f82b717d2de20820868e453f89d66745ae6ef3742a49c8963a476eba8ae0d62e

Sharing

Copy URL Twitter E-mail

General

Target
f82b717d2de20820868e453f89d66745ae6ef3742a49c8963a476eba8ae0d62e
Size 176KB
Sample260831-qvch5sshje
SHA256 f82b717d2de20820868e453f89d66745ae6ef3742a49c8963a476eba8ae0d62e
MD5 e85a5dd042f90c2f10f8439b7830bcec
SHA1 202f10dc925bb014c62699ebce8afd766b9c651e
SHA512 940827031f61f15315bcd6ff4b4b34bcaf1cba212ce6d48048d3a2c934558a2f7f71deb57869eeafea4fbd02716a09a28345ba04e7f2e544c0b7c51adb3086d6
SSDEEP 3072:PaMHjUho9ngktHfMOh/cVF+bM3lX7QEn/s2ItP4EHfqCdk:PaSUhCnfx/cKylLiPny
TLSH
T10E046C313AD2C032C5A714329AF8D776397AB732173690CB77540B796E206E2AB3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
f82b717d2de20820868e453f89d66745ae6ef3742a49c8963a476eba8ae0d62e

File Explorer

f82b717d2de20820868e453f89d66745ae6ef3742a49c8963a476eba8ae0d62e

.exe 176KB

f82b717d2de20820868e453f89d66745ae6ef3742a49c8963a476eba8ae0d62e

IMPHASH cfd63d146322d48b935c8a36ca3d94ed
SHA256 f82b717d2de20820868e453f89d66745ae6ef3742a49c8963a476eba8ae0d62e
MD5 e85a5dd042f90c2f10f8439b7830bcec
SHA1 202f10dc925bb014c62699ebce8afd766b9c651e
SHA512 940827031f61f15315bcd6ff4b4b34bcaf1cba212ce6d48048d3a2c934558a2f7f71deb57869eeafea4fbd02716a09a28345ba04e7f2e544c0b7c51adb3086d6
SSDEEP 3072:PaMHjUho9ngktHfMOh/cVF+bM3lX7QEn/s2ItP4EHfqCdk:PaSUhCnfx/cKylLiPny
TLSH
T10E046C313AD2C032C5A714329AF8D776397AB732173690CB77540B796E206E2AB3571B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

90:0c:f4:b7:53:d2:4c:38:d6:90:6d:62:a1:8b:e5:24:fb:26:d6:04

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Baofeng Technology Co.\, Ltd.,OU=在线QA,O=Beijing Baofeng Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Oct 29, 2015

CN=Beijing Baofeng Technology Co.\, Ltd.,OU=在线QA,O=Beijing Baofeng Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Beijing Baofeng Technology Co.\, Ltd.,OU=在线QA,O=Beijing Baofeng Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

3f:5a:9d:93:d7:70:22:9c:50:3b:83:55:b1:5b:6d:f0

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 5, 2015 - Apr 5, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

65990

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\svnwork\stormplayer\tags\5.54.1029.1111\Setup\BF_NewInstall\src\BF_InstallEngine\bin\Release\OtherInst.pdb

kernel32

HeapAlloc GetProcessHeap HeapFree CreateFileW MoveFileExW Sleep GetModuleHandleW LocalFree LoadLibraryW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetEvent InitializeCriticalSection CreateEventW GlobalFree GetModuleFileNameW GetPrivateProfileStringW GetTempPathW OutputDebugStringW GetFileSize ReadFile SetLastError OpenEventW WriteConsoleW DeleteFileW lstrlenW lstrcpynW TerminateProcess GetCurrentProcess FreeLibrary GetProcAddress LoadLibraryExW SetErrorMode WriteFile CloseHandle CreateProcessW GetLastError WideCharToMultiByte FindResourceExW FindResourceW LoadResource LockResource SetStdHandle SetEndOfFile CreateFileA GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers SetFilePointer GetStartupInfoW GetFileType SetHandleCount GetStringTypeW GetStdHandle ExitProcess HeapCreate IsProcessorFeaturePresent LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter DecodePointer EncodePointer HeapSetInformation GetCommandLineW GetSystemTimeAsFileTime GetCurrentThreadId InterlockedIncrement InterlockedDecrement SizeofResource MultiByteToWideChar HeapDestroy HeapReAlloc HeapSize RaiseException InitializeCriticalSectionAndSpinCount

advapi32

GetUserNameW BuildExplicitAccessWithNameW DeleteAce GetExplicitEntriesFromAclW SetNamedSecurityInfoW SetEntriesInAclW GetNamedSecurityInfoW

shell32

SHGetSpecialFolderPathW SHGetSpecialFolderPathA

ole32

OleInitialize CoCreateInstance CLSIDFromProgID CoLoadLibrary CoFreeLibrary CoUninitialize OleUninitialize CoInitialize

oleaut32

VariantInit SysAllocString SysFreeString VariantClear SysAllocStringByteLen SysStringByteLen

shlwapi

SHSetValueW PathFileExistsA PathAppendW PathFileExistsW SHGetValueW StrCmpW

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpOpen WinHttpCloseHandle WinHttpAddRequestHeaders WinHttpSendRequest WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpWriteData WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpOpenRequest WinHttpReadData WinHttpSetOption

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

f82b717d2de20820868e453f89d66745ae6ef3742a49c8963a476eba8ae0d62e

PE Signature issue

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

winhttp

iphlpapi

generic