c99a36232296add00459fca1b852faf0d6a8a3810c2538059493305a2b7427cc

Sharing

Copy URL Twitter E-mail

General

Target
c99a36232296add00459fca1b852faf0d6a8a3810c2538059493305a2b7427cc
Size 1.1MB
Sample260819-tejjasdn8s
SHA256 c99a36232296add00459fca1b852faf0d6a8a3810c2538059493305a2b7427cc
MD5 c6d6fcac4c2daddf3c651ca4d493aa88
SHA1 37e98acd1a1c922d68140d4369aebfc38138020c
SHA512 28dfa97641c6a5dca774025f7becc3e4c4daf72a70c94f9521d6532088bca730bb0f3a75a02dc7dc3ab5f8691753fb09975ada7ff938f7335dce204797fa8625
SSDEEP 24576:TAdHJcyK8WJDi9FfmUdMOhAqxAhZT1o4YpKiQBbbaNJ74/Zlm6P9:HPF8F+AfAq0HYFNNJCZE6P9
TLSH
T15F359D00B686D472F4B605709DB9E7B6553CBD241F3485DBB2D06E2E0C706C26A3AB7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
c99a36232296add00459fca1b852faf0d6a8a3810c2538059493305a2b7427cc

File Explorer

c99a36232296add00459fca1b852faf0d6a8a3810c2538059493305a2b7427cc

.exe 1.1MB

c99a36232296add00459fca1b852faf0d6a8a3810c2538059493305a2b7427cc

IMPHASH d79bc7a2eeb4dca0fb3750a058d45cf0
SHA256 c99a36232296add00459fca1b852faf0d6a8a3810c2538059493305a2b7427cc
MD5 c6d6fcac4c2daddf3c651ca4d493aa88
SHA1 37e98acd1a1c922d68140d4369aebfc38138020c
SHA512 28dfa97641c6a5dca774025f7becc3e4c4daf72a70c94f9521d6532088bca730bb0f3a75a02dc7dc3ab5f8691753fb09975ada7ff938f7335dce204797fa8625
SSDEEP 24576:TAdHJcyK8WJDi9FfmUdMOhAqxAhZT1o4YpKiQBbbaNJ74/Zlm6P9:HPF8F+AfAq0HYFNNJCZE6P9
TLSH
T15F359D00B686D472F4B605709DB9E7B6553CBD241F3485DBB2D06E2E0C706C26A3AB7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

eb:d3:ee:07:cb:c0:86:d1:93:a3:5e:9c:8b:86:6a:7f:4b:81:f6:ec:db:b5:25:55:e6:30:aa:03:6d:02:8f:c6

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,L=Yokohama-shi,ST=Kanagawa-ken,C=JP

Chains

Aug 18, 2026

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,L=Yokohama-shi,ST=Kanagawa-ken,C=JP

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,L=Yokohama-shi,ST=Kanagawa-ken,C=JP

Serial Number

33:00:04:6f:39:0e:81:ae:ff:e8:8b:4d:cc:00:00:00:04:6f:39

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 16, 2026 - Aug 19, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:56:7e:8f:9d:58:08:8e:e9:60:00:00:00:00:00:56

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

617728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\FastCopy\Obj\ReleaseFcp\fcp.pdb

kernel32

CreateDirectoryW GetFullPathNameW GetFileAttributesW GetUserDefaultLCID DeleteFileW MoveFileExW CopyFileW MoveFileW ReadFile GetVolumeInformationW CancelIo TlsSetValue SetLastError EnterCriticalSection FindNextFileW WriteFile GetDiskFreeSpaceW SetFileTime SetThreadPriority LeaveCriticalSection InitializeCriticalSection FindClose WaitForSingleObject CreateFileW GetCurrentThreadId SuspendThread ResumeThread SetFileAttributesW Sleep GetFileInformationByHandle FormatMessageW LocalFileTimeToFileTime GetLastError FileTimeToSystemTime GetCurrentThread TerminateThread TlsAlloc CloseHandle GetLocalTime GetOverlappedResult DeleteCriticalSection SystemTimeToFileTime TlsGetValue SystemTimeToTzSpecificLocalTime TlsFree CreateEventA GetTickCount GetDriveTypeW SetFilePointer SetEndOfFile FlushFileBuffers GetFileSizeEx BackupRead BackupSeek GetFileTime BackupWrite CreateHardLinkW SetFilePointerEx SetFileValidData FindFirstFileW CreateMutexA ReleaseMutex GetFileSize GetSystemTimeAsFileTime SetDllDirectoryW SetConsoleCtrlHandler SetPriorityClass GetCommandLineW SetSystemPowerState GetCurrentProcess GetThreadLocale CreatePipe DuplicateHandle OpenProcess ProcessIdToSessionId TzSpecificLocalTimeToSystemTime GetCurrentProcessId SetThreadExecutionState GetSystemTime GetLongPathNameW GetFileAttributesExW CreateProcessW GetStdHandle SetConsoleMode GetConsoleMode WriteConsoleW GetTempPathW GetCurrentDirectoryW SetCurrentDirectoryW GetModuleFileNameW GetProcAddress FreeLibrary UnmapViewOfFile OpenMutexA CreateFileMappingA MapViewOfFile DeviceIoControl RemoveDirectoryW FindFirstChangeNotificationW GetVolumeNameForVolumeMountPointW FindCloseChangeNotification FindNextChangeNotification GetModuleHandleW HeapSize GetConsoleCP GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetOEMCP IsValidCodePage GetEnvironmentVariableW FindNextFileA FindFirstFileExA SetStdHandle HeapReAlloc InterlockedExchange VirtualFree InterlockedCompareExchange VirtualAlloc SetEvent GetVersionExA GetEnvironmentStringsW IsDebuggerPresent WriteConsoleA OutputDebugStringA AttachConsole GetConsoleProcessList OutputDebugStringW FreeConsole GetFileType InterlockedIncrement AllocConsole SetThreadLocale FindFirstFileExW TerminateProcess GetSystemDirectoryW CreateToolhelp32Snapshot GetExitCodeThread Process32NextW GlobalAlloc Process32FirstW GlobalFree LoadLibraryW GetWindowsDirectoryW GlobalLock MultiByteToWideChar WideCharToMultiByte CreateMutexW GlobalMemoryStatusEx ExitProcess GetModuleFileNameA RtlCaptureStackBackTrace GetModuleHandleExA RaiseException CreateThread IsBadReadPtr SetUnhandledExceptionFilter SizeofResource FindResourceA LockResource LoadResource GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW InitializeCriticalSectionAndSpinCount CreateEventW GetStringTypeW ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ReadConsoleInputA GetCommandLineA GetACP HeapAlloc HeapFree IsValidLocale EnumSystemLocalesW

oleaut32

SafeArrayGetLBound VariantClear SafeArrayCreateVector SafeArrayPutElement SafeArrayGetUBound SafeArrayGetElement VariantInit SysFreeString SysAllocString

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

738KB

Virtual Size

737KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

172KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c99a36232296add00459fca1b852faf0d6a8a3810c2538059493305a2b7427cc

PE Signature issue

kernel32

oleaut32

version

generic