b4db1e169239c1c051e7744ac87515c953eac062f5157820bb824fbe533cb061

Sharing

Copy URL Twitter E-mail

General

Target
b4db1e169239c1c051e7744ac87515c953eac062f5157820bb824fbe533cb061
Size 865KB
Sample260831-vs4xtshf95
SHA256 b4db1e169239c1c051e7744ac87515c953eac062f5157820bb824fbe533cb061
MD5 d642d94442b1fb24fe9b5ce341cf3071
SHA1 145de76cb3d1f6991e007dedb02e66a06d394ea6
SHA512 3ac907574db819356daba0e2863a33adba906357031d3966efd7bdb22742d6147b2d0304b8e64015f73ecec58c17cd50f797b0f3c3688bbe3992fe3d501487bb
SSDEEP 24576:vntHKCCO6VD6mp7o431BQ6d5zNem/uAB95:vn4hvZ6mRoIjV/H5
TLSH
T15F1502E2D25499E9F9D606F5ED27A93111636E5C88E4110F64FE7E213BF338210DAE0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
b4db1e169239c1c051e7744ac87515c953eac062f5157820bb824fbe533cb061

File Explorer

b4db1e169239c1c051e7744ac87515c953eac062f5157820bb824fbe533cb061

.exe 865KB

b4db1e169239c1c051e7744ac87515c953eac062f5157820bb824fbe533cb061

SHA256 b4db1e169239c1c051e7744ac87515c953eac062f5157820bb824fbe533cb061
MD5 d642d94442b1fb24fe9b5ce341cf3071
SHA1 145de76cb3d1f6991e007dedb02e66a06d394ea6
SHA512 3ac907574db819356daba0e2863a33adba906357031d3966efd7bdb22742d6147b2d0304b8e64015f73ecec58c17cd50f797b0f3c3688bbe3992fe3d501487bb
SSDEEP 24576:vntHKCCO6VD6mp7o431BQ6d5zNem/uAB95:vn4hvZ6mRoIjV/H5
TLSH
T15F1502E2D25499E9F9D606F5ED27A93111636E5C88E4110F64FE7E213BF338210DAE0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a5:ac:17:1b:da:89:f0:df:a8:37:fb:2b:91:66:cb:4f:35:f6:f4:4c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=Engineering Excellence,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Feb 10, 2015

CN=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=Engineering Excellence,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=Engineering Excellence,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

07:bb:7e:65:86:c7:d0:0d:36:17:00:e4:13:9f:e7:72

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 5, 2015 - Feb 6, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

1931744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

b4db1e169239c1c051e7744ac87515c953eac062f5157820bb824fbe533cb061

PE Signature issue

generic