OpticalFlares_1[.]3[.]8 (168)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
OpticalFlares_1.3.8 (168).exe
Size 39.4MB
Sample260804-13v1kaer21
SHA256 0111b0e981e1c6c7222e481f58cfbfe6600e606470832c0df8678decfe6d5c14
MD5 e440f9133247851bd5936ef3d37792cf
SHA1 7ad8f69dda85937f5358ee8afe2984f7844ad46b
SHA512 9f6c9ca155afe70a30b287eda6b7691ba8b4344525029a4ab3c8f203827c80d1146d60428089a64fbff699f5afb65a27e1ff510894ca3335f667210cce8b2738
SSDEEP 786432:9h66n18tU6ayzBPhiiXM9TZpAyykMAblSUDTAyy9brK+sw+bJ2/8at5QHmc:9h6E8tmSBZiiXM97lfcbi51Symc
TLSH
T11F97335BB39900E6C87AC03C8597964BE27238110374A7EB37AD965A6F777F01A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

OpticalFlares_1.3.8 (168).exe

.exe 39.4MB

OpticalFlares_1.3.8 (168).exe

IMPHASH 844c15c5328c3190e35baadb9e9f0891
SHA256 0111b0e981e1c6c7222e481f58cfbfe6600e606470832c0df8678decfe6d5c14
MD5 e440f9133247851bd5936ef3d37792cf
SHA1 7ad8f69dda85937f5358ee8afe2984f7844ad46b
SHA512 9f6c9ca155afe70a30b287eda6b7691ba8b4344525029a4ab3c8f203827c80d1146d60428089a64fbff699f5afb65a27e1ff510894ca3335f667210cce8b2738
SSDEEP 786432:9h66n18tU6ayzBPhiiXM9TZpAyykMAblSUDTAyy9brK+sw+bJ2/8at5QHmc:9h6E8tmSBZiiXM97lfcbi51Symc
TLSH
T11F97335BB39900E6C87AC03C8597964BE27238110374A7EB37AD965A6F777F01A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

9d:da:d9:1d:3a:ef:0b:c1:96:d7:a6:95:c1:18:ef:37:a9:80:93:12:83:bf:c2:07:36:d4:20:94:a3:c8:6c:53

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3347647,CN=Video Copilot\, Inc.,O=Video Copilot\, Inc.,L=Lake Elsinore,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 17, 2022

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 11, 2018 - Sep 11, 2023

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

Serial Number

4b:70:f2:70:e8:f8:08:ed:79:81:11:ee:7b:50:33:1d

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2022 - May 12, 2025

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 11, 2018 - Sep 11, 2023

Subject

CN=SSL.com Timestamping Unit 2021,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

5f:1c:bc:8c:5c:3e:5f:6f:24:fd:3a:4f:e4:88:d6:28

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 10, 2021 - Sep 8, 2031

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

352136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\VideoCopilot\Repositories\vcinstaller\bin\Optical Flares\win\x64\Release\vcinstaller.pdb

kernel32

SizeofResource GetCurrentProcess WriteFile CreateFileW LockResource CloseHandle LoadResource FindResourceW IsWow64Process WriteConsoleW HeapSize CreateDirectoryW GetModuleHandleW GetModuleFileNameW GlobalAlloc GlobalLock GlobalUnlock MultiByteToWideChar WideCharToMultiByte MulDiv SetFileTime FindNextFileW FindClose LoadLibraryW GetProcAddress FreeLibrary GetFileAttributesW SetEndOfFile LocalFree GetLastError GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle HeapAlloc HeapFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle RtlUnwind

advapi32

RegCloseKey RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW

shell32

ShellExecuteW SHAppBarMessage SHGetFolderPathW SHCreateItemFromParsingName ShellExecuteExW DragQueryFileW

shlwapi

SHRegGetValueW

wtsapi32

WTSRegisterSessionNotification

d2d1

ord1

imm32

ImmGetContext ImmReleaseContext ImmGetVirtualKey ImmGetCompositionStringW ImmAssociateContext ImmSetCandidateWindow ImmNotifyIME ImmIsIME

dwrite

DWriteCreateFactory

user32

GetDesktopWindow KillTimer IsZoomed GetClientRect SetCapture TranslateMessage GetUpdateRect SetFocus TrackMouseEvent ValidateRect PeekMessageW GetMonitorInfoW SetTimer DispatchMessageW GetClassInfoW ShowWindow RegisterClassExW GetWindowLongPtrW WaitMessage SetWindowTextW GetSystemMetrics SendMessageW CreateWindowExW FillRect GetCursorPos MonitorFromWindow ReleaseCapture EqualRect SetWindowPos IsWindowVisible DestroyWindow GetFocus GetWindowRect GetWindow AdjustWindowRectEx DefWindowProcW EndPaint BeginPaint AppendMenuA TrackPopupMenuEx DestroyMenu SetMenuItemInfoW CreatePopupMenu GetMenuItemInfoW DestroyCaret GetKeyboardLayout CreateCaret MapVirtualKeyW OpenClipboard UpdateWindow CloseClipboard EmptyClipboard InvalidateRect EnableWindow GetKeyState GetDC ScreenToClient LoadCursorW SetCursor ShowCursor SetCursorPos MonitorFromRect SetClipboardData ReleaseDC SetWindowLongPtrW

gdi32

SetWindowExtEx DeleteObject CreateSolidBrush SetMapMode GetDeviceCaps SetViewportExtEx GetObjectW

ole32

RevokeDragDrop CoLockObjectExternal RegisterDragDrop CoUninitialize CoCreateInstance OleInitialize OleUninitialize CoInitializeEx ReleaseStgMedium

Name

.text

Size

525KB

Virtual Size

525KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

548KB

Virtual Size

547KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

38.3MB

Virtual Size

38.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

OpticalFlares_1.3.8 (168).exe

kernel32

advapi32

shell32

shlwapi

wtsapi32

d2d1

imm32

dwrite

user32

gdi32

ole32

generic