AdBlock360Setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AdBlock360Setup.exe
Size 736KB
Sample260724-rmh7dssbne
SHA256 1eb1056655168a7c4ed81a07425f5f80c28c7f4448552923de1cfbd23188a4c7
MD5 45c31bae4ec866546631dc8c2a72b248
SHA1 db58be0fb00f9b83f1ebba508ff046aec8d66265
SHA512 cdfd7b734378c394f826f673a9ace1d31740dcd2703e9ef3f12565df1abd411bf1f456c46bb751b935c6809f59d8ef313f7e3de1ffb132152e874460ec125307
SSDEEP 12288:fEoX5Mw6IOEXkSY4Cr23ph0lhSMXli3B1du5qSg:fE+MgOEUSHCS5h0lhSMXlkBXuYz
TLSH
T1C2F48C15F7B440F9E0A6C275896A497AFB727C8743A8974B03B0665E1F376980E3E331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

AdBlock360Setup.exe

.exe 736KB

AdBlock360Setup.exe

IMPHASH e3677f7c4cfa99a97b274a4780792e46
SHA256 1eb1056655168a7c4ed81a07425f5f80c28c7f4448552923de1cfbd23188a4c7
MD5 45c31bae4ec866546631dc8c2a72b248
SHA1 db58be0fb00f9b83f1ebba508ff046aec8d66265
SHA512 cdfd7b734378c394f826f673a9ace1d31740dcd2703e9ef3f12565df1abd411bf1f456c46bb751b935c6809f59d8ef313f7e3de1ffb132152e874460ec125307
SSDEEP 12288:fEoX5Mw6IOEXkSY4Cr23ph0lhSMXli3B1du5qSg:fE+MgOEUSHCS5h0lhSMXlkBXuYz
TLSH
T1C2F48C15F7B440F9E0A6C275896A497AFB727C8743A8974B03B0665E1F376980E3E331
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Password

mercimek123

Digest

04:58:7a:5d:23:28:25:ac:00:62:33:bc:80:6b:be:94:10:f5:4c:ab:6e:88:b0:c3:57:75:c1:76:a2:77:5d:e9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=C 104782,CN=ADBLOCK LIMITED,O=ADBLOCK LIMITED,L=Birkirkara,C=MT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024d54

Chains

Apr 24, 2026

SERIALNUMBER=C 104782,CN=ADBLOCK LIMITED,O=ADBLOCK LIMITED,L=Birkirkara,C=MT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024d54

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=C 104782,CN=ADBLOCK LIMITED,O=ADBLOCK LIMITED,L=Birkirkara,C=MT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024d54

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=C 104782,CN=ADBLOCK LIMITED,O=ADBLOCK LIMITED,L=Birkirkara,C=MT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024d54

Serial Number

01:25:76:8e:32:d5:78:53:c5:79:f0:e2:16:3e:c3:90

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 20, 2024 - Jun 20, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

234840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\AdBlock360\AdBlock360\WebInstaller\Bin\x64.Release\AdBlock360Setup.pdb

kernel32

GetModuleHandleW FreeLibrary lstrcmpiW GlobalUnlock LoadLibraryExW GetExitCodeProcess ReadFile SetEndOfFile WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID CreateProcessW GetLocaleInfoW LCMapStringW FindResourceW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GlobalLock IsValidLocale LoadResource RaiseException GlobalAlloc LockResource GetCurrentThreadId WaitForSingleObject CreateMutexW LeaveCriticalSection GetModuleFileNameW ExpandEnvironmentStringsW WriteFile GetCurrentProcess EnterCriticalSection SetLastError SizeofResource WideCharToMultiByte GetProcAddress CloseHandle DeleteFileW MultiByteToWideChar GetModuleHandleA GetFileAttributesW GetFileType GetStdHandle ExitProcess GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread CreateFileW DeleteCriticalSection TlsFree TlsSetValue DecodePointer GetLastError VirtualProtect InitializeCriticalSectionEx TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetSystemTimeAsFileTime RtlUnwind CompareStringEx LCMapStringEx GetExitCodeThread IsDebuggerPresent OutputDebugStringW EncodePointer HeapAlloc HeapFree GetProcessHeap InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle GetTempPathW AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW TryAcquireSRWLockExclusive Sleep WaitForSingleObjectEx

user32

PeekMessageW GetMonitorInfoW IsDialogMessageW DispatchMessageW GetWindowLongPtrW GetSystemMetrics SendMessageW SetWindowLongPtrW MonitorFromWindow MapWindowPoints DestroyWindow TranslateMessage GetWindow PostMessageW CallWindowProcW DefWindowProcW CreateDialogParamW GetMessageW GetWindowLongW SetWindowPos CharNextW BeginPaint EndPaint MessageBoxW UnregisterClassW GetClientRect GetDlgItem PostQuitMessage GetParent GetWindowRect LoadImageW

advapi32

CryptCreateHash RegOpenKeyA RegCloseKey GetTokenInformation CryptReleaseContext CryptGetHashParam CryptAcquireContextW RegQueryInfoKeyW EqualSid RegDeleteKeyW AllocateAndInitializeSid RegCreateKeyExW RegEnumKeyExW RegQueryValueExA CryptHashData RegSetValueExW CryptDestroyHash OpenProcessToken FreeSid RegOpenKeyExW RegDeleteValueW

shell32

ShellExecuteW

ole32

CoCreateInstance CoTaskMemFree CreateStreamOnHGlobal CoTaskMemRealloc CoTaskMemAlloc

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

msimg32

GradientFill

crypt32

CryptStringToBinaryA CryptBinaryToStringA CryptDecodeObject

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpCrackUrl

bcrypt

BCryptGenerateSymmetricKey BCryptEncrypt BCryptDestroyKey BCryptGetProperty BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider BCryptImportKeyPair BCryptSetProperty

gdiplus

GdipGetImageWidth GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipDisposeImage GdipCreateBitmapFromStream GdipDrawImageRectI GdipAlloc GdipCloneImage GdipGetImageHeight GdiplusShutdown GdiplusStartup

Name

.text

Size

386KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

242KB

Virtual Size

241KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AdBlock360Setup.exe

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

msimg32

crypt32

winhttp

bcrypt

gdiplus

generic