57b635da9c7933c7f943ffd7a47fa8eccf672377158581ebbbead3cf468a18ba

Sharing

Copy URL Twitter E-mail

General

Target
57b635da9c7933c7f943ffd7a47fa8eccf672377158581ebbbead3cf468a18ba
Size 2.6MB
Sample260827-vx68rayfjd
SHA256 57b635da9c7933c7f943ffd7a47fa8eccf672377158581ebbbead3cf468a18ba
MD5 403bd664c2172610c519b0929e33866a
SHA1 71e0bfeac6bffe9300f4feb2ce59b74667881c83
SHA512 2af3949bd33a5fd2bcab1994559eaa84c9a41bc3d732f52d1cabffd5105ec107f988cc412f2da9ef5e2293ad04ac94263d964bb40ce081fe2252e97cef344061
SSDEEP 49152:KFoHgEIXrjXfE44zAKveF+7YdOcYTBZEjUqxZgJGLfgqjJUDYWbXy:pHgNDfXQ1veFPk5FaoCRrgGUDxy
TLSH
T1B6C5333393D0D436F4D12BB89AFD237B12767C95A635A33BD2888085586D3D8BA7431B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
57b635da9c7933c7f943ffd7a47fa8eccf672377158581ebbbead3cf468a18ba

File Explorer

57b635da9c7933c7f943ffd7a47fa8eccf672377158581ebbbead3cf468a18ba

.exe 2.6MB

57b635da9c7933c7f943ffd7a47fa8eccf672377158581ebbbead3cf468a18ba

IMPHASH 0ebb3c09b06b1666d307952e824c8697
SHA256 57b635da9c7933c7f943ffd7a47fa8eccf672377158581ebbbead3cf468a18ba
MD5 403bd664c2172610c519b0929e33866a
SHA1 71e0bfeac6bffe9300f4feb2ce59b74667881c83
SHA512 2af3949bd33a5fd2bcab1994559eaa84c9a41bc3d732f52d1cabffd5105ec107f988cc412f2da9ef5e2293ad04ac94263d964bb40ce081fe2252e97cef344061
SSDEEP 49152:KFoHgEIXrjXfE44zAKveF+7YdOcYTBZEjUqxZgJGLfgqjJUDYWbXy:pHgNDfXQ1veFPk5FaoCRrgGUDxy
TLSH
T1B6C5333393D0D436F4D12BB89AFD237B12767C95A635A33BD2888085586D3D8BA7431B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b1:82:12:a8:bb:1b:a7:cc:9b:e1:6f:fe:4c:8f:f8:d9:53:7d:0f:c2

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 21, 2006

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 23, 2002 - Sep 25, 2011

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:87:58:00:03:00:00:00:5a

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 5, 2005 - Apr 5, 2006

Minor OS version

Major OS version

Entry point

25692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

FreeSid AllocateAndInitializeSid EqualSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA RegCloseKey RegDeleteValueA RegOpenKeyExA RegSetValueExA RegQueryValueExA RegCreateKeyExA RegQueryInfoKeyA

kernel32

LocalFree LocalAlloc GetLastError GetCurrentProcess lstrlenA GetModuleFileNameA GetSystemDirectoryA _lclose _llseek _lopen WritePrivateProfileStringA GetWindowsDirectoryA CreateDirectoryA GetFileAttributesA ExpandEnvironmentStringsA lstrcpyA GlobalFree GlobalUnlock GlobalLock GlobalAlloc IsDBCSLeadByte GetShortPathNameA GetPrivateProfileStringA GetPrivateProfileIntA lstrcmpiA RemoveDirectoryA FindClose FindNextFileA DeleteFileA SetFileAttributesA lstrcmpA FindFirstFileA FreeResource GetProcAddress LoadResource SizeofResource FindResourceA lstrcatA CloseHandle WriteFile SetFilePointer SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetCurrentDirectoryA GetTempFileNameA ExitProcess CreateFileA LoadLibraryExA lstrcpynA GetVolumeInformationA FormatMessageA GetCurrentDirectoryA GetVersionExA GetExitCodeProcess WaitForSingleObject CreateProcessA GetTempPathA GetSystemInfo CreateMutexA SetEvent CreateEventA CreateThread ResetEvent TerminateThread GetDriveTypeA GetModuleHandleA GetStartupInfoA GetCommandLineA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter ReadFile LoadLibraryA GetDiskFreeSpaceA MulDiv EnumResourceLanguagesA FreeLibrary LockResource

gdi32

GetDeviceCaps

user32

ExitWindowsEx wsprintfA CharNextA CharUpperA CharPrevA SetWindowLongA GetWindowLongA CallWindowProcA DispatchMessageA MsgWaitForMultipleObjects PeekMessageA SendMessageA SetWindowPos ReleaseDC GetDC GetWindowRect SendDlgItemMessageA GetDlgItem SetForegroundWindow SetWindowTextA MessageBoxA DialogBoxIndirectParamA ShowWindow EnableWindow GetDlgItemTextA EndDialog GetDesktopWindow MessageBeep SetDlgItemTextA LoadStringA GetSystemMetrics

comctl32

ord17

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

Sharing

General

Malware Config

Signatures

File Explorer

57b635da9c7933c7f943ffd7a47fa8eccf672377158581ebbbead3cf468a18ba

PE Signature issue

advapi32

kernel32

gdi32

user32

comctl32

version

generic