CSISysFilesInstall[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CSISysFilesInstall.exe
Size 33.3MB
Sample260730-sraw9ack31
SHA256 af53c0d0919c4b1ca010ba5865edb74a5150929220358463e32895197a582e5e
MD5 d77c92847d7d2da044ab4149973f0496
SHA1 2d3f59d2bda6b85227f4e538521841b1dcb22f53
SHA512 93dc4a5d3574d1b6ab584238b3c5b448ff4e9d1a66fddb22d19565c1117501bad4151a9b38077a57f8b9c502c8a8e786afd0c821cc44fd8283e64a735aeb8482
SSDEEP 786432:HdZalvxDkWznLEGQpC2ibPIVZ7vFdpB8Gt0/SaYYdNq9Od1:HzgDkknspybPIVZLFdpB8fKaYYdNd
TLSH
T1887722CDA16B1521DE01C37F80A5E6FB5E687D70AFC3D9855ADC6C9C64A19A0E30BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
CSISysFilesInstall.exe

File Explorer

CSISysFilesInstall.exe

.exe 33.3MB

CSISysFilesInstall.exe

IMPHASH ee5d64bd299805320bf7ca40b8082306
SHA256 af53c0d0919c4b1ca010ba5865edb74a5150929220358463e32895197a582e5e
MD5 d77c92847d7d2da044ab4149973f0496
SHA1 2d3f59d2bda6b85227f4e538521841b1dcb22f53
SHA512 93dc4a5d3574d1b6ab584238b3c5b448ff4e9d1a66fddb22d19565c1117501bad4151a9b38077a57f8b9c502c8a8e786afd0c821cc44fd8283e64a735aeb8482
SSDEEP 786432:HdZalvxDkWznLEGQpC2ibPIVZ7vFdpB8Gt0/SaYYdNq9Od1:HzgDkknspybPIVZLFdpB8fKaYYdNd
TLSH
T1887722CDA16B1521DE01C37F80A5E6FB5E687D70AFC3D9855ADC6C9C64A19A0E30BC23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

50:0e:1a:f5:3e:fe:d6:35:0f:0b:08:94:58:f2:82:a9:ad:38:2d:c8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=COBRA Solutions\, Inc.,O=COBRA Solutions\, Inc.,L=Tempe,ST=AZ,C=US

Chains

Aug 1, 2014

CN=COBRA Solutions\, Inc.,O=COBRA Solutions\, Inc.,L=Tempe,ST=AZ,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

SERIALNUMBER=10688435,CN=Starfield Secure Certification Authority,OU=http://certificates.starfieldtech.com/repository,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

02:01

Issuer

OU=Starfield Class 2 Certification Authority,O=Starfield Technologies\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 16, 2006 - Nov 16, 2026

Subject

CN=COBRA Solutions\, Inc.,O=COBRA Solutions\, Inc.,L=Tempe,ST=AZ,C=US

Serial Number

4b:65:e1:45:7b:11:65

Issuer

SERIALNUMBER=10688435,CN=Starfield Secure Certification Authority,OU=http://certificates.starfieldtech.com/repository,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 4, 2013 - Apr 4, 2015

Minor OS version

Major OS version

Entry point

170348

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

shell32

SHGetPathFromIDListA ShellExecuteA SHBrowseForFolderA SHGetMalloc

comctl32

ord17

kernel32

DuplicateHandle GetCurrentProcess ExitProcess WaitForSingleObject CreateProcessA lstrcpyA GetWindowsDirectoryA SetErrorMode GetTempPathA ExpandEnvironmentStringsA lstrcmpA lstrcmpiA GetTickCount GetExitCodeThread CreateThread CopyFileA InterlockedIncrement InterlockedDecrement QueryPerformanceFrequency CreateEventA lstrcatA GetTempFileNameA CompareStringA CompareStringW GetVersionExA SetFilePointer SetFileAttributesA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime FreeLibrary GetProcAddress LoadLibraryA LockResource LoadResource SizeofResource FindResourceA GetSystemDefaultLCID GlobalHandle VerLanguageNameA FormatMessageA LocalFree GetLocalTime MoveFileA SetCurrentDirectoryA FindClose FindNextFileA CompareFileTime FindFirstFileA GetSystemTimeAsFileTime GetSystemInfo MulDiv IsValidCodePage GetVersion FlushFileBuffers SetEndOfFile GetDiskFreeSpaceA GetDriveTypeA CreateDirectoryA MapViewOfFile GetCurrentThread GetLocaleInfoA GetFileType GetStdHandle GetThreadContext GetEnvironmentStringsW SetLastError FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetOEMCP GetACP GetCPInfo SetUnhandledExceptionFilter LCMapStringW LCMapStringA IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA TlsGetValue TlsAlloc TlsSetValue GetCurrentThreadId HeapSize HeapReAlloc GetCommandLineA GetStartupInfoA RaiseException RtlUnwind DeleteCriticalSection InterlockedExchange IsBadReadPtr SystemTimeToFileTime QueryPerformanceCounter ResetEvent SetEvent GetShortPathNameA VirtualProtect VirtualQuery EnterCriticalSection LeaveCriticalSection InitializeCriticalSection TerminateProcess GetModuleHandleA SearchPathA SetStdHandle UnmapViewOfFile lstrlenA CreateFileA GetFileSize GlobalAlloc CloseHandle VirtualProtectEx WriteProcessMemory FlushInstructionCache SetThreadContext ResumeThread DeleteFileA Sleep RemoveDirectoryA IsDBCSLeadByte GetFileAttributesA GetProcessHeap HeapAlloc HeapFree WriteFile lstrcpynA GetModuleFileNameA lstrlenW WideCharToMultiByte MultiByteToWideChar SetHandleCount GetLastError GlobalLock ReadFile GlobalUnlock GlobalFree GetEnvironmentStrings CreateFileMappingA GetStringTypeA GetStringTypeW IsBadCodePtr GetExitCodeProcess

user32

GetDlgItemTextA GetWindow SetCursor UpdateWindow GetClassInfoA CharUpperA CharLowerBuffA wvsprintfA EnableWindow GetParent GetWindowTextLengthA GetWindowTextA MoveWindow GetWindowPlacement DrawIcon DestroyIcon GetDlgCtrlID SetWindowTextA FillRect GetSysColor GetSysColorBrush SendMessageA LoadStringA GetSystemMetrics SetRect FindWindowA IntersectRect SubtractRect IsWindow DestroyWindow CreateDialogParamA CharNextA MessageBoxA WaitForInputIdle GetWindowLongA BeginPaint EndPaint SetWindowLongA GetClientRect ClientToScreen SetWindowPos GetWindowDC EndDialog GetDlgItem ShowWindow DialogBoxParamA GetDesktopWindow wsprintfA MsgWaitForMultipleObjects PeekMessageA DefWindowProcA PostMessageA KillTimer PostQuitMessage SetTimer LoadIconA LoadCursorA RegisterClassA CreateWindowExA GetMessageA TranslateMessage DispatchMessageA GetDC ReleaseDC CharPrevA ExitWindowsEx SendDlgItemMessageA GetWindowRect IsDialogMessageA

gdi32

CreateFontA GetTextExtentPoint32A SetBkMode SetTextColor GetObjectA CreateFontIndirectA CreateSolidBrush CreateCompatibleDC SelectObject BitBlt DeleteDC DeleteObject GetStockObject GetSystemPaletteEntries CreatePalette GetDeviceCaps SelectPalette RealizePalette CreateDIBitmap TranslateCharsetInfo

advapi32

RegQueryValueA RegOpenKeyA FreeSid OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegEnumValueA RegCreateKeyExA RegSetValueExA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegCloseKey AllocateAndInitializeSid GetTokenInformation OpenThreadToken EqualSid

rpcrt4

UuidCreate RpcStringFreeA UuidToStringA

ole32

CoUninitialize CoInitialize

oleaut32

SysStringLen SysAllocStringLen SysFreeString SysAllocString VariantClear VariantChangeType SysReAllocStringLen

Sharing

General

Malware Config

Signatures

File Explorer

CSISysFilesInstall.exe

PE Signature issue

version

shell32

comctl32

kernel32

user32

gdi32

advapi32

rpcrt4

ole32

oleaut32

generic