ISBEW64[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ISBEW64.exe
Size 215KB
Sample260807-aztp8adb97
SHA256 18b2ed4d6780f2b3469a25a6f89440948e4f89005f3050418dfeeccae229d2a8
MD5 471ac600fcca451a4bb380b8a49a5dd6
SHA1 92aed969b1ab85ee988949858be83c143d809d94
SHA512 b0d5bf256f1289721faffca66c20af2ee450f773e2aac5b7f9ea15e29112b0bf8e9af7c925c876aef26ee3f877f9422ee99b148ef9e74fc3d577d58424bece4f
SSDEEP 3072:O1JarOaA9ZHXBIQ0uxuIrPZPZz+jObNvsQHDFCJrsLz4QOTdtT:ObarOaA91xiuxuYPX6jKJGr8zOhJ
TLSH
T115244A4AB3A400E9E177827889654602F673BC510B60DBDF13A4837E9F377D1AD3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

ISBEW64.exe

.exe 215KB

ISBEW64.exe

IMPHASH a8e8f834d0d651dc9d28395d6f0abb06
SHA256 18b2ed4d6780f2b3469a25a6f89440948e4f89005f3050418dfeeccae229d2a8
MD5 471ac600fcca451a4bb380b8a49a5dd6
SHA1 92aed969b1ab85ee988949858be83c143d809d94
SHA512 b0d5bf256f1289721faffca66c20af2ee450f773e2aac5b7f9ea15e29112b0bf8e9af7c925c876aef26ee3f877f9422ee99b148ef9e74fc3d577d58424bece4f
SSDEEP 3072:O1JarOaA9ZHXBIQ0uxuIrPZPZz+jObNvsQHDFCJrsLz4QOTdtT:ObarOaA91xiuxuYPX6jKJGr8zOhJ
TLSH
T115244A4AB3A400E9E177827889654602F673BC510B60DBDF13A4837E9F377D1AD3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

42:47:8c:ef:bb:01:9c:90:12:bb:cb:84:7f:4c:82:e1:47:61:88:dd:bc:1d:23:86:aa:7e:df:bb:f7:48:6f:88

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4503908,CN=Flexera Software LLC,O=Flexera Software LLC,L=Itasca,ST=Illinois,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Dec 29, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:89:75:81:52:b0:06:f4:3c:a7:e6:8b:1a:af:21:47

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 1, 2024 - Jun 30, 2027

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

42784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\CodeBases\isdev\Src\Runtime\InstallScript\ISBEW64\x64\Release\ISBEW64.pdb

rpcrt4

UuidFromStringW

kernel32

WaitForSingleObject CloseHandle CreateEventW CreateThread FreeLibrary lstrcmpiW GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW DeleteCriticalSection RaiseException InitializeCriticalSectionAndSpinCount GetCommandLineW SetEvent GetCurrentThreadId Sleep WideCharToMultiByte SetLastError GetSystemDirectoryW GetSystemWow64DirectoryW LoadLibraryW LocalAlloc LocalFree FlsFree CreateFileW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetModuleFileNameW LeaveCriticalSection EnterCriticalSection GetProcAddress GetModuleHandleW WriteConsoleW DecodePointer GetStringTypeW SetStdHandle GetProcessHeap LCMapStringW FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA IsDebuggerPresent OutputDebugStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree HeapAlloc HeapSize HeapReAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo

user32

CharNextW CharUpperBuffW GetMessageW DispatchMessageW PostThreadMessageW

advapi32

RegConnectRegistryW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

shell32

SHGetSpecialFolderPathW

ole32

StringFromGUID2 CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitialize GetRunningObjectTable CreateItemMoniker CoUninitialize

oleaut32

SysAllocString SysReAllocStringLen LoadTypeLi SysStringLen SysFreeString VarUI4FromStr SysAllocStringLen

Sharing

General

Malware Config

Signatures

File Explorer

ISBEW64.exe

rpcrt4

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic