avast_decryptor_hermeticransom[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
avast_decryptor_hermeticransom.exe
Size 2.7MB
Sample260805-plbptaah45
SHA256 d27a35761a43145dc61f3656ef2190659b892ba6fdd2780aec7e58f42440687b
MD5 926afef91bfec583b50d5622ea9c649e
SHA1 6dd4c0217e0966adcb73443a9f194575b7f3231a
SHA512 7db4c2a351127116575224759844929a350540ff84a9a77bf243c707e68da7209a36c1658d72a03cccf5df6f69f091e0e03f9910c1d6a6ae8b2bbd2737966d8f
SSDEEP 49152:BNC4eEK2gh8O1Dsu9WRzeJZ1s6NuRkV8f7rNeXCLVyxmB4bdefVC7p:fK2giO1giCRHIXqVFBjVg
TLSH
T126D523473EE24D46EA914B38ECBCBE5901247FFA08245B0FB13A7E4D39B259B4934761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

avast_decryptor_hermeticransom.exe

.exe 2.7MB

avast_decryptor_hermeticransom.exe

IMPHASH c28adbe43b7b638c0cb9fb14a8a863c5
SHA256 d27a35761a43145dc61f3656ef2190659b892ba6fdd2780aec7e58f42440687b
MD5 926afef91bfec583b50d5622ea9c649e
SHA1 6dd4c0217e0966adcb73443a9f194575b7f3231a
SHA512 7db4c2a351127116575224759844929a350540ff84a9a77bf243c707e68da7209a36c1658d72a03cccf5df6f69f091e0e03f9910c1d6a6ae8b2bbd2737966d8f
SSDEEP 49152:BNC4eEK2gh8O1Dsu9WRzeJZ1s6NuRkV8f7rNeXCLVyxmB4bdefVC7p:fK2giO1giCRHIXqVFBjVg
TLSH
T126D523473EE24D46EA914B38ECBCBE5901247FFA08245B0FB13A7E4D39B259B4934761
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

f9:9e:9c:26:2a:bb:bf:09:3b:8d:80:76:e1:e0:aa:98:31:74:b3:8b:06:86:67:a3:0b:53:f4:4c:10:9d:00:af

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Jun 30, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1652786

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualFree VirtualQueryEx CreateToolhelp32Snapshot Process32FirstW Process32NextW GetSystemTimeAsFileTime CreateProcessW CopyFileW SetEndOfFile SizeofResource LockResource LoadResource FindResourceW GetModuleHandleW FlushFileBuffers GetFileSizeEx MoveFileExW SetFileAttributesW GetProcessHeap FormatMessageW GetSystemDirectoryW GetTempPathW GetComputerNameW GetDriveTypeW GetLogicalDrives GetFullPathNameW GetDateFormatW CreateThread ReadProcessMemory Sleep CreateEventW DeleteCriticalSection InitializeCriticalSection GetExitCodeProcess WaitForSingleObject GetCurrentProcess SystemTimeToFileTime GetFileSize GetLocalTime GetFileInformationByHandle VirtualAlloc TerminateProcess K32GetProcessImageFileNameW OpenProcess GetVolumeInformationW GetWindowsDirectoryW GetSystemInfo DecodePointer WriteConsoleW HeapSize GetTimeZoneInformation GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle GetConsoleOutputCP GetVersionExA ExpandEnvironmentStringsA GetComputerNameA GetCurrentThreadId ExitProcess IsDebuggerPresent GetSystemTime GetCurrentProcessId SetEvent LeaveCriticalSection EnterCriticalSection GetTickCount GetProcAddress LoadLibraryW SetFilePointerEx CompareFileTime FindClose FindNextFileW FindFirstFileW ExpandEnvironmentStringsW GetFileAttributesW DeleteFileW FileTimeToSystemTime FileTimeToLocalFileTime WriteFile CreateFileW WideCharToMultiByte LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc SystemTimeToTzSpecificLocalTime PeekNamedPipe SetConsoleCtrlHandler GetCommandLineW GetCommandLineA EncodePointer EnumResourceNamesW LoadLibraryExW RaiseException RtlUnwind InitializeSListHead MultiByteToWideChar GetModuleFileNameW SetFilePointer ReadFile HeapFree HeapReAlloc GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter HeapAlloc SetLastError GetLastError CloseHandle UnmapViewOfFile MapViewOfFile CreateFileMappingW OpenFileMappingW UnhandledExceptionFilter ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode LoadLibraryA ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber QueryPerformanceCounter TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetFileType GetStdHandle GetModuleHandleExW GetCurrentDirectoryW SetEnvironmentVariableW GetEnvironmentVariableW FreeLibrary GetVersionExW GetCurrentThread CompareStringW

user32

SystemParametersInfoW GetParent SetWindowLongW SetClassLongW GetWindowLongW GetFocus PostMessageW SetFocus KillTimer ShowWindow LoadImageW DestroyIcon CallWindowProcW GetDC GetClientRect SetWindowTextW CharLowerBuffW GetClassNameW GetWindowTextW GetWindowThreadProcessId EnumWindows CharUpperA SendMessageW GetDlgItem LoadIconW SetWindowPos ClientToScreen ReleaseDC IsCharAlphaNumericW DrawTextExW GetDCEx GetWindowRect DialogBoxParamW CharUpperBuffW GetDlgItemTextW LoadStringW InvalidateRect SetCursor GetDlgCtrlID GetWindow ScreenToClient FindWindowW IsCharAlphaW GetDesktopWindow GetAsyncKeyState EnableWindow GetSystemMetrics GetWindowTextLengthW SetTimer SetDlgItemTextW IsWindowVisible MessageBoxW IsDlgButtonChecked CheckDlgButton IsIconic IsWindow BeginDeferWindowPos DeferWindowPos EndDeferWindowPos FillRect LoadCursorW CreateCursor DialogBoxIndirectParamW GetSystemMenu DeleteMenu BeginPaint EndPaint MessageBeep GetSysColor GetSysColorBrush GetProcessWindowStation GetUserObjectInformationW EndDialog

gdi32

GetTextExtentPoint32W GetStockObject SetBkMode SetTextColor DeleteObject GetObjectW CreateFontIndirectW GetDeviceCaps SelectObject TextOutW CreatePen CreateSolidBrush GetTextExtentPointW Rectangle GetTextMetricsW

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

SetSecurityDescriptorOwner CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext ReportEventW RegisterEventSourceW DeregisterEventSource CloseEventLog ReadEventLogW OpenEventLogW CryptAcquireContextW RegQueryValueExA GetUserNameA RegSetValueExW GetUserNameW GetTokenInformation OpenProcessToken RegQueryValueExW RegQueryInfoKeyW RegCloseKey RegOpenKeyExW LookupPrivilegeValueW CryptEnumProvidersW OpenThreadToken AccessCheck AddAccessAllowedAce AdjustTokenPrivileges AllocateAndInitializeSid DuplicateToken FreeSid GetLengthSid InitializeAcl InitializeSecurityDescriptor IsValidSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorGroup

shell32

SHGetFolderPathW SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc DragAcceptFiles DragQueryFileW ShellExecuteExW SHGetSpecialFolderPathW SHGetFolderPathA ShellExecuteW

ole32

CoInitialize CoCreateInstance CLSIDFromProgID CoGetClassObject

oleaut32

SysFreeString SysAllocString

ntdll

NtSetInformationFile NtEnumerateValueKey

comctl32

ord17 CreatePropertySheetPageW PropertySheetW

shlwapi

PathIsRelativeW

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

ws2_32

WSAStartup WSACleanup WSAGetLastError getaddrinfo freeaddrinfo getnameinfo ntohs send WSASetLastError closesocket connect setsockopt socket getsockopt ioctlsocket recv shutdown

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

mpr

WNetOpenEnumW WNetEnumResourceW WNetCloseEnum

bcrypt

BCryptGenRandom

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.gcode

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

580KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

289KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

avast_decryptor_hermeticransom.exe

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

ntdll

comctl32

shlwapi

crypt32

ws2_32

version

mpr

bcrypt

generic