f937330f1a51c49e95e340d0375361538024f7b780e10c41199639ec77b50892

Sharing

Copy URL Twitter E-mail

General

Target
f937330f1a51c49e95e340d0375361538024f7b780e10c41199639ec77b50892
Size 1.4MB
Sample260814-k7eldagg69
SHA256 f937330f1a51c49e95e340d0375361538024f7b780e10c41199639ec77b50892
MD5 2a753e57b9bca7e0f1dcc6bc2fb4d644
SHA1 ee07150f635a300cc0456c31aac6c50bae01dec2
SHA512 edc3c72156194af53b0a75778bdf2f00da547787010c3261009e0a77ceb133397c295eeb38e27e965fce6c377d9d30b169a8fe6ce51477d8346110fd4ea853ad
SSDEEP 24576:AUyoeu26kh+pzUVbg81LASKSFYak8Qp8mqaIs72P5SVI0bqu923YotOLpDsKrGDA:+q26kyIf6SbcTEJ5SVhaOVD1rWk
TLSH
T1F365234712C4003ACDF9AFB4BCFA118307327DA5AB6442EB774965EA4CB27D1A835367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
f937330f1a51c49e95e340d0375361538024f7b780e10c41199639ec77b50892

File Explorer

f937330f1a51c49e95e340d0375361538024f7b780e10c41199639ec77b50892

.exe 1.4MB

f937330f1a51c49e95e340d0375361538024f7b780e10c41199639ec77b50892

IMPHASH 646167cce332c1c252cdcb1839e0cf48
SHA256 f937330f1a51c49e95e340d0375361538024f7b780e10c41199639ec77b50892
MD5 2a753e57b9bca7e0f1dcc6bc2fb4d644
SHA1 ee07150f635a300cc0456c31aac6c50bae01dec2
SHA512 edc3c72156194af53b0a75778bdf2f00da547787010c3261009e0a77ceb133397c295eeb38e27e965fce6c377d9d30b169a8fe6ce51477d8346110fd4ea853ad
SSDEEP 24576:AUyoeu26kh+pzUVbg81LASKSFYak8Qp8mqaIs72P5SVI0bqu923YotOLpDsKrGDA:+q26kyIf6SbcTEJ5SVhaOVD1rWk
TLSH
T1F365234712C4003ACDF9AFB4BCFA118307327DA5AB6442EB774965EA4CB27D1A835367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

66:f4:f8:2f:3f:e4:fc:86:6c:2f:3e:53:f2:30:29:7f:39:6b:1d:95:a6:b4:a7:10:c7:7d:0a:79:e4:30:54:c3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 19, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 8, 2024 - Apr 10, 2027

Minor OS version

Major OS version

Entry point

27984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

GetTokenInformation RegDeleteValueA RegOpenKeyExA RegQueryInfoKeyA FreeSid OpenProcessToken RegSetValueExA RegCreateKeyExA LookupPrivilegeValueA AllocateAndInitializeSid RegQueryValueExA EqualSid RegCloseKey AdjustTokenPrivileges

kernel32

_lopen _llseek CompareStringA GetLastError GetFileAttributesA GetSystemDirectoryA LoadLibraryA DeleteFileA GlobalAlloc GlobalFree CloseHandle WritePrivateProfileStringA IsDBCSLeadByte GetWindowsDirectoryA SetFileAttributesA GetProcAddress GlobalLock LocalFree RemoveDirectoryA FreeLibrary _lclose CreateDirectoryA GetPrivateProfileIntA GetPrivateProfileStringA GlobalUnlock ReadFile SizeofResource WriteFile GetDriveTypeA lstrcmpA SetFileTime SetFilePointer FindResourceA CreateMutexA GetVolumeInformationA ExpandEnvironmentStringsA GetCurrentDirectoryA FreeResource GetVersion SetCurrentDirectoryA GetTempPathA LocalFileTimeToFileTime CreateFileA SetEvent TerminateThread GetVersionExA LockResource GetSystemInfo CreateThread ResetEvent LoadResource ExitProcess GetModuleHandleW CreateProcessA FormatMessageA GetTempFileNameA DosDateTimeToFileTime CreateEventA GetExitCodeProcess FindNextFileA LocalAlloc GetShortPathNameA MulDiv GetDiskFreeSpaceA EnumResourceLanguagesA GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW Sleep FindClose GetCurrentProcess FindFirstFileA WaitForSingleObject GetModuleFileNameA LoadLibraryExA

gdi32

GetDeviceCaps

user32

SetWindowLongA GetDlgItemTextA DialogBoxIndirectParamA ShowWindow MsgWaitForMultipleObjects SetWindowPos GetDC GetWindowRect DispatchMessageA GetDesktopWindow CharUpperA SetDlgItemTextA ExitWindowsEx MessageBeep EndDialog CharPrevA LoadStringA CharNextA EnableWindow ReleaseDC SetForegroundWindow PeekMessageA GetDlgItem SendMessageA SendDlgItemMessageA MessageBoxA SetWindowTextA GetWindowLongA CallWindowProcA GetSystemMetrics

msvcrt

_controlfp ?terminate@@YAXXZ _acmdln _initterm __setusermatherr _except_handler4_common memcpy _ismbblead __p__fmode _cexit _exit exit __set_app_type __getmainargs _amsg_exit __p__commode _XcptFilter memcpy_s _vsnprintf memset

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

Sharing

General

Malware Config

Signatures

File Explorer

f937330f1a51c49e95e340d0375361538024f7b780e10c41199639ec77b50892

PE Signature issue

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

cabinet

version

generic