1df293705e729360e84d4d40e0137c45f10c2d6422e27db40ebba2f8d41b5b52

Sharing

Copy URL Twitter E-mail

General

Target
1df293705e729360e84d4d40e0137c45f10c2d6422e27db40ebba2f8d41b5b52
Size 315KB
Sample260910-kk3ppaak31
SHA256 1df293705e729360e84d4d40e0137c45f10c2d6422e27db40ebba2f8d41b5b52
MD5 294096133d8d86ac9a9831cbea7d0d84
SHA1 60c9fa2e714e77941b823167afa2b6028a17117b
SHA512 62ef84eb999505d33a0c896360557a083e18efb8f94a9b1276088d936de858efedc330fd147dd519b93d2ef132eba91975a3114dc46fde01fb6a68c383797f5f
SSDEEP 6144:ZuV4MxQCZKZ+dqA2xwNFMH5X9r69wBvRfRXGm+nWzgoH9e15dXXi:oSaZKZLAYwNH+FRz1zHmfXi
TLSH
T1EC64399A36140CE6E967D0398A53CA0BE7F2BD456352C3CB1364839E5F637D0D93A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
1df293705e729360e84d4d40e0137c45f10c2d6422e27db40ebba2f8d41b5b52

File Explorer

1df293705e729360e84d4d40e0137c45f10c2d6422e27db40ebba2f8d41b5b52

.dll 315KB

1df293705e729360e84d4d40e0137c45f10c2d6422e27db40ebba2f8d41b5b52

SHA256 1df293705e729360e84d4d40e0137c45f10c2d6422e27db40ebba2f8d41b5b52
MD5 294096133d8d86ac9a9831cbea7d0d84
SHA1 60c9fa2e714e77941b823167afa2b6028a17117b
SHA512 62ef84eb999505d33a0c896360557a083e18efb8f94a9b1276088d936de858efedc330fd147dd519b93d2ef132eba91975a3114dc46fde01fb6a68c383797f5f
SSDEEP 6144:ZuV4MxQCZKZ+dqA2xwNFMH5X9r69wBvRfRXGm+nWzgoH9e15dXXi:oSaZKZLAYwNH+FRz1zHmfXi
TLSH
T1EC64399A36140CE6E967D0398A53CA0BE7F2BD456352C3CB1364839E5F637D0D93A722
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3b:32:38:99:89:cb:71:33:da:1f:cd:d2:9e:31:bf:d2:ad:2b:38:50:e3:30:1a:61:b6:9b:c3:9e:84:0c:c9:d5

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 17, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

3b:32:38:99:89:cb:71:33:da:1f:cd:d2:9e:31:bf:d2:ad:2b:38:50:e3:30:1a:61:b6:9b:c3:9e:84:0c:c9:d5

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 17, 2025

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ff:ed:62:7b:87:d0:66:0d:fa:00:00:00:00:00:ff

Issuer

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2024 - Aug 20, 2025

Subject

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 1, 2013 - May 1, 2028

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ea:9a:24:72:d5:59:3f:61:63:00:01:00:00:01:ea

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:fd:36:44:39:73:0d:dc:02:28:00:00:00:00:03:fd

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2024 - Aug 20, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f0:2a:7c:1d:59:3b:e6:1f:ad:00:01:00:00:01:f0

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 6, 2023 - Mar 5, 2025

Minor OS version

Major OS version

Entry point

180496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

179KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1df293705e729360e84d4d40e0137c45f10c2d6422e27db40ebba2f8d41b5b52

PE Signature issue

PE Signature issue

generic