2e1d61a230245186cce9d7ed0882656671dc2c3e77ac62dc59ef2dbe75c4b96b

Sharing

Copy URL Twitter E-mail

General

Target
2e1d61a230245186cce9d7ed0882656671dc2c3e77ac62dc59ef2dbe75c4b96b
Size 424KB
Sample260722-srbtjsbr5t
SHA256 2e1d61a230245186cce9d7ed0882656671dc2c3e77ac62dc59ef2dbe75c4b96b
MD5 80f7682e6c20044d8f5bae6cea762b3f
SHA1 8f1377bcdf316ddc19ceb54bfa9adabe8f20a48a
SHA512 2704884b30cc0982329547abbca3d0e655b3829cebdb43f1e81621294d3809642fd30f3f82ac1721bf2130779615d5b65d38b26746e6373156a6b16c95a802c3
SSDEEP 6144:zUTxxIXB0iS0GaYApLhTrKUfdOtvHtKrr4Kdyj7XKUTa8m23d7KJqKWMJcjo+eCO:zUtNL8YcL5YHaI7XHgZQKhJgeCmdN
TLSH
T10994D023F6E1AF33E522C33444B57131E7BEA1359A2383275F642F95B89A2F04E55782
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2e1d61a230245186cce9d7ed0882656671dc2c3e77ac62dc59ef2dbe75c4b96b

File Explorer

2e1d61a230245186cce9d7ed0882656671dc2c3e77ac62dc59ef2dbe75c4b96b

.exe 424KB

2e1d61a230245186cce9d7ed0882656671dc2c3e77ac62dc59ef2dbe75c4b96b

IMPHASH c1298c589348389876de18cbe7fd398a
SHA256 2e1d61a230245186cce9d7ed0882656671dc2c3e77ac62dc59ef2dbe75c4b96b
MD5 80f7682e6c20044d8f5bae6cea762b3f
SHA1 8f1377bcdf316ddc19ceb54bfa9adabe8f20a48a
SHA512 2704884b30cc0982329547abbca3d0e655b3829cebdb43f1e81621294d3809642fd30f3f82ac1721bf2130779615d5b65d38b26746e6373156a6b16c95a802c3
SSDEEP 6144:zUTxxIXB0iS0GaYApLhTrKUfdOtvHtKrr4Kdyj7XKUTa8m23d7KJqKWMJcjo+eCO:zUtNL8YcL5YHaI7XHgZQKhJgeCmdN
TLSH
T10994D023F6E1AF33E522C33444B57131E7BEA1359A2383275F642F95B89A2F04E55782
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c8:97:2e:45:94:49:32:f9:e9:41:91:79:88:6e:e4:e5:7c:18:5e:f3

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2006

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 4, 2006 - Apr 26, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:46:9e:cb:00:04:00:00:00:65

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 4, 2006 - Oct 4, 2007

Minor OS version

Major OS version

Entry point

200200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

t:\dw\x86\ship\0\dwtrig20.pdb

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

secur32

GetUserNameExW

msvcr80

?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ _controlfp_s _invoke_watson _crt_debugger_hook _decode_pointer _onexit _lock __dllonexit _unlock _except_handler4_common __set_app_type _encode_pointer __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm __winitenv exit _XcptFilter _exit _cexit __wgetmainargs _amsg_exit fopen_s fwprintf_s fclose vsprintf_s wcscpy_s vswprintf_s wcsrchr _CxxThrowException _vsnprintf __CxxFrameHandler3 memmove _CIsqrt memcpy _wtol memset swprintf_s strncmp

advapi32

RegEnumKeyExW RegOpenKeyExA RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegCloseKey RegQueryInfoKeyW RegEnumKeyW RegEnumValueW GetLengthSid AddAccessAllowedAce AddAccessDeniedAce InitializeAcl OpenThreadToken RegQueryValueExA IsValidSid CheckTokenMembership ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid OpenProcessToken GetTokenInformation CopySid AllocateAndInitializeSid RegQueryValueExW

gdi32

DeleteDC DeleteObject CreateDCA CreateSolidBrush GetDeviceCaps

kernel32

Sleep TerminateProcess GetCurrentProcessId GetCurrentThreadId GlobalAlloc InitializeCriticalSection IsDBCSLeadByte GetStringTypeExW MultiByteToWideChar IsValidCodePage WideCharToMultiByte CompareStringW CreateDirectoryW GetShortPathNameW GetLongPathNameW GetCurrentThread GlobalMemoryStatus ReleaseSemaphore IsProcessorFeaturePresent VirtualProtect QueryPerformanceCounter GetTempFileNameA GetTempPathA InterlockedExchange InterlockedCompareExchange UnhandledExceptionFilter IsDebuggerPresent GetSystemWindowsDirectoryW lstrcmpiW CreateProcessW SetEvent lstrlenW GetModuleFileNameW CreateEventW WaitForSingleObject GetProcessHeap HeapFree HeapSize HeapValidate HeapAlloc HeapReAlloc GetModuleHandleA VirtualAlloc RaiseException TlsSetValue SetLastError GetLastError InitializeCriticalSectionAndSpinCount TlsAlloc GetSystemDefaultLCID VirtualFree TlsGetValue TlsFree DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetVersionExA IsValidLocale GetProcAddress LoadLibraryW FreeLibrary LoadLibraryA ReleaseMutex CloseHandle GetSystemTimeAsFileTime GetTickCount WriteFile SetFileAttributesW FlushFileBuffers DeleteFileW GetModuleHandleW GetFileAttributesW GetVersion GetFileType CreateFileW ExpandEnvironmentStringsW GetProcessTimes GetCurrentProcess CreateMutexA OpenMutexA CreateSemaphoreA GetShortPathNameA GetModuleFileNameA OutputDebugStringA LoadLibraryExW GetSystemDirectoryW GetVersionExW GetTimeZoneInformation GetDiskFreeSpaceExW GetSystemInfo GetUserDefaultLCID LocalFree LocalAlloc GlobalFree CreateProcessA SetUnhandledExceptionFilter

ole32

CoCreateInstance CoInitializeEx CoRegisterClassObject StringFromCLSID CoTaskMemFree CoRevokeClassObject CoUninitialize StringFromIID

oleaut32

LoadRegTypeLi SysAllocString LoadTypeLi SysFreeString

rpcrt4

UuidCreate

shell32

SHGetSpecialFolderPathW

user32

GetKeyboardLayout GetSystemMetrics GetMenuCheckMarkDimensions ReleaseDC GetDC SystemParametersInfoA GetMonitorInfoA EnumDisplayMonitors GetSysColor

Sharing

General

Malware Config

Signatures

File Explorer

2e1d61a230245186cce9d7ed0882656671dc2c3e77ac62dc59ef2dbe75c4b96b

PE Signature issue

version

secur32

msvcr80

advapi32

gdi32

kernel32

ole32

oleaut32

rpcrt4

shell32

user32

generic