autoplay[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
autoplay.exe
Size 185KB
Sample260808-aee2bsej2v
SHA256 3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82
MD5 76ef16e94f77454aaffdfa4c700be85f
SHA1 9b45b3826706337a11e43248095fb2c62e42d14d
SHA512 4185cf9393877fd6d80ecfb7290c10d40a62fc7013d175e5fc91df56870500ea33b518e4f55b4e7d8a7865d3f7707fb5f49f621d5d944bb1edffda4734f99d53
SSDEEP 3072:fNCpBPbYsMn1mx6nWGdN6YROBxQo6PfSPgHvUJjX1qINSxT3OIpkApPxn:fNiGC6nWGdN6YO6Pf9vAjX1qINGLdRz
TLSH
T18F047B6232D050F3E49368B299999BB68776FC74433D85D3E3743D2A25222F27B38365
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
autoplay.exe

File Explorer

autoplay.exe

.exe 185KB

autoplay.exe

IMPHASH ec7603dfc11290c5ea59ede1b41eac50
SHA256 3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82
MD5 76ef16e94f77454aaffdfa4c700be85f
SHA1 9b45b3826706337a11e43248095fb2c62e42d14d
SHA512 4185cf9393877fd6d80ecfb7290c10d40a62fc7013d175e5fc91df56870500ea33b518e4f55b4e7d8a7865d3f7707fb5f49f621d5d944bb1edffda4734f99d53
SSDEEP 3072:fNCpBPbYsMn1mx6nWGdN6YROBxQo6PfSPgHvUJjX1qINSxT3OIpkApPxn:fNiGC6nWGdN6YO6Pf9vAjX1qINGLdRz
TLSH
T18F047B6232D050F3E49368B299999BB68776FC74433D85D3E3743D2A25222F27B38365
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

55:7e:59:12:c0:ed:63:3a:cb:5b:e7:da:2f:6c:23:99:5e:d6:5d:d2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Chains

Aug 6, 2008

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Serial Number

4b:ea:81:7c:ba:c7:c3:8a:ba:72:e7:be:6f:00:de:6d

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 7, 2007 - Dec 10, 2008

Minor OS version

Major OS version

Entry point

75130

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

_TrackMouseEvent ord17

msvfw32

MCIWndCreateW MCIWndCreateA

winmm

waveOutSetVolume waveOutGetVolume PlaySoundA waveOutGetNumDevs

shlwapi

PathRemoveFileSpecW

kernel32

InterlockedExchange GetModuleHandleA GetModuleFileNameA GetWindowsDirectoryA GetSystemDirectoryA LoadLibraryA SetLastError GetOEMCP GetACP SetEndOfFile CreateFileA FlushFileBuffers SetStdHandle GetTimeZoneInformation GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter VirtualQuery GetSystemInfo VirtualProtect GetLocaleInfoA IsBadCodePtr IsBadReadPtr SetFilePointer GetStringTypeA IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy GetCommandLineW GetCommandLineA GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter CompareStringA WaitForSingleObject CloseHandle DeviceIoControl MulDiv FreeLibrary Sleep ReleaseMutex GetLastError GetUserDefaultLCID GetUserDefaultUILanguage GetSystemDefaultLangID WriteFile ReadFile GetStartupInfoA GetFileType GetStdHandle SetHandleCount SetUnhandledExceptionFilter SetEnvironmentVariableA HeapSize HeapReAlloc RtlUnwind FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA RaiseException ExitProcess TerminateProcess GetCurrentProcess GetVersionExA HeapAlloc HeapFree LCMapStringA

user32

DestroyIcon GetSystemMetrics SetFocus BeginPaint FillRect DrawEdge keybd_event SetForegroundWindow UpdateWindow TranslateMessage ReleaseDC GetAsyncKeyState SetCursor EndPaint RedrawWindow MoveWindow GetIconInfo CreateIconIndirect GetClientRect InvalidateRect ShowWindow PostQuitMessage DrawIconEx SetRect GetDC GetWindowRect

gdi32

CreateSolidBrush GetStockObject PatBlt CreateCompatibleBitmap CreateCompatibleDC SetTextAlign SetLayout LineTo SetBkMode StretchBlt BitBlt SetTextColor CreatePenIndirect SelectObject MoveToEx Polyline DeleteObject DeleteDC

advapi32

RegQueryValueA RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

autoplay.exe

PE Signature issue

comctl32

msvfw32

winmm

shlwapi

kernel32

user32

gdi32

advapi32

generic