293e60ba4c1b4a839aeca1d9cc61b5bd044ae23395e5c992914f450f449cedf3

Sharing

Copy URL Twitter E-mail

General

Target
293e60ba4c1b4a839aeca1d9cc61b5bd044ae23395e5c992914f450f449cedf3
Size 1.5MB
Sample260910-mvc8wsvxey
SHA256 293e60ba4c1b4a839aeca1d9cc61b5bd044ae23395e5c992914f450f449cedf3
MD5 b1f0cab6c33af6ceda29f99902435dea
SHA1 6f183b0a8ec556444916918c6194c44eddc39477
SHA512 e6b1313ac7ec4506f7615199cea26001f47b7461272398b2bbce5b6789a0e2b54f58c72622c5a1f5d078ea7cb59542654a4e1df19090625d4c8a0f6b7b713675
SSDEEP 24576:CZTMPo38SOau028X8qtsAv9BXJAO0RHzoIIkkiA:RBHaZ2HqX9BKO2HY
TLSH
T1A6657B03F99241E9E05DC134C7764776DA32BC465F31E5FB02D0AA252EA7AD08F39BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
293e60ba4c1b4a839aeca1d9cc61b5bd044ae23395e5c992914f450f449cedf3

File Explorer

293e60ba4c1b4a839aeca1d9cc61b5bd044ae23395e5c992914f450f449cedf3

.exe 1.5MB

293e60ba4c1b4a839aeca1d9cc61b5bd044ae23395e5c992914f450f449cedf3

IMPHASH ebc3a7dc69efec583a1b47701a41debb
SHA256 293e60ba4c1b4a839aeca1d9cc61b5bd044ae23395e5c992914f450f449cedf3
MD5 b1f0cab6c33af6ceda29f99902435dea
SHA1 6f183b0a8ec556444916918c6194c44eddc39477
SHA512 e6b1313ac7ec4506f7615199cea26001f47b7461272398b2bbce5b6789a0e2b54f58c72622c5a1f5d078ea7cb59542654a4e1df19090625d4c8a0f6b7b713675
SSDEEP 24576:CZTMPo38SOau028X8qtsAv9BXJAO0RHzoIIkkiA:RBHaZ2HqX9BKO2HY
TLSH
T1A6657B03F99241E9E05DC134C7764776DA32BC465F31E5FB02D0AA252EA7AD08F39BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

95:d5:f8:fd:6f:22:42:23:27:59:31:62:53:a7:9c:ce:c0:c2:7c:54:25:71:5d:0c:7c:0d:83:67:c8:a2:2e:ef

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 20, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

463936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msedge_pwa_launcher.exe.pdb

advapi32

CreateProcessAsUserW EventRegister EventUnregister EventWrite RegCloseKey RegCreateKeyExW RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CompareStringW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW GetWindowsDirectoryW InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpiW

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

user32

AllowSetForegroundWindow PostMessageW

winmm

timeGetTime

ole32

CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

Name

.text

Size

981KB

Virtual Size

980KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

367KB

Virtual Size

367KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

36B

Characteristics

Name

.tls

Size

512B

Virtual Size

289B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

293e60ba4c1b4a839aeca1d9cc61b5bd044ae23395e5c992914f450f449cedf3

PE Signature issue

advapi32

kernel32

shell32

userenv

user32

winmm

ole32

generic