oo-syspectr-setup849e83d8-3a28-4b29-bb6d-0df23b31e39f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
oo-syspectr-setup849e83d8-3a28-4b29-bb6d-0df23b31e39f.exe
Size 11.2MB
Sample260729-rhryqshe98
SHA256 e9a902cb380eda3d3b4e4153c3f8c637a650bd51d299f3a75dce4c0007a64985
MD5 5de758dd6164000fe5e51ca090bdd48d
SHA1 18de7cf4fb8795c1afaae4b2451cf73bbcb7e4f9
SHA512 9a176fc29a4b604291601c9a4d922d11feb4f1f64f7e5a569fc5b91149cd1e97bf350d325c1abc873b96e3a6b798ec2a6c8bd5399199b4b55d50957da2db041b
SSDEEP 196608:dCM2Dy1aF7tKyq4Ez/zlDQRTIhzgPP1nR/gOxL8+1llCssVAg8JxAHsZ0u:OD7oz/xW7PdR/Nxnkxu
TLSH
T1E0C637112740C063C3164E34D90DA7F6A169AC31FAA5EE8F16D8BE0C3A754F2969C67F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

oo-syspectr-setup849e83d8-3a28-4b29-bb6d-0df23b31e39f.exe

.exe 11.2MB

oo-syspectr-setup849e83d8-3a28-4b29-bb6d-0df23b31e39f.exe

IMPHASH dda935bbdac20f979ad9e537b892c62e
SHA256 e9a902cb380eda3d3b4e4153c3f8c637a650bd51d299f3a75dce4c0007a64985
MD5 5de758dd6164000fe5e51ca090bdd48d
SHA1 18de7cf4fb8795c1afaae4b2451cf73bbcb7e4f9
SHA512 9a176fc29a4b604291601c9a4d922d11feb4f1f64f7e5a569fc5b91149cd1e97bf350d325c1abc873b96e3a6b798ec2a6c8bd5399199b4b55d50957da2db041b
SSDEEP 196608:dCM2Dy1aF7tKyq4Ez/zlDQRTIhzgPP1nR/gOxL8+1llCssVAg8JxAHsZ0u:OD7oz/xW7PdR/Nxnkxu
TLSH
T1E0C637112740C063C3164E34D90DA7F6A169AC31FAA5EE8F16D8BE0C3A754F2969C67F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

fe:fc:06:3e:4a:f9:0f:e6:49:58:85:76:50:cc:44:9a:36:e6:b2:dd:3f:22:a8:ca:80:c6:a6:78:ae:9a:de:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=O&O Software GmbH,O=O&O Software GmbH,L=Berlin,ST=Berlin,C=DE

Chains

Nov 25, 2022

CN=O&O Software GmbH,O=O&O Software GmbH,L=Berlin,ST=Berlin,C=DE

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

60:31:93:39:d6:6c:e8:18:0d:57:3a:16:ff:37:4d:21:c9:32:b6:2e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=O&O Software GmbH,O=O&O Software GmbH,L=Berlin,ST=Berlin,C=DE

Chains

Nov 25, 2022

CN=O&O Software GmbH,O=O&O Software GmbH,L=Berlin,ST=Berlin,C=DE

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=O&O Software GmbH,O=O&O Software GmbH,L=Berlin,ST=Berlin,C=DE

Serial Number

05:a4:b4:e2:f8:9b:34:d1:79:fb:48:c3:64:22:51:c8

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 12, 2021 - Feb 21, 2023

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1437080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\jenkins-slave\workspace\oosys_OOSYS-CLIENT_0.206\installation\InstallationStub\Release\InstallationStub.pdb

kernel32

UnmapViewOfFile CreateFileMappingW CreateEventW MapViewOfFile CloseHandle WaitForMultipleObjects CreateFileW WriteFile HeapFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx HeapSize GetLastError HeapReAlloc RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap FindResourceW LoadResource LockResource SizeofResource CreateProcessW WaitForSingleObject GetProcAddress GetModuleHandleW CopyFileW GetTempPathW GetModuleFileNameW GetCurrentThreadId TerminateProcess FindFirstFileW FindClose GetUserDefaultLCID GetCommandLineW CreateThread Sleep GetExitCodeThread DeleteFileW OutputDebugStringA EncodePointer SetLastError GetSystemDirectoryW FreeLibrary GetModuleHandleA LoadLibraryExW LoadLibraryA LoadLibraryW GlobalDeleteAtom lstrcmpW GlobalAddAtomW GlobalFindAtomW CompareStringW GlobalAlloc GlobalUnlock GlobalLock MultiByteToWideChar WideCharToMultiByte FlushFileBuffers GetFileSize GetFullPathNameW GetVolumeInformationW LockFile ReadFile SetEndOfFile SetFilePointer UnlockFile DuplicateHandle GetCurrentProcess lstrcmpiW GetThreadLocale GlobalFree GlobalSize LocalFree MulDiv FormatMessageW InitializeCriticalSectionAndSpinCount LocalAlloc SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GetCurrentThread GetVersionExW lstrcmpA GetTickCount SetEvent SetThreadPriority ResumeThread GetCurrentProcessId GlobalGetAtomNameW InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalReAlloc GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalFlags VirtualProtect FileTimeToLocalFileTime GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileTime SetErrorMode FindNextFileW GetCurrentDirectoryW lstrcpyW FindResourceExW GetWindowsDirectoryW VerSetConditionMask VerifyVersionInfoW GetProfileIntW SearchPathW GetTempFileNameW ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW WriteConsoleW OutputDebugStringW GetStringTypeW LCMapStringEx CompareStringEx GetCPInfo RtlUnwind GetSystemInfo VirtualAlloc VirtualQuery GetCommandLineA ExitThread FreeLibraryAndExitThread GetModuleHandleExW HeapQueryInformation SetStdHandle GetFileType QueryPerformanceFrequency GetStdHandle ExitProcess LCMapStringW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW LoadLibraryExA

credui

CredUIPromptForCredentialsW

Sharing

General

Malware Config

Signatures

File Explorer

oo-syspectr-setup849e83d8-3a28-4b29-bb6d-0df23b31e39f.exe

kernel32

credui

generic