f6267695406e18187acae2e55312d65ed817caf78a38db97552fb2308d695d38

General

Target
f6267695406e18187acae2e55312d65ed817caf78a38db97552fb2308d695d38
Size 1.0MB
Sample260724-kbamjsap2x
SHA256 f6267695406e18187acae2e55312d65ed817caf78a38db97552fb2308d695d38
MD5 99dcaa8383470125dd1d8d7dbc8ffeb8
SHA1 c967c083f60160f708b577b1fbb7a5b398726795
SHA512 9b8af7f8a3389e3a8a6dd25aa9e14d35e6ab07da2b8ade2739f0ff387bcd06c0a2e8e44513cb4960a8c4809494158f939a4e8491a725cbc608605db582aaa7e0
SSDEEP 12288:autAY9OIGKBzxzxzxzxzxzxzxzxzxzxzxzxzxzxzxzxzxzxzxzJ3k6zuYRJb:autqKB11111111111111111119k6TTb
TLSH
T14C354880FB862646C75CD7F699029CB9C2EEACEE061393C732127A7D7844B7C4A57253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
f6267695406e18187acae2e55312d65ed817caf78a38db97552fb2308d695d38

File Explorer

f6267695406e18187acae2e55312d65ed817caf78a38db97552fb2308d695d38

.dll 1.0MB

f6267695406e18187acae2e55312d65ed817caf78a38db97552fb2308d695d38

IMPHASH eb830f4a9829483ae0c6be206877122b
SHA256 f6267695406e18187acae2e55312d65ed817caf78a38db97552fb2308d695d38
MD5 99dcaa8383470125dd1d8d7dbc8ffeb8
SHA1 c967c083f60160f708b577b1fbb7a5b398726795
SHA512 9b8af7f8a3389e3a8a6dd25aa9e14d35e6ab07da2b8ade2739f0ff387bcd06c0a2e8e44513cb4960a8c4809494158f939a4e8491a725cbc608605db582aaa7e0
SSDEEP 12288:autAY9OIGKBzxzxzxzxzxzxzxzxzxzxzxzxzxzxzxzxzxzxzxzJ3k6zuYRJb:autqKB11111111111111111119k6TTb
TLSH
T14C354880FB862646C75CD7F699029CB9C2EEACEE061393C732127A7D7844B7C4A57253
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1a:31:27:15:26:21:ea:fb:bc:21:de:20:02:b9:d6:1d:70:ab:6f:95

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=JINHUA 9158 NETWORK SCIENCE AND TECHNOLOGY CO.\,LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=JINHUA 9158 NETWORK SCIENCE AND TECHNOLOGY CO.\,LTD.,L=Jinhua,ST=Zhejiang,C=CN

Chains

Jun 26, 2015

CN=JINHUA 9158 NETWORK SCIENCE AND TECHNOLOGY CO.\,LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=JINHUA 9158 NETWORK SCIENCE AND TECHNOLOGY CO.\,LTD.,L=Jinhua,ST=Zhejiang,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=JINHUA 9158 NETWORK SCIENCE AND TECHNOLOGY CO.\,LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=JINHUA 9158 NETWORK SCIENCE AND TECHNOLOGY CO.\,LTD.,L=Jinhua,ST=Zhejiang,C=CN

Serial Number

1a:f5:86:d6:64:d4:ad:1f:05:52:4f:d9:b3:bc:e3:4c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 28, 2012 - Aug 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

6

Entry point

50592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress LoadResource LockResource FindResourceW AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetCurrentThread GetThreadContext SetThreadContext VirtualProtect CreateFileW GetFileSizeEx WriteFile CloseHandle GetLastError GetCurrentProcess FreeLibrary LoadLibraryExW LoadLibraryW VirtualAlloc GetModuleHandleW GetModuleHandleExW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetFileAttributesW GetTempPathW IsDebuggerPresent SetUnhandledExceptionFilter WaitForSingleObject CreateEventA GetCurrentProcessId ExitProcess CreateThread GetCurrentThreadId OpenThread SuspendThread GetLocalTime GetSystemDirectoryW DisableThreadLibraryCalls GetModuleFileNameA WriteConsoleW HeapReAlloc HeapSize SetStdHandle GetConsoleMode ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter InitializeCriticalSectionEx GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCPInfo GetModuleFileNameW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetStdHandle GetFileType SetFilePointerEx GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap FlushFileBuffers GetConsoleOutputCP

user32

wsprintfA wsprintfW

advapi32

OpenProcessToken GetTokenInformation

shell32

ShellExecuteExA

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

709KB

Virtual Size

709KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f6267695406e18187acae2e55312d65ed817caf78a38db97552fb2308d695d38

PE Signature issue

kernel32

user32

advapi32

shell32

generic