avast_decryptor_hiddentear[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
avast_decryptor_hiddentear.exe
Size 2.3MB
Sample260803-wwd19avera
SHA256 575beeb9e0f2aee0094c615218ca080cf33c5ee4fc42bb58d3c25774e22ae83e
MD5 0559e66e0c2ee3364afd8b9cc4a40dca
SHA1 ecf7b9f7062a69b5a0d9ea13d32ee5531abc03af
SHA512 d59ccb5d482832af67e2acc722d42940fe89ac9773dbbcb33f729ccb878d97619da70069ce0147919efa6d97a1d658b161bbcd7ad9fc1281b05721ce2925df30
SSDEEP 24576:DUovqrRVFW2GnIkXyRBU8CiI7jAXbZ1PY6XmZe1QXmPsAITljOZ77OXOO33d5Yfy:BvYN/2P7MrZ1PY6XmZ1kkTAqndefVR8b
TLSH
T1D3B5E032BF8148B2E9D6853495BA6B7B4D327E334335C5C387A13D295C322D16A3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

avast_decryptor_hiddentear.exe

.exe 2.3MB

avast_decryptor_hiddentear.exe

IMPHASH c25dbae568d7c257b7dde559fb744060
SHA256 575beeb9e0f2aee0094c615218ca080cf33c5ee4fc42bb58d3c25774e22ae83e
MD5 0559e66e0c2ee3364afd8b9cc4a40dca
SHA1 ecf7b9f7062a69b5a0d9ea13d32ee5531abc03af
SHA512 d59ccb5d482832af67e2acc722d42940fe89ac9773dbbcb33f729ccb878d97619da70069ce0147919efa6d97a1d658b161bbcd7ad9fc1281b05721ce2925df30
SSDEEP 24576:DUovqrRVFW2GnIkXyRBU8CiI7jAXbZ1PY6XmZe1QXmPsAITljOZ77OXOO33d5Yfy:BvYN/2P7MrZ1PY6XmZ1kkTAqndefVR8b
TLSH
T1D3B5E032BF8148B2E9D6853495BA6B7B4D327E334335C5C387A13D295C322D16A3E395
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

8e:c1:46:d0:39:65:ef:da:d1:3c:fb:3c:18:13:6f:3d:20:89:0b:4e:b8:45:23:43:0c:7d:18:7a:95:8d:4a:52

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ

Chains

Jul 17, 2019

CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

d8:34:d7:80:23:e4:f5:25:63:50:6b:a9:ae:be:e6:82:40:7a:f8:a3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ

Chains

Jul 17, 2019

CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ

Subject

CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ

Serial Number

07:c7:0f:7c:ab:14:5b:c1:ed:38:5f:be:69:fa:31:30

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 6, 2016 - Oct 4, 2019

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=AVAST Software s.r.o.,O=AVAST Software s.r.o.,L=Praha 4,C=CZ

Serial Number

01:e9:39:99:f3:87:1d:10:91:dc:1e:8d:58:b8:d4:05

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 16, 2017 - Jun 24, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:1c:b2:8a:00:00:00:00:00:26

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

803645

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

decryptor.pdb

kernel32

Sleep VirtualAlloc ReadProcessMemory VirtualFree VirtualQueryEx CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCommandLineW InterlockedCompareExchange CopyFileW SetFilePointerEx SetEndOfFile GetSystemTime CreateFileW MultiByteToWideChar GetLastError OutputDebugStringW FileTimeToSystemTime FileTimeToLocalFileTime GetSystemTimeAsFileTime ReadFile UnmapViewOfFile CloseHandle HeapAlloc WideCharToMultiByte WriteFile HeapFree DecodePointer HeapSize WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW TerminateProcess GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle GetConsoleCP FlushFileBuffers LCMapStringW CompareStringW GetStringTypeW GetACP SetConsoleCtrlHandler GetModuleHandleExW GetCommandLineA LoadLibraryExW FormatMessageW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind RaiseException EncodePointer GetStartupInfoW InitializeSListHead GetLongPathNameW GetVersionExA ExpandEnvironmentStringsA GetComputerNameA GetCurrentThreadId ExitProcess InterlockedIncrement IsDebuggerPresent HeapReAlloc GetSystemInfo MoveFileExW DeleteFileW SetFileAttributesW CreateProcessW SizeofResource LockResource LoadResource GetCPInfo FindResourceW GetSystemDirectoryW ExpandEnvironmentStringsW WaitForSingleObject GetFullPathNameW GetCurrentThread GetVersionExW GetProcessHeap GetCurrentProcessId GetCurrentProcess DuplicateHandle OpenProcess OpenFileMappingW LeaveCriticalSection EnterCriticalSection GetComputerNameW GetDriveTypeW GetLogicalDrives GetProcAddress LoadLibraryW GetTickCount MapViewOfFile CreateFileMappingW SystemTimeToFileTime GetFileSize GetLocalTime GetFileInformationByHandle SetFilePointer CompareFileTime GetFileSizeEx FindClose FindNextFileW FindFirstFileW GetFileAttributesW SetLastError IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SetConsoleMode ReadConsoleW ReadConsoleA GetConsoleMode GetEnvironmentVariableW GlobalMemoryStatus QueryPerformanceCounter ConvertFiberToThread DeleteFiber GetFileType GetStdHandle GetTempPathW GetDateFormatW GetModuleHandleW CreateThread CreateEventW WaitForMultipleObjects SetEvent ResetEvent DeleteCriticalSection InitializeCriticalSection FreeLibrary GetExitCodeProcess GetModuleFileNameW

user32

EnableWindow MessageBoxW CharLowerBuffW GetClassNameW GetWindowTextW GetWindowThreadProcessId EnumWindows CharUpperBuffW CharUpperA GetDesktopWindow SendMessageW GetDlgItem EndDialog DialogBoxParamW GetWindowRect GetUserObjectInformationW GetProcessWindowStation GetClientRect LoadImageW GetDC SystemParametersInfoW ReleaseDC GetParent SetWindowLongW LoadIconW SetClassLongW SetWindowPos GetWindowLongW SetWindowTextW KillTimer GetDlgCtrlID PostMessageW FindWindowW MoveWindow IsCharAlphaW CreateCursor LoadCursorW FillRect GetWindow EndDeferWindowPos DeferWindowPos BeginDeferWindowPos IsWindow GetSystemMetrics ClientToScreen SetTimer ShowWindow SetFocus GetWindowTextLengthW IsDlgButtonChecked InvalidateRect CallWindowProcW DestroyIcon SetCursor LoadStringW IsWindowVisible GetDlgItemTextW CheckDlgButton SetDlgItemTextW

gdi32

GetTextExtentPoint32W DeleteObject GetStockObject SetBkMode SetTextColor SelectObject GetObjectW CreateFontIndirectW GetDeviceCaps TextOutW

comdlg32

GetOpenFileNameW

advapi32

RegQueryInfoKeyW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext ReportEventW RegisterEventSourceW DeregisterEventSource CloseEventLog ReadEventLogW OpenEventLogW CryptAcquireContextW GetCurrentHwProfileW RegQueryValueExA GetUserNameA AdjustTokenPrivileges LookupPrivilegeValueW RegSetValueExW RegDeleteValueW GetTokenInformation FreeSid AccessCheck IsValidSecurityDescriptor SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl GetLengthSid InitializeSecurityDescriptor AllocateAndInitializeSid DuplicateToken OpenProcessToken OpenThreadToken RegQueryValueExW CryptGenRandom GetUserNameW RegCloseKey RegOpenKeyExW

shell32

SHBrowseForFolderW SHGetFileInfoW SHGetMalloc ShellExecuteW DragQueryFileW ShellExecuteExW SHGetSpecialFolderPathW SHGetFolderPathA SHGetFolderPathW DragAcceptFiles SHGetPathFromIDListW

ole32

CoCreateInstance CLSIDFromProgID CoGetClassObject CoInitialize

oleaut32

SysFreeString SysAllocString

ntdll

NtEnumerateValueKey NtSetInformationFile

comctl32

ord17 PropertySheetW CreatePropertySheetPageW

shlwapi

StrStrIW PathFindFileNameW

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore CertCloseStore

ws2_32

WSACleanup WSAGetLastError send WSASetLastError recv closesocket

mpr

WNetEnumResourceW WNetCloseEnum WNetOpenEnumW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

psapi

GetProcessImageFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

avast_decryptor_hiddentear.exe

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

ntdll

comctl32

shlwapi

crypt32

ws2_32

mpr

version

psapi

generic