Optical Flares v1[.]3[.]8 (170)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Optical Flares v1.3.8 (170).exe
Size 39.4MB
Sample260804-16b2vsyzhy
SHA256 c146c61a100e5a2f18f93c69fe055f8d3253b3bd7aa300a5669639c08cd57695
MD5 aefa0c287108abcfe07033604b9278d6
SHA1 dc25bce783f6f163ee7c48c1fe89ed901b9fe89b
SHA512 75f0b49831f921ac824783830e3b4d0a6d809074249fc420aad60865d9bdd21890727825b3f518ce0f66443ea0df015fd0931a362640da636be50ee167f50ab1
SSDEEP 786432:kQ6n18tU6ayzBPhiiXM9TZpAyykMAblSUDTAyy9brK+sw+bJ2/8at5QxS6:kQE8tmSBZiiXM97lfcbi51SoS6
TLSH
T1AD97234BB29900EAC87AC03C8596954BF2723851037497EB37ED965A6F37BF11A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Optical Flares v1.3.8 (170).exe

.exe 39.4MB

Optical Flares v1.3.8 (170).exe

IMPHASH 18060602246b818f680eb453044f179f
SHA256 c146c61a100e5a2f18f93c69fe055f8d3253b3bd7aa300a5669639c08cd57695
MD5 aefa0c287108abcfe07033604b9278d6
SHA1 dc25bce783f6f163ee7c48c1fe89ed901b9fe89b
SHA512 75f0b49831f921ac824783830e3b4d0a6d809074249fc420aad60865d9bdd21890727825b3f518ce0f66443ea0df015fd0931a362640da636be50ee167f50ab1
SSDEEP 786432:kQ6n18tU6ayzBPhiiXM9TZpAyykMAblSUDTAyy9brK+sw+bJ2/8at5QxS6:kQE8tmSBZiiXM97lfcbi51SoS6
TLSH
T1AD97234BB29900EAC87AC03C8596954BF2723851037497EB37ED965A6F37BF11A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

52:98:6e:16:82:e1:bc:fe:f8:03:0b:90:1c:b9:ca:20:42:01:37:85:91:c2:c7:51:02:cd:89:92:af:e8:2d:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3347647,CN=Video Copilot\, Inc.,O=Video Copilot\, Inc.,L=Lake Elsinore,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 16, 2024

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

56:b6:29:cd:34:bc:78:f6

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2017 - May 30, 2042

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

Serial Number

4b:70:f2:70:e8:f8:08:ed:79:81:11:ee:7b:50:33:1d

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 13, 2022 - May 12, 2025

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2022 - Dec 6, 2032

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

363384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\VideoCopilot\Repositories\WIP\vcinstaller\bin\Optical Flares\win\x64\Release\vcinstaller.pdb

kernel32

SizeofResource GetCurrentProcess WriteFile CreateFileW LockResource CloseHandle LoadResource FindResourceW IsWow64Process WriteConsoleW HeapSize CreateDirectoryW GetModuleHandleW GetModuleFileNameW GlobalAlloc GlobalLock GlobalUnlock MultiByteToWideChar WideCharToMultiByte MulDiv SetFileTime FindNextFileW FindClose LoadLibraryW GetProcAddress FreeLibrary GetFileAttributesW SetEndOfFile LocalFree GetLastError GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection FindFirstFileExW SetFilePointerEx EncodePointer DecodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle HeapAlloc HeapFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle RtlUnwind

advapi32

RegCloseKey RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW

shell32

ShellExecuteW SHAppBarMessage SHGetFolderPathW SHCreateItemFromParsingName ShellExecuteExW DragQueryFileW

shlwapi

SHRegGetValueW

wtsapi32

WTSRegisterSessionNotification

d2d1

ord1

imm32

ImmGetContext ImmReleaseContext ImmGetVirtualKey ImmGetCompositionStringW ImmAssociateContext ImmSetCandidateWindow ImmNotifyIME ImmIsIME

dwrite

DWriteCreateFactory

user32

GetDesktopWindow KillTimer IsZoomed GetClientRect SetCapture TranslateMessage GetUpdateRect SetFocus TrackMouseEvent ValidateRect PeekMessageW GetMonitorInfoW SetTimer DispatchMessageW GetClassInfoW ShowWindow RegisterClassExW GetWindowLongPtrW WaitMessage SetWindowTextW GetSystemMetrics SendMessageW CreateWindowExW FillRect GetCursorPos MonitorFromWindow ReleaseCapture EqualRect SetWindowPos IsWindowVisible DestroyWindow GetFocus GetWindowRect GetWindow AdjustWindowRectEx DefWindowProcW EndPaint BeginPaint MapVirtualKeyW AppendMenuA TrackPopupMenuEx DestroyMenu SetMenuItemInfoW CreatePopupMenu GetMenuItemInfoW DestroyCaret GetKeyboardLayout CreateCaret OpenClipboard UpdateWindow CloseClipboard EmptyClipboard InvalidateRect EnableWindow GetKeyState GetDC ScreenToClient LoadCursorW SetCursor ShowCursor SetCursorPos MonitorFromRect SetClipboardData ReleaseDC SetWindowLongPtrW

gdi32

GetObjectW DeleteObject CreateSolidBrush SetMapMode GetDeviceCaps SetWindowExtEx SetViewportExtEx

ole32

RevokeDragDrop CoLockObjectExternal RegisterDragDrop CoUninitialize CoCreateInstance OleInitialize OleUninitialize CoInitializeEx ReleaseStgMedium

Name

.text

Size

537KB

Virtual Size

536KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

549KB

Virtual Size

549KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

38.3MB

Virtual Size

38.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Optical Flares v1.3.8 (170).exe

kernel32

advapi32

shell32

shlwapi

wtsapi32

d2d1

imm32

dwrite

user32

gdi32

ole32

generic