SB24_PCDRV_LB_1_04_0090a[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SB24_PCDRV_LB_1_04_0090a.exe
Size 40.6MB
Sample260808-ajxryawbpc
SHA256 e1deb4a34f385bfc4d6e5f647d370edffaacb4efb5059ec36796ad67568602e5
MD5 dae258ce2f444d10fff7f3d192b935a6
SHA1 a032d5496e2d588ba9e1eea0e816ca5e9706a11c
SHA512 e1ad9ccf4603705bacfeccc1c9561fc4701f62f36fb83d4bb202dbba4e76ee5114b9915fa6fa714a0d4a25a95b62d21944d1c4dc346882d466bd3dcfaab43bd1
SSDEEP 786432:pQxO84w8AV22/wuGEP4H2QZmOdmwW3DE/ByzChY39qIQ:izAMbP4H2QGV4IL39qp
TLSH
T19B9733B3D19ECDCCFC8510B2E0E0A009E0396641AB185B7BF50CA6569A976737B75F8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
SB24_PCDRV_LB_1_04_0090a.exe

File Explorer

SB24_PCDRV_LB_1_04_0090a.exe

.exe 40.6MB

SB24_PCDRV_LB_1_04_0090a.exe

IMPHASH af4e4b390dfae32202db4dcaa8228d77
SHA256 e1deb4a34f385bfc4d6e5f647d370edffaacb4efb5059ec36796ad67568602e5
MD5 dae258ce2f444d10fff7f3d192b935a6
SHA1 a032d5496e2d588ba9e1eea0e816ca5e9706a11c
SHA512 e1ad9ccf4603705bacfeccc1c9561fc4701f62f36fb83d4bb202dbba4e76ee5114b9915fa6fa714a0d4a25a95b62d21944d1c4dc346882d466bd3dcfaab43bd1
SSDEEP 786432:pQxO84w8AV22/wuGEP4H2QZmOdmwW3DE/ByzChY39qIQ:izAMbP4H2QGV4IL39qp
TLSH
T19B9733B3D19ECDCCFC8510B2E0E0A009E0396641AB185B7BF50CA6569A976737B75F8C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

dd:b5:b6:01:96:6e:de:4c:6b:04:29:a7:3e:b5:74:4f:45:62:11:01

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Creative Technology Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Creative Technology Ltd,L=Singapore,ST=Singapore,C=SG

Chains

Jun 12, 2014

CN=Creative Technology Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Creative Technology Ltd,L=Singapore,ST=Singapore,C=SG

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Dec 30, 2020

Subject

CN=Creative Technology Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Creative Technology Ltd,L=Singapore,ST=Singapore,C=SG

Serial Number

17:53:19:18:96:1e:d0:b7:58:2e:7b:c5:28:15:21:fe

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Jul 28, 2012 - Aug 24, 2014

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

36156

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteFileA GetFileAttributesA CreateDirectoryA SetFileAttributesA CloseHandle SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA GetWindowsDirectoryA lstrcmpiA ReadFile GetFileSize CreateProcessA CopyFileA RemoveDirectoryA GetExitCodeProcess WaitForSingleObject GetCurrentProcess GetCommandLineA SetCurrentDirectoryA GetFullPathNameA GetModuleFileNameA GetModuleHandleA FreeLibrary GetProcAddress LoadLibraryA ExitThread FindNextFileA Sleep CreateThread TerminateThread IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter FlushFileBuffers LCMapStringW LCMapStringA GetEnvironmentStringsW GetEnvironmentStrings WideCharToMultiByte FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter SetStdHandle GetStdHandle SetHandleCount SetEndOfFile IsBadWritePtr HeapReAlloc VirtualAlloc VirtualFree HeapCreate HeapDestroy GetVersionExA FindFirstFileA lstrcmpA MultiByteToWideChar FindClose GetEnvironmentVariableA GetOEMCP GetACP GetCPInfo GetStringTypeW HeapFree HeapAlloc GetLastError GetFileType WriteFile SetFilePointer ExitProcess TerminateProcess RtlUnwind GetStartupInfoA GetVersion GetStringTypeA

user32

SetWindowTextA DefWindowProcA DestroyWindow CreateWindowExA LoadCursorA RegisterClassExA LoadAcceleratorsA GetMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA PostQuitMessage PostMessageA EnableWindow ShowWindow UpdateWindow LoadStringA WaitForInputIdle MessageBoxA DialogBoxParamA EndDialog SetDlgItemTextA LoadIconA

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

shell32

SHBrowseForFolderA SHGetPathFromIDListA SHGetMalloc FindExecutableA

Sharing

General

Malware Config

Signatures

File Explorer

SB24_PCDRV_LB_1_04_0090a.exe

PE Signature issue

kernel32

user32

advapi32

shell32

generic