03e08ede7a8e75787d4050fffd52019e14a67e0ebbd7eab7d2c2a697fc635962

Sharing

Copy URL Twitter E-mail

General

Target
03e08ede7a8e75787d4050fffd52019e14a67e0ebbd7eab7d2c2a697fc635962
Size 696KB
Sample260908-qwmqhack8v
SHA256 03e08ede7a8e75787d4050fffd52019e14a67e0ebbd7eab7d2c2a697fc635962
MD5 d370c283626e21b158d5e41975c3fca3
SHA1 c5976b60f46db2e2e86ecb5e9171b68f9f0cb254
SHA512 d696940841a08ee555bf8ade1a1c55c4badac311331bcb98c4e2aee7848a424f7a27334e375c7303857505a97b32b2fe2e64e37c85193035d494f3d8c88c04f8
SSDEEP 12288:rCGbgUFgEsnojA9gUFgEsnojAeCGd+BeDuUlEqatglsLbCLUeDu4:bb9+EM0q9+EM0HdExqatgl8bOUG
TLSH
T125E42B45FBC990A2E4770231486B82B75B70BD254F12D6EFB294936D9E337C0AE31B61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
03e08ede7a8e75787d4050fffd52019e14a67e0ebbd7eab7d2c2a697fc635962

File Explorer

03e08ede7a8e75787d4050fffd52019e14a67e0ebbd7eab7d2c2a697fc635962

.exe 696KB

03e08ede7a8e75787d4050fffd52019e14a67e0ebbd7eab7d2c2a697fc635962

IMPHASH a220beeafc75603adf8a3e0eebda23d9
SHA256 03e08ede7a8e75787d4050fffd52019e14a67e0ebbd7eab7d2c2a697fc635962
MD5 d370c283626e21b158d5e41975c3fca3
SHA1 c5976b60f46db2e2e86ecb5e9171b68f9f0cb254
SHA512 d696940841a08ee555bf8ade1a1c55c4badac311331bcb98c4e2aee7848a424f7a27334e375c7303857505a97b32b2fe2e64e37c85193035d494f3d8c88c04f8
SSDEEP 12288:rCGbgUFgEsnojA9gUFgEsnojAeCGd+BeDuUlEqatglsLbCLUeDu4:bb9+EM0q9+EM0HdExqatgl8bOUG
TLSH
T125E42B45FBC990A2E4770231486B82B75B70BD254F12D6EFB294936D9E337C0AE31B61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c0:01:02:e4:ef:4f:3e:dc:84:af:01:89:a8:dc:85:21:af:c9:47:11:2a:00:56:ef:3d:d2:48:45:b2:fb:c9:91

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 30, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

85:86:38:dc:18:14:30:e0:a8:ce:53:48:5d:e9:22:cb:7a:cf:02:73

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 30, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:89:62:0d:9e:95:d3:61:6b:a8:00:00:00:00:00:89

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 7, 2015 - Jan 7, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7b

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:c6:fe:ea:06:36:34:01:16:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 7, 2015 - Jan 7, 2017

Minor OS version

Major OS version

Entry point

19328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

diagtrackrunner.pdb

advapi32

EventWriteTransfer RegCreateKeyExW RegDeleteValueW RegGetValueW RegCloseKey OpenThreadToken

kernel32

LoadLibraryExW SetEnvironmentVariableW GetModuleHandleExW OutputDebugStringW GetModuleHandleW GetCurrentThread FormatMessageW RaiseException GetLastError SetLastError GetProcAddress GetModuleFileNameA GetCurrentThreadId CloseHandle ExpandEnvironmentStringsW GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter Sleep QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetTickCount TerminateProcess

msvcrt

_CxxThrowException ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ _callnewh _XcptFilter _amsg_exit __wgetmainargs __set_app_type exit _exit _cexit __setusermatherr ??0exception@@QEAA@AEBQEBD@Z __C_specific_handler _fmode _commode ?terminate@@YAXXZ _lock _unlock __dllonexit _onexit ??1type_info@@UEAA@XZ _purecall _vsnwprintf malloc memcpy _initterm __CxxFrameHandler3 free memmove _wcsicmp ??3@YAXPEAX@Z ??0exception@@QEAA@AEBQEBDH@Z memset

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

userenv

ExpandEnvironmentStringsForUserW

diagtrack

RunDll32Main

Sharing

General

Malware Config

Signatures

File Explorer

03e08ede7a8e75787d4050fffd52019e14a67e0ebbd7eab7d2c2a697fc635962

PE Signature issue

PE Signature issue

advapi32

kernel32

msvcrt

ntdll

userenv

diagtrack

generic