3065614b4ad70921547504f64f641a4d17937dab8bb21e3a2ea8090afa825480

General

Target
3065614b4ad70921547504f64f641a4d17937dab8bb21e3a2ea8090afa825480
Size 381KB
Sample260830-1dyedsak21
SHA256 3065614b4ad70921547504f64f641a4d17937dab8bb21e3a2ea8090afa825480
MD5 2dab0bdd6ece0b2419b462920f9b9316
SHA1 bf3d86598713798f4f8251b4715f31bd929f2752
SHA512 450b2b2565122b0c097d6247fc1448131bfc07d50bbdde7e45bdd842e29bdc97bba197ba3fea6d0279b654f140bdb0630982f918b94acd87b9dfc230ae704ead
SSDEEP 6144:bOe2ZifYSOG2hvH1ygNxBqzCyhbZPwV1vn6eLG2QURdUyuwhpkXNCYpIlooDwBhW:Ce2AfYSOkhbCV1fhCHURBuw/ACYp29
TLSH
T1B3849E0591915A62E712133062B1F68994648C39079286DFF3AC3DB7FBB61C7763738E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
3065614b4ad70921547504f64f641a4d17937dab8bb21e3a2ea8090afa825480

File Explorer

3065614b4ad70921547504f64f641a4d17937dab8bb21e3a2ea8090afa825480

.exe 381KB

3065614b4ad70921547504f64f641a4d17937dab8bb21e3a2ea8090afa825480

IMPHASH 8a452e9497389b10bfcad391cd1b3369
SHA256 3065614b4ad70921547504f64f641a4d17937dab8bb21e3a2ea8090afa825480
MD5 2dab0bdd6ece0b2419b462920f9b9316
SHA1 bf3d86598713798f4f8251b4715f31bd929f2752
SHA512 450b2b2565122b0c097d6247fc1448131bfc07d50bbdde7e45bdd842e29bdc97bba197ba3fea6d0279b654f140bdb0630982f918b94acd87b9dfc230ae704ead
SSDEEP 6144:bOe2ZifYSOG2hvH1ygNxBqzCyhbZPwV1vn6eLG2QURdUyuwhpkXNCYpIlooDwBhW:Ce2AfYSOkhbCV1fhCHURBuw/ACYp29
TLSH
T1B3849E0591915A62E712133062B1F68994648C39079286DFF3AC3DB7FBB61C7763738E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

90:a6:bb:35:1a:cb:a7:5c:a3:a9:50:e3:82:08:44:17:ee:5f:e8:ec

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Nero AG,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LEGAL DEPARTMENT,O=Nero AG,L=Karlsbad,ST=Baden Wuerttemberg,C=DE

Chains

Jun 22, 2007

CN=Nero AG,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LEGAL DEPARTMENT,O=Nero AG,L=Karlsbad,ST=Baden Wuerttemberg,C=DE

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Nero AG,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LEGAL DEPARTMENT,O=Nero AG,L=Karlsbad,ST=Baden Wuerttemberg,C=DE

Serial Number

2a:6a:d4:4a:46:42:fb:73:94:2c:a2:b9:2d:eb:3d:34

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 20, 2006 - Jun 22, 2009

Minor OS version

0

Major OS version

4

Entry point

40199

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\Source\OCTANE\BUSAutostart\Release\Nero Bus info1.pdb

kernel32

LockResource SizeofResource LoadResource GetSystemDefaultLangID FindResourceExW GetUserDefaultLangID FindResourceW FreeResource CreateDirectoryW GetTempPathW FormatMessageW GetModuleFileNameW CompareStringW CompareStringA GetOEMCP WriteFile CreateFileW GetLastError CloseHandle GetACP FlushFileBuffers WideCharToMultiByte MultiByteToWideChar ExitProcess FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileW RtlUnwind RaiseException HeapFree GetModuleHandleA GetStartupInfoW GetVersionExA HeapAlloc LCMapStringA LCMapStringW GetCPInfo GetProcAddress TerminateProcess GetCurrentProcess GetStringTypeA GetStringTypeW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA GetFullPathNameW GetCurrentDirectoryA SetUnhandledExceptionFilter HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc IsBadWritePtr HeapSize GetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA GetLocaleInfoA VirtualProtect GetSystemInfo VirtualQuery GetUserDefaultLCID EnumSystemLocalesA IsValidLocale IsValidCodePage IsBadReadPtr IsBadCodePtr LoadLibraryA InterlockedExchange GetTimeZoneInformation GetCurrentDirectoryW SetFilePointer GetLocaleInfoW GetDriveTypeA SetStdHandle SetEnvironmentVariableA

user32

GetDesktopWindow MessageBoxW

advapi32

RegOpenKeyW RegCloseKey RegQueryValueExW

shell32

ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

3065614b4ad70921547504f64f641a4d17937dab8bb21e3a2ea8090afa825480

PE Signature issue

kernel32

user32

advapi32

shell32

generic