HashMyFiles[.]exe | Triage™

General

Target
HashMyFiles.exe
Size 51KB
Sample260908-plefpsfd53
SHA256 39d50d35da993a7667c4436b799974669e705f0ec975ca0b3e161e45bfda029c
MD5 4bf78929727348777aafb75c6c294b6e
SHA1 12e4aff3f683e9b5cd561dd70a9c6e68af83a722
SHA512 f5d1dc1df528e5bb998774333b7de2db1a13e139fbfd68697fe37a9e12ab4829d5b41c3a961649cb6cf6d5fbfc490c8fc4d0b894cb878bc54406ee4c03bcf2bf
SSDEEP 1536:tYenLJ4lpQ7cA+qojCZ6jNNu4ZBpSaq4kB8:txLJ4lccA+q6dLpTq4ku
TLSH
T12F33CFA2E314E731D26D093418ABCB336D31FE866CA0439B62F4F9BE7C713906E49555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
static1/unpack001/out.upx	Nirsoft

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
HashMyFiles.exe

File Explorer

HashMyFiles.exe

.exe 51KB
out.upx

.exe 86KB

HashMyFiles.exe

SHA256 39d50d35da993a7667c4436b799974669e705f0ec975ca0b3e161e45bfda029c
MD5 4bf78929727348777aafb75c6c294b6e
SHA1 12e4aff3f683e9b5cd561dd70a9c6e68af83a722
SHA512 f5d1dc1df528e5bb998774333b7de2db1a13e139fbfd68697fe37a9e12ab4829d5b41c3a961649cb6cf6d5fbfc490c8fc4d0b894cb878bc54406ee4c03bcf2bf
SSDEEP 1536:tYenLJ4lpQ7cA+qojCZ6jNNu4ZBpSaq4kB8:txLJ4lccA+q6dLpTq4ku
TLSH
T12F33CFA2E314E731D26D093418ABCB336D31FE866CA0439B62F4F9BE7C713906E49555
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

cc:ad:c2:c0:44:a2:aa:78:6b:fb:98:6a:0d:49:0f:11:e3:ad:69:94

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Chains

Mar 23, 2016

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Serial Number

1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 12, 2014 - Sep 12, 2019

Minor OS version

0

Major OS version

4

Entry point

112704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 059ebbfaf702ee14ceb5278a4fb018a3fdc959ed3c75f5c7ed4ab4f24f4f7d1c
MD5 99cd38c388936457dae35de5affe59d8
SHA1 cda77a8a670a9bf964f165fe4f528f190a34f898
SHA512 4ec320b1465ba8bfdd116f0a8d6f4db8ccc963a2c167ddbafe8347fd67e639aab0755c10ad6a9675c79e5cc2f38134ea21508849ce3accb0938fa49399091d87
SSDEEP 1536:txzBr0rQYd/P05iDK1egkYbBsqmzuXLli+SF4kxkD2Fe:D9r00C/8yVnYRmzuXL0+w4kCD2Fe
TLSH
T14C832803B7E08071F5B35A707E3B97258AB97D315A34DA0F87507A0E7CB0A41D9267A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

59528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

HashMyFiles.exe

PE Signature issue

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

HashMyFiles.exe

PE Signature issue

generic

out.upx

generic