iExplore[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
iExplore.exe
Size 1.7MB
Sample260804-wrnd5atzft
SHA256 d4ac5b3c525a5fd94019d80ff81b552e73b19b1bd0a554b9609cdd5e1b00955a
MD5 6d622dcc87edc9a7b10d35372ade816b
SHA1 47d98825b03c507b85dec02a2297e03ebc925f30
SHA512 ed06f872a7c66ffeeb8cb8f6fedca06ccabf623f9cd188c4c7105428e8d6521ef8da0bac0564e14d2da914d2846369a9c04577a8cf7fb80cb62831e5497f2a58
SSDEEP 49152:KpEsgw14kZV2HXsMnmjEREseBSsxHnfXsrHYi2Yijig:0wYJYW
TLSH
T1A0857C2177E90274F2B3CA709975C222D5B5B8626F32D7CF42911A1D1E37ED09E36B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

iExplore.exe

.exe 1.7MB

iExplore.exe

IMPHASH 136bea86936e01e1f983ef31dafa8b2a
SHA256 d4ac5b3c525a5fd94019d80ff81b552e73b19b1bd0a554b9609cdd5e1b00955a
MD5 6d622dcc87edc9a7b10d35372ade816b
SHA1 47d98825b03c507b85dec02a2297e03ebc925f30
SHA512 ed06f872a7c66ffeeb8cb8f6fedca06ccabf623f9cd188c4c7105428e8d6521ef8da0bac0564e14d2da914d2846369a9c04577a8cf7fb80cb62831e5497f2a58
SSDEEP 49152:KpEsgw14kZV2HXsMnmjEREseBSsxHnfXsrHYi2Yijig:0wYJYW
TLSH
T1A0857C2177E90274F2B3CA709975C222D5B5B8626F32D7CF42911A1D1E37ED09E36B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

e1:ee:f7:06:21:e3:33:74:53:d8:4c:a7:5c:aa:8c:c6:03:19:9a:ce:38:9a:35:89:f4:22:11:74:0a:d7:41:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Bleeping Computer\, LLC.,O=Bleeping Computer\, LLC.,POSTALCODE=11747,STREET=273 Walt Whitman Road #255,L=Huntington Station,ST=New York,C=US,2.5.4.18=#13053131373437

Chains

Mar 13, 2018

CN=Bleeping Computer\, LLC.,O=Bleeping Computer\, LLC.,POSTALCODE=11747,STREET=273 Walt Whitman Road #255,L=Huntington Station,ST=New York,C=US,2.5.4.18=#13053131373437

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

ad:ee:4c:fe:5d:6a:f2:73:46:1f:64:b0:9c:20:89:7c:12:ce:b0:03

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Bleeping Computer\, LLC.,O=Bleeping Computer\, LLC.,POSTALCODE=11747,STREET=273 Walt Whitman Road #255,L=Huntington Station,ST=New York,C=US,2.5.4.18=#13053131373437

Chains

Mar 13, 2018

CN=Bleeping Computer\, LLC.,O=Bleeping Computer\, LLC.,POSTALCODE=11747,STREET=273 Walt Whitman Road #255,L=Huntington Station,ST=New York,C=US,2.5.4.18=#13053131373437

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=Bleeping Computer\, LLC.,O=Bleeping Computer\, LLC.,POSTALCODE=11747,STREET=273 Walt Whitman Road #255,L=Huntington Station,ST=New York,C=US,2.5.4.18=#13053131373437

Serial Number

37:76:9e:e4:0a:db:40:b3:25:f0:1c:aa:a6:cf:1a:66

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 13, 2018 - Mar 12, 2021

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Minor OS version

Major OS version

Entry point

339131

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LockResource SizeofResource CreateFileMappingW MapViewOfFile UnmapViewOfFile GetShortPathNameW SetLastError GetFileAttributesW SetFileAttributesW LoadResource LocalFree GetProcessHeap SetEndOfFile CreateProcessA GetExitCodeProcess FindResourceW GetEnvironmentVariableW CreateDirectoryW Sleep Process32NextW TerminateProcess OpenProcess Process32FirstW CreateToolhelp32Snapshot WaitForSingleObject CreateProcessW GetTickCount lstrlenW GetLastError FileTimeToSystemTime FileTimeToLocalFileTime CloseHandle DeviceIoControl CreateFileW FindClose FindNextFileW FindFirstFileW GetCurrentProcessId GetNativeSystemInfo GetCurrentProcess GetVersionExW WriteConsoleW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID HeapSize QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesA SetStdHandle LoadLibraryW SetEnvironmentVariableA GetTimeZoneInformation FlushFileBuffers InterlockedIncrement InterlockedDecrement WideCharToMultiByte InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetLocaleInfoW HeapFree GetCPInfo HeapAlloc GetSystemTimeAsFileTime GetProcAddress GetModuleHandleW ExitProcess DeleteFileW GetTimeFormatW GetDateFormatW HeapReAlloc GetCommandLineW HeapSetInformation RaiseException RtlUnwind LCMapStringW CompareStringW GetTimeFormatA GetDateFormatA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetACP GetOEMCP IsValidCodePage ReadFile WriteFile GetModuleFileNameW GetConsoleCP GetConsoleMode SetFilePointer

user32

MessageBoxW GetSystemMetrics

advapi32

AllocateAndInitializeSid SetNamedSecurityInfoW SetEntriesInAclW GetNamedSecurityInfoW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken ControlService QueryServiceStatus RegDeleteValueW RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegEnumValueW CloseServiceHandle OpenServiceW OpenSCManagerW RegCloseKey RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW FreeSid

shell32

SHGetFolderPathW

psapi

GetModuleFileNameExW EnumProcessModules

shlwapi

StrStrIW

wintrust

CryptCATAdminReleaseCatalogContext CryptCATAdminAcquireContext CryptCATAdminReleaseContext CryptCATAdminCalcHashFromFileHandle WinVerifyTrust CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext

Sharing

General

Malware Config

Signatures

File Explorer

iExplore.exe

kernel32

user32

advapi32

shell32

psapi

shlwapi

wintrust

generic