EPA_4000[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
EPA_4000.exe
Size 118.9MB
Sample260818-aarvbssxcy
SHA256 bd6b5fe71956c68950b02d518182365a4dd21dc4608092c18563b148949d7124
MD5 eb171c4fffdaa45538728134c767ef85
SHA1 6c4a8826371d62cd54012d6c83b10ae257b7b537
SHA512 e92a70b4def954e1c043911bc338351780f12b053683de243b1956568865a7a450e92d2ab45012c9d99ff43ccdaf0a07355d15198b8f0e65c3408d55473b9bee
SSDEEP 3145728:Tb60KQoKYQ7ka9CmVhv6BNYi9dzcT68dNNSS9EyJX4EPdkb/j:yzTKdkyvVRiPYT68tqe4EPOb/j
TLSH
T16F5833A3A48ACF3ED662593AA9E5F948065E3511B01A84F3F78CDFD7613335B42B4E40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

EPA_4000.exe

.exe 118.9MB

EPA_4000.exe

IMPHASH cc000e0a56358759c95f653af1246259
SHA256 bd6b5fe71956c68950b02d518182365a4dd21dc4608092c18563b148949d7124
MD5 eb171c4fffdaa45538728134c767ef85
SHA1 6c4a8826371d62cd54012d6c83b10ae257b7b537
SHA512 e92a70b4def954e1c043911bc338351780f12b053683de243b1956568865a7a450e92d2ab45012c9d99ff43ccdaf0a07355d15198b8f0e65c3408d55473b9bee
SSDEEP 3145728:Tb60KQoKYQ7ka9CmVhv6BNYi9dzcT68dNNSS9EyJX4EPdkb/j:yzTKdkyvVRiPYT68tqe4EPOb/j
TLSH
T16F5833A3A48ACF3ED662593AA9E5F948065E3511B01A84F3F78CDFD7613335B42B4E40
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

ee:5f:47:69:58:79:41:44:38:42:33:d9:87:74:16:38:84:29:25:90:b5:dd:f5:68:62:0c:f2:d6:01:cf:8d:2c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Feb 19, 2025

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Serial Number

0b:61:f1:ee:bd:68:35:54:19:56:0f:0e:fe:4b:73:96

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 16, 2024 - Oct 16, 2025

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

52628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileAttributesA RemoveDirectoryA SetEndOfFile SetFilePointer CloseHandle UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileA GetWindowsDirectoryA MoveFileExA GlobalFree GlobalUnlock GlobalHandle _lclose _llseek _lread _lopen GlobalLock GlobalAlloc GlobalMemoryStatus GetVersion GetModuleFileNameA WriteFile GetSystemTime CreateProcessA LocalFree ExitProcess FormatMessageA DeleteFileA GetModuleHandleA GetVolumeInformationA FindNextFileA GetTickCount WideCharToMultiByte WaitForSingleObject GetLongPathNameA GetTempPathA GetCommandLineA CopyFileA GetFileAttributesA LoadLibraryExA GetSystemDirectoryA SetErrorMode MultiByteToWideChar GetLocalTime lstrlenA CreateFileW ReadFile GetEnvironmentVariableA GetDriveTypeA LocalAlloc DosDateTimeToFileTime LocalFileTimeToFileTime GetVersionExA SetFileTime CreateDirectoryA SetCurrentDirectoryA FindFirstFileA FindClose GetLastError GetProcAddress FreeLibrary InterlockedExchange LoadLibraryA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree HeapReAlloc GetProcessHeap GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId Sleep HeapSize DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapDestroy HeapCreate GetStdHandle LCMapStringA LCMapStringW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode InitializeCriticalSection SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers

gdi32

CreateDCA SetBkColor SetTextColor SetTextAlign GetBkColor GetTextExtentPoint32A ExtTextOutA GetDeviceCaps CreateFontIndirectA DeleteDC SelectObject DeleteObject

Sharing

General

Malware Config

Signatures

File Explorer

EPA_4000.exe

kernel32

gdi32

generic