2a302d147262a5741c7c0a2faa503406f56cb73c39bfb344cb98fc73014a8c88

Sharing

Copy URL Twitter E-mail

General

Target
2a302d147262a5741c7c0a2faa503406f56cb73c39bfb344cb98fc73014a8c88
Size 387KB
Sample260916-23rtkstyds
SHA256 2a302d147262a5741c7c0a2faa503406f56cb73c39bfb344cb98fc73014a8c88
MD5 d1fc3745d3bb7286e685aa713f59fda1
SHA1 e149a8ed34c82e7b46e35445c21cdddd5e31a768
SHA512 2b7989e8c1a9b4c885d9981f08e1dd11bc7bfa4808adb48c247ccf0a2c521b94aa555f2e943c23e509531801f75aa93b32c9c8670bc554990d31e44fdeb6d6db
SSDEEP 6144:cMs0RnCnAFxhTpF9f+fu5GbLxrgrw2G1GM04TMweAOHmW9R4TOGwUAz:lAAFxh/MfuMLJgrwx1vTM7RGOGwUAz
TLSH
T109841619E6A38035E1FE06331A68FF5E99796C236D30857B7FB673DC59329408934B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2a302d147262a5741c7c0a2faa503406f56cb73c39bfb344cb98fc73014a8c88

.exe 387KB

2a302d147262a5741c7c0a2faa503406f56cb73c39bfb344cb98fc73014a8c88

IMPHASH c0b164460800eb0a717b04942fcd731b
SHA256 2a302d147262a5741c7c0a2faa503406f56cb73c39bfb344cb98fc73014a8c88
MD5 d1fc3745d3bb7286e685aa713f59fda1
SHA1 e149a8ed34c82e7b46e35445c21cdddd5e31a768
SHA512 2b7989e8c1a9b4c885d9981f08e1dd11bc7bfa4808adb48c247ccf0a2c521b94aa555f2e943c23e509531801f75aa93b32c9c8670bc554990d31e44fdeb6d6db
SSDEEP 6144:cMs0RnCnAFxhTpF9f+fu5GbLxrgrw2G1GM04TMweAOHmW9R4TOGwUAz:lAAFxh/MfuMLJgrwx1vTM7RGOGwUAz
TLSH
T109841619E6A38035E1FE06331A68FF5E99796C236D30857B7FB673DC59329408934B22
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

27:4e:30:1d:06:1f:1d:ba:9a:12:bc:24:46:41:d6:d7:2e:d9:c4:d7:de:43:d2:aa:6e:83:76:f1:93:33:87:82

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=C 87749,CN=Iron Gaming Limited,O=Iron Gaming Limited,L=Birkirkara,C=MT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024d54

Chains

Jan 20, 2021

SERIALNUMBER=C 87749,CN=Iron Gaming Limited,O=Iron Gaming Limited,L=Birkirkara,C=MT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024d54

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=C 87749,CN=Iron Gaming Limited,O=Iron Gaming Limited,L=Birkirkara,C=MT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024d54

Serial Number

0c:58:19:65:bf:81:b2:3b:98:ba:5f:a1:ec:43:82:3b

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 18, 2020 - Nov 21, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

140838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\JobRelease\win\Release\custact\x86\aipackagechainer.pdb

kernel32

SizeofResource LockResource LoadResource FindResourceW FindResourceExW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap GetSystemTime GetLastError WideCharToMultiByte MultiByteToWideChar GetShortPathNameW CreateFileW CloseHandle WriteFile DeleteFileW FindFirstFileW SetCurrentDirectoryW GetModuleFileNameW OpenMutexW WaitForSingleObject RaiseException FindClose FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW LeaveCriticalSection EnterCriticalSection LoadLibraryExW InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedDecrement InterlockedIncrement GetCurrentThreadId DecodePointer WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindFirstFileExW GetOEMCP IsValidCodePage GetFileType GetModuleHandleExW ExitProcess GetACP GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetTempPathW GetTempFileNameW FindNextFileW GetFileAttributesW SetFileAttributesW RemoveDirectoryW SetLastError CreateDirectoryW CopyFileW GetLogicalDriveStringsW GetDriveTypeW GetFileSize ReadFile GetDiskFreeSpaceExW GetEnvironmentVariableW SetFilePointer OutputDebugStringW CreateThread InitializeCriticalSection GetCurrentProcessId GetLocalTime FlushFileBuffers FormatMessageW LoadLibraryW GetFileTime GetSystemDefaultLangID GetSystemDirectoryW GetWindowsDirectoryW GetCurrentProcess GetStdHandle CreateProcessW GetExitCodeProcess GetLocaleInfoW SystemTimeToFileTime FileTimeToSystemTime CreateEventW GetExitCodeThread TerminateThread GetVersionExW SetEvent Sleep ResetEvent MoveFileW GlobalFree GetStringTypeW MulDiv LocalFree LocalAlloc CompareFileTime CopyFileExW IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LCMapStringW GetCPInfo WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW QueryPerformanceCounter RtlUnwind

user32

DestroyWindow UnregisterClassW CharNextW DefWindowProcW MsgWaitForMultipleObjectsEx PeekMessageW TranslateMessage DispatchMessageW GetActiveWindow PostMessageW IsWindow GetDlgItem SetWindowTextW SetWindowPos MapWindowPoints GetClientRect GetParent GetWindowRect GetMonitorInfoW MonitorFromWindow SendMessageW GetWindow ShowWindow InvalidateRect EnableWindow CreateDialogParamW SetWindowLongW EndDialog GetForegroundWindow MessageBoxW DialogBoxParamW LoadImageW GetSystemMetrics LoadStringW SetForegroundWindow IsWindowVisible GetWindowTextW GetWindowTextLengthW CreateWindowExW GetSystemMenu ModifyMenuW DestroyMenu CallWindowProcW ExitWindowsEx MessageBeep SetFocus RedrawWindow GetWindowLongW

shell32

ShellExecuteW ShellExecuteExW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFolderPathW

ole32

CoTaskMemRealloc CoTaskMemFree CoUninitialize CoCreateInstance CoTaskMemAlloc CoInitialize

oleaut32

VarUI4FromStr

shlwapi

PathIsDirectoryW PathFileExistsW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

mpr

WNetAddConnection2W

Sharing

General

Malware Config

Signatures

File Explorer

2a302d147262a5741c7c0a2faa503406f56cb73c39bfb344cb98fc73014a8c88

kernel32

user32

shell32

ole32

oleaut32

shlwapi

version

mpr

generic