AAd[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AAd.exe
Size 2.0MB
Sample260908-pmpm3afe64
SHA256 7fdaabb625a6180627b307a4f8d533c2eeceef480157c7067849cf20b09fddea
MD5 becbe4f5100b858411dcb51e5719529d
SHA1 553c284d440a34fda1cc3772c98639267002c7a4
SHA512 93c6d25789b7c9d26e5a191569d88cefe5c02f868a6088c2d1ec6d8ddd0643372ab25affaecfa6dc5406addf228d858d92fccbf5f487d2e03d312284423fe679
SSDEEP 49152:LV9yIArXjY4LjAs/p98gieBhDiY6Vt9TRAia2H1:n2jDLn/p8CwXVSia2V
TLSH
T13DA59E42FBD281F1E5B30F7039B9722E5939BF345934816FB3902A1DADB07809965B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
AAd.exe

File Explorer

AAd.exe

.exe 2.0MB

AAd.exe

IMPHASH 6b7a66b9172fbff74b1dc751cfc4aa54
SHA256 7fdaabb625a6180627b307a4f8d533c2eeceef480157c7067849cf20b09fddea
MD5 becbe4f5100b858411dcb51e5719529d
SHA1 553c284d440a34fda1cc3772c98639267002c7a4
SHA512 93c6d25789b7c9d26e5a191569d88cefe5c02f868a6088c2d1ec6d8ddd0643372ab25affaecfa6dc5406addf228d858d92fccbf5f487d2e03d312284423fe679
SSDEEP 49152:LV9yIArXjY4LjAs/p98gieBhDiY6Vt9TRAia2H1:n2jDLn/p8CwXVSia2V
TLSH
T13DA59E42FBD281F1E5B30F7039B9722E5939BF345934816FB3902A1DADB07809965B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

87:ba:c2:77:72:71:1d:4b:4c:95:f4:5b:4a:b4:a6:96:14:8c:75:2a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Sole Proprietorship Smolikov Eugene Gennadyevich,O=Sole Proprietorship Smolikov Eugene Gennadyevich,L=Moscow,ST=Moscow,C=RU,1.2.840.113549.1.9.1=#0c15737570706f7274406165726f61646d696e2e636f6d

Chains

Dec 10, 2017

CN=Sole Proprietorship Smolikov Eugene Gennadyevich,O=Sole Proprietorship Smolikov Eugene Gennadyevich,L=Moscow,ST=Moscow,C=RU,1.2.840.113549.1.9.1=#0c15737570706f7274406165726f61646d696e2e636f6d

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=Sole Proprietorship Smolikov Eugene Gennadyevich,O=Sole Proprietorship Smolikov Eugene Gennadyevich,L=Moscow,ST=Moscow,C=RU,1.2.840.113549.1.9.1=#0c15737570706f7274406165726f61646d696e2e636f6d

Serial Number

01:d6:df:1a:4a:f2:66:ff:f2:50:b9:f2

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 22, 2017 - Apr 12, 2019

Subject

CN=GlobalSign TSA for Advanced - G3 - 001-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

40:cb:42:89:5c:3e:74:94:26:97:ad:2f

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 24, 2017 - Feb 24, 2028

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

1188572

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\hg_clone\source\Output\AeroAdmin.pdb

kernel32

TlsFree OpenProcess TerminateProcess UnmapViewOfFile CreateFileMappingW WaitForSingleObject CreateEventW GetConsoleWindow SetThreadExecutionState GetCurrentProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalFree GlobalUnlock GlobalLock WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GlobalAlloc GetGeoInfoW GetUserGeoID RaiseException FreeLibrary LoadLibraryW GetCommandLineW WTSGetActiveConsoleSessionId AttachConsole SetUnhandledExceptionFilter SetErrorMode ProcessIdToSessionId DeleteFileW GetFileSize CreateFileW GetTickCount WideCharToMultiByte GetModuleFileNameW GetCurrentProcessId ReadFile WriteFile GetProcAddress Sleep PostQueuedCompletionStatus CloseHandle LeaveCriticalSection EnterCriticalSection GetLastError TlsAlloc InterlockedExchangeAdd IsValidCodePage FindNextFileA FindFirstFileExA ReadConsoleW HeapSize GetTimeZoneInformation SetFilePointerEx FlushFileBuffers GetConsoleMode GetConsoleCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetACP GetStdHandle GetModuleFileNameA HeapReAlloc ExitThread GetModuleHandleExW ExitProcess RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect VirtualAlloc LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SwitchToThread SignalObjectAndWait CreateTimerQueue GetStartupInfoW IsDebuggerPresent InitializeSListHead OpenFileMappingW GetModuleHandleW MapViewOfFile IsProcessorFeaturePresent UnhandledExceptionFilter ResetEvent SetEndOfFile SetFilePointer SetFileTime GetFileAttributesExW RemoveDirectoryW MoveFileW FindClose FindNextFileW FindFirstFileW GetDiskFreeSpaceExW GetVolumeInformationW GetLogicalDriveStringsW LoadResource LockResource FindResourceW GetUserDefaultUILanguage GetFileAttributesW GetComputerNameW InterlockedExchange InterlockedDecrement InterlockedIncrement MultiByteToWideChar GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency DuplicateHandle WaitForSingleObjectEx GetCurrentThread GetCurrentThreadId GetExitCodeThread TryEnterCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsGetValue TlsSetValue GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo LocalFree FormatMessageA CreateDirectoryW InterlockedCompareExchange WaitForMultipleObjects TerminateThread QueueUserAPC SetEvent SleepEx CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus VerSetConditionMask VerifyVersionInfoW CompareFileTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime SetCurrentDirectoryW GetThreadTimes DeviceIoControl SetPriorityClass GetVersionExW HeapAlloc GetProcessHeap HeapFree

user32

DestroyMenu FindWindowW GetSystemMetrics RegisterClassExW CreateWindowExW LoadImageW PeekMessageW TranslateMessage DispatchMessageW SetWindowTextW PostMessageW OpenClipboard EmptyClipboard SetClipboardData CloseClipboard TrackPopupMenu SetCursor SetClassLongW wsprintfW ExitWindowsEx ChangeDisplaySettingsW LockWorkStation SendInput GetDC ReleaseDC SendMessageW GetWindowLongW MapWindowPoints DrawMenuBar InsertMenuItemW CreateMenu GetMenuBarInfo LoadIconW SetWindowLongW GetDCEx CreateIconIndirect GetIconInfo GetCursorInfo DestroyCursor InsertMenuW CreatePopupMenu GetCursorPos DefWindowProcW SetForegroundWindow ShowWindow GetWindowDC EnumDisplayMonitors GetUserObjectInformationW OpenInputDesktop CloseWindowStation PostQuitMessage DestroyWindow LoadCursorW GetWindowTextA MapVirtualKeyW CloseDesktop SetThreadDesktop OpenDesktopW GetClipboardData EnumDisplaySettingsW EnumDisplayDevicesW mouse_event SystemParametersInfoW EnableWindow GetDlgItem GetWindowRect GetAsyncKeyState InvalidateRect SetMenu AdjustWindowRect SetFocus SetWindowPos GetClientRect ScreenToClient MoveWindow FillRect CallNextHookEx BroadcastSystemMessageW SetProcessWindowStation UnhookWindowsHookEx SetWindowTextA SetWindowsHookExW GetWindowTextW MessageBoxW IsDlgButtonChecked GetMenu DrawEdge DrawTextExW DrawFrameControl GetParent GetKeyboardState ToAscii SetScrollPos ShowScrollBar SetScrollRange HideCaret ShowCaret MessageBeep DrawTextW SetCaretPos RegisterClassW BeginPaint EndPaint GetFocus UpdateWindow GetScrollPos GetScrollRange CreateCaret DestroyCaret GetWindowPlacement DrawIconEx DestroyIcon GetDesktopWindow GetMonitorInfoW OpenWindowStationW

gdi32

CreatePen CreatePatternBrush CreateCompatibleBitmap GetDeviceCaps GetStockObject CreateFontW CreateSolidBrush DeleteObject CreateCompatibleDC CreateDIBSection SelectObject BitBlt SetBkMode CreateFontIndirectW TextOutW SetTextColor Rectangle CreateDIBitmap GetROP2 SetROP2 GetTextExtentPoint32W GetTextMetricsW ExtTextOutW SetBkColor SetBrushOrgEx CreateBitmap GetBitmapBits GetObjectW RestoreDC SaveDC GetDIBits DeleteDC

advapi32

LookupPrivilegeValueW GetTokenInformation CryptAcquireContextW FreeSid CheckTokenMembership AllocateAndInitializeSid StartServiceCtrlDispatcherW StartServiceW DeleteService OpenServiceW CloseServiceHandle ChangeServiceConfig2W CreateServiceW OpenSCManagerW RegisterServiceCtrlHandlerExW SetServiceStatus CreateProcessAsUserW AdjustTokenPrivileges SetTokenInformation DuplicateTokenEx CryptGenRandom OpenProcessToken RegDeleteValueW RegSetValueExW RegOpenKeyExW SetSecurityInfo RegCloseKey RegQueryValueExW RegCreateKeyExW CryptReleaseContext LookupAccountSidW

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteW SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc SHGetSpecialFolderPathW ord47 ShellExecuteExW Shell_NotifyIconW

ole32

CreateStreamOnHGlobal CoCreateInstance CoUninitialize CoInitializeEx CoInitialize

oleaut32

SysFreeString VariantClear SysStringLen SysAllocString VariantInit

ws2_32

freeaddrinfo bind listen accept getsockname ntohl socket WSASetLastError getsockopt getaddrinfo recv select WSAGetLastError send WSASocketW closesocket ioctlsocket setsockopt gethostname inet_ntoa gethostbyname WSACleanup WSAStartup shutdown WSARecv WSASend connect

urlmon

URLDownloadToFileW

winmm

timeEndPeriod timeBeginPeriod waveOutClose waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader waveOutOpen waveInClose waveInUnprepareHeader waveInReset waveInPrepareHeader waveInOpen waveInGetDevCapsW waveInGetNumDevs waveInAddBuffer waveInStart

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

iphlpapi

GetBestInterface GetAdaptersAddresses

netapi32

NetApiBufferFree NetWkstaTransportEnum

mpr

WNetCloseEnum WNetOpenEnumW WNetEnumResourceW

gdiplus

GdipSaveImageToStream GdiplusShutdown GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipFree GdipAlloc GdipDisposeImage GdipCloneImage GdipCreateBitmapFromHBITMAP

msimg32

AlphaBlend

comctl32

InitCommonControlsEx ord17

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

380KB

Virtual Size

379KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

163KB

Virtual Size

377KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AAd.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

urlmon

winmm

wtsapi32

userenv

iphlpapi

netapi32

mpr

gdiplus

msimg32

comctl32

generic