vcredist_x86_vc141[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
vcredist_x86_vc141.exe
Size 14.0MB
Sample260819-w9769a1aqa
SHA256 7eadb463bdf3cd1de633b0a292b485fcca7647ca5f9145600f784c7dd5ddf115
MD5 e8e0bb4f12ec984cce63665b4a4f3f09
SHA1 cbfcd67c7660e186a12e4523ffc9300a45bd728b
SHA512 f895e1146acd8a4f01f13a9e94ccf5fb4c0726ce6554fe1ae93ea1fa07a484a074e6fa0aeccf1a22733ea164d49cf993f6e5983a991072dc5968e9561e7de2dd
SSDEEP 393216:+jFzlptVYmfr7yBG/4doNifUXxE2MCg5OxMmnH:+DpttD7yBG/WoXXxE2M1iz
TLSH
T154E63333A5844036DFF70477A968A9203F3CD62423158ABAE2CCDD5D27B919223FB756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
vcredist_x86_vc141.exe

File Explorer

vcredist_x86_vc141.exe

.exe 14.0MB

vcredist_x86_vc141.exe

IMPHASH 58e63938ccf607896b1a0dac4dd9b11d
SHA256 7eadb463bdf3cd1de633b0a292b485fcca7647ca5f9145600f784c7dd5ddf115
MD5 e8e0bb4f12ec984cce63665b4a4f3f09
SHA1 cbfcd67c7660e186a12e4523ffc9300a45bd728b
SHA512 f895e1146acd8a4f01f13a9e94ccf5fb4c0726ce6554fe1ae93ea1fa07a484a074e6fa0aeccf1a22733ea164d49cf993f6e5983a991072dc5968e9561e7de2dd
SSDEEP 393216:+jFzlptVYmfr7yBG/4doNifUXxE2MCg5OxMmnH:+DpttD7yBG/WoXXxE2M1iz
TLSH
T154E63333A5844036DFF70477A968A9203F3CD62423158ABAE2CCDD5D27B919223FB756
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8b:90:c0:4b:ff:de:c2:45:49:d8:f0:f1:12:ec:1c:df:2b:53:ac:30

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 14, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 12, 2018 - Jul 26, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:f6:38:0d:9a:86:d0:5c:a4:3b:00:00:00:00:00:f6

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 23, 2018 - Nov 23, 2019

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Minor OS version

Major OS version

Entry point

174077

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\build\work\eca3d12b\wix3\build\ship\x86\burn.pdb

advapi32

OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownExW GetUserNameW RegCloseKey RegQueryValueExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW DecryptFileW CreateWellKnownSid InitializeAcl SetEntriesInAclW ChangeServiceConfigW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW QueryServiceStatus QueryServiceConfigW SetNamedSecurityInfoW CheckTokenMembership AllocateAndInitializeSid SetEntriesInAclA SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW GetTokenInformation CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegOpenKeyExW SystemFunction036

user32

WaitForInputIdle PostQuitMessage TranslateMessage DispatchMessageW DefWindowProcW RegisterClassW CreateWindowExW MessageBoxW GetCursorPos GetWindowLongW IsWindow LoadBitmapW LoadCursorW IsDialogMessageW MonitorFromPoint PostThreadMessageW MsgWaitForMultipleObjects PeekMessageW SetWindowLongW GetMessageW UnregisterClassW GetMonitorInfoW PostMessageW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

gdi32

StretchBlt SelectObject DeleteObject DeleteDC CreateCompatibleDC GetObjectW

shell32

CommandLineToArgvW ShellExecuteExW SHGetFolderPathW

ole32

CoInitializeEx CoUninitialize CoInitializeSecurity CLSIDFromProgID CoInitialize StringFromGUID2 CoTaskMemFree CoCreateInstance

kernel32

FreeLibrary GetProcAddress EnterCriticalSection LeaveCriticalSection GetSystemTime GetNativeSystemInfo lstrlenW GetModuleHandleExW GetSystemDirectoryW GetTempPathW GetWindowsDirectoryW GetSystemWow64DirectoryW GetComputerNameW VerifyVersionInfoW GetVolumePathNameW CompareStringW GetDateFormatW GetSystemDefaultLangID GetUserDefaultLangID GetStringTypeW ExpandEnvironmentStringsW GetFileAttributesW ReadFile SetFilePointerEx CreateFileW CreateProcessW DuplicateHandle InterlockedExchange InterlockedCompareExchange LoadLibraryW lstrlenA CreateEventW GetCurrentProcessId ProcessIdToSessionId LocalFree OpenProcess GetProcessId WaitForSingleObject WriteFile ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW CreateThread GetExitCodeThread FindClose SetFileAttributesW FindFirstFileW FindNextFileW SetEvent WaitForMultipleObjects InterlockedIncrement InterlockedDecrement ResetEvent SetEndOfFile SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA CompareStringA SetCurrentDirectoryW GetCurrentDirectoryW GetExitCodeProcess SetThreadExecutionState CopyFileExW MapViewOfFile UnmapViewOfFile CreateMutexW CreateFileMappingW GetThreadLocale VerSetConditionMask GetVersionExW GetModuleHandleW TlsFree TlsSetValue TlsGetValue SystemTimeToTzSpecificLocalTime VirtualFree VirtualAlloc RemoveDirectoryW MoveFileExW GetFullPathNameW CreateDirectoryW CopyFileW DeleteFileW GetFileSizeEx GetTempFileNameW FormatMessageW TlsAlloc CloseHandle GetLocalTime SetFilePointer Sleep ReleaseMutex DeleteCriticalSection InitializeCriticalSection GetLastError GetCurrentThreadId GetCurrentProcess WriteConsoleW DecodePointer FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc HeapSize GetProcessHeap SetStdHandle LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GlobalFree GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW GetFileType HeapAlloc HeapSetInformation GetTimeZoneInformation SystemTimeToFileTime GlobalAlloc GetModuleHandleA QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetModuleFileNameW RaiseException InitializeCriticalSectionAndSpinCount LoadLibraryExW RtlUnwind SetLastError GetStdHandle MultiByteToWideChar WideCharToMultiByte ExitProcess GetACP HeapFree

cabinet

ord20 ord22 ord23

crypt32

CertGetCertificateContextProperty CryptHashPublicKeyInfo

msi

ord141 ord137 ord169 ord70 ord88 ord190 ord238 ord173 ord45 ord205 ord90 ord171 ord118 ord115 ord125 ord17 ord111 ord116 ord8

rpcrt4

UuidCreate

wininet

InternetOpenW InternetCloseHandle InternetConnectW InternetReadFile InternetErrorDlg InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW InternetCrackUrlW

wintrust

CryptCATAdminCalcHashFromFileHandle WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrust

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

shlwapi

PathCanonicalizeW

Name

.text

Size

291KB

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

vcredist_x86_vc141.exe

PE Signature issue

advapi32

user32

oleaut32

gdi32

shell32

ole32

kernel32

cabinet

crypt32

msi

rpcrt4

wininet

wintrust

version

shlwapi

generic