnvironmentStringsA lstrcpyA GlobalFree GlobalUnlock GlobalLock GlobalAlloc IsDBCSLeadByte GetShortPathNameA GetPrivateProfileStringA GetPrivateProfileIntA lstrcmpiA RemoveDirectoryA FindClose FindNextFileA DeleteFileA SetFileAttributesA lstrcmpA FindFirstFileA FreeResource GetProcAddress LoadResource SizeofResource FindResourceA lstrcatA CloseHandle WriteFile SetFilePointer SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetCurrentDirectoryA GetTempFileNameA ExitProcess CreateFileA LoadLibraryExA lstrcpynA GetVolumeInformationA FormatMessageA GetCurrentDirectoryA GetVersionExA GetExitCodeProcess WaitForSingleObject CreateProcessA GetTempPathA GetSystemInfo CreateMutexA SetEvent CreateEventA CreateThread ResetEvent TerminateThread GetDriveTypeA GetModuleHandleA GetStartupInfoA GetCommandLineA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter ReadFile LoadLibraryA GetDiskFreeSpaceA MulDiv EnumResourceLanguagesA FreeLibrary LockResource

gdi32

GetDeviceCaps

user32

ExitWindowsEx wsprintfA CharNextA CharUpperA CharPrevA SetWindowLongA GetWindowLongA CallWindowProcA DispatchMessageA MsgWaitForMultipleObjects PeekMessageA SendMessageA SetWindowPos ReleaseDC GetDC GetWindowRect SendDlgItemMessageA GetDlgItem SetForegroundWindow SetWindowTextA MessageBoxA DialogBoxIndirectParamA ShowWindow EnableWindow GetDlgItemTextA EndDialog GetDesktopWindow MessageBeep SetDlgItemTextA LoadStringA GetSystemMetrics

comctl32

ord17

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

Sharing

General

Malware Config

Signatures

File Explorer

f5f6e7bfa966040585c586253784bf66a2c930e1c1ca136d01378d8deb7e228c

PE Signature issue

advapi32

kernel32

gdi32

user32

comctl32

version

generic