BDGoGoogleDecryptor[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
BDGoGoogleDecryptor.exe
Size 8.7MB
Sample260803-wwktsshj7t
SHA256 4c5302802d5fb9c8b73850dcd306b6aba202f9e644d9103ed14300457e2b9d42
MD5 a1ca646c7affc6029b7ec555932dc593
SHA1 2bbe2d8765a170ea0caf453ca7c6adf5daa52382
SHA512 020dbe4602565f105cbfef68f9aa9c827e4c0264e46459587bce64014147e58649d72d5790d78c5dc07e326e9b56aa4a33200c4bb4e6b281fefd68d8cb5729b3
SSDEEP 196608:9GEHHWtwPlARRmtejsum3O0V58IzN6+ZR62Wi:QEn9PlAGMixxNF762W
TLSH
T1EB9633422B7BAE46EA435CBC6C2500E5F4657EC009D189B784B4F6EE56B730137CF28A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

BDGoGoogleDecryptor.exe

.exe 8.7MB

BDGoGoogleDecryptor.exe

IMPHASH c0bf34e100d570b80b7dce11087a79bc
SHA256 4c5302802d5fb9c8b73850dcd306b6aba202f9e644d9103ed14300457e2b9d42
MD5 a1ca646c7affc6029b7ec555932dc593
SHA1 2bbe2d8765a170ea0caf453ca7c6adf5daa52382
SHA512 020dbe4602565f105cbfef68f9aa9c827e4c0264e46459587bce64014147e58649d72d5790d78c5dc07e326e9b56aa4a33200c4bb4e6b281fefd68d8cb5729b3
SSDEEP 196608:9GEHHWtwPlARRmtejsum3O0V58IzN6+ZR62Wi:QEn9PlAGMixxNF762W
TLSH
T1EB9633422B7BAE46EA435CBC6C2500E5F4657EC009D189B784B4F6EE56B730137CF28A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

cc:4d:a7:3d:b2:0b:b8:51:11:fa:4c:84:35:5c:94:51:8e:97:43:b0:54:6f:97:83:13:2f:34:a0:89:99:57:61

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO

Chains

Apr 27, 2021

CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

ce:91:bf:9e:02:09:3c:00:fa:c4:2a:66:9f:a1:92:a0:91:45:09:56

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO

Chains

Apr 27, 2021

CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO

Serial Number

0d:32:b8:a4:68:df:3b:34:c0:09:a7:74:9a:68:29:f0

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 27, 2020 - Dec 5, 2023

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO

Serial Number

0b:02:a4:0e:13:21:fb:40:cc:eb:94:78:22:46:bc:8d

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 14, 2020 - Dec 5, 2023

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

17469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateDirectoryW GetCommandLineW WriteFile GetTempPathW CreateFileW CloseHandle GetNativeSystemInfo LoadResource FindResourceW CreateProcessW GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter TerminateProcess

user32

wsprintfW MessageBoxW

shell32

SHFileOperationW

vcruntime140

wcschr __std_exception_destroy memset __current_exception memcpy _CxxThrowException __std_exception_copy _except_handler4_common __current_exception_context

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit _initterm _c_exit terminate _cexit _initterm_e _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe __p___argv __p___argc _controlfp_s _exit exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

BDGoGoogleDecryptor.exe

PE Signature issue

kernel32

user32

shell32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic