Eraser 6[.]2[.]0[.]2993[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Eraser 6.2.0.2993.exe
Size 8.4MB
Sample260809-pfqa1sxdrb
SHA256 062ccb4e9e6f90d3e5b0df23a4c85c65690a1b527a70015c914e17468fc74bbc
MD5 ccc33a97215d0f681f0a93e9c2cbea21
SHA1 4264b1e46b1f4d0e98659c8167994197a87f6a11
SHA512 767e162aa88da7f05f6a304152c1baba928418eb59f7a657bdb0959a96f01a6aa280565231ac6d0ae1d85c3b78595d8e21011e11d0ec8566a958904556309d54
SSDEEP 196608:4LP77AnQvG91X+fOqHi2z6/o7W7D8Jsj/7dPV7MgsKXLB6:4L/UH2fnz6Q7W7oO//AgsKXLw
TLSH
T11096332433D6D0F4D1E1153584A867B85E3EDE129F51CAFF6BD92F2A1A601C12A30FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
Eraser 6.2.0.2993.exe

File Explorer

Eraser 6.2.0.2993.exe

.exe 8.4MB

Eraser 6.2.0.2993.exe

IMPHASH a01e45cd5f93a1431db468dc3fc08863
SHA256 062ccb4e9e6f90d3e5b0df23a4c85c65690a1b527a70015c914e17468fc74bbc
MD5 ccc33a97215d0f681f0a93e9c2cbea21
SHA1 4264b1e46b1f4d0e98659c8167994197a87f6a11
SHA512 767e162aa88da7f05f6a304152c1baba928418eb59f7a657bdb0959a96f01a6aa280565231ac6d0ae1d85c3b78595d8e21011e11d0ec8566a958904556309d54
SSDEEP 196608:4LP77AnQvG91X+fOqHi2z6/o7W7D8Jsj/7dPV7MgsKXLB6:4L/UH2fnz6Q7W7oO//AgsKXLw
TLSH
T11096332433D6D0F4D1E1153584A867B85E3EDE129F51CAFF6BD92F2A1A601C12A30FA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

7a:81:97:a3:9a:8f:00:04:4a:c4:07:e8:d1:b4:1f:b0:c8:65:a4:a3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Heidi Computers Ltd,O=Heidi Computers Ltd,L=Greystones,ST=Leinster,C=IE

Chains

Sep 25, 2021

CN=Heidi Computers Ltd,O=Heidi Computers Ltd,L=Greystones,ST=Leinster,C=IE

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=Heidi Computers Ltd,O=Heidi Computers Ltd,L=Greystones,ST=Leinster,C=IE

Serial Number

69:24:4f:da:86:ad:71:23:0f:a4:46:99

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 19, 2020 - Jan 19, 2024

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 27, 2021 - Jun 28, 2032

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

53104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

kernel32

GetFileSize UpdateResourceW EndUpdateResourceW FindResourceW LoadResource SizeofResource LockResource CreateProcessW WaitForSingleObject GetExitCodeProcess GetNativeSystemInfo CreateDirectoryW RemoveDirectoryW FindFirstFileW DeleteFileW FindNextFileW FindClose GetTempPathW GetModuleFileNameW FormatMessageW GetLastError BeginUpdateResourceW GetConsoleOutputCP FlushFileBuffers HeapSize SetFilePointerEx SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFileType HeapReAlloc WriteFile GetConsoleMode CreateFileW CloseHandle ReadFile WideCharToMultiByte MultiByteToWideChar EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle HeapFree HeapAlloc LCMapStringW WriteConsoleW

user32

CallWindowProcW PostQuitMessage SetWindowTextW SetWindowLongW GetWindowLongW EnableWindow UpdateWindow InvalidateRect ShowWindow DefWindowProcW RegisterClassExW LoadCursorW LoadIconW SendMessageW CreateWindowExW DestroyWindow DispatchMessageW TranslateMessage GetMessageW PeekMessageW MessageBoxW SystemParametersInfoW

gdi32

CreateFontIndirectW

shell32

CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

Eraser 6.2.0.2993.exe

comctl32

kernel32

user32

gdi32

shell32

generic