8151ee7e6a45fc672f189b5af0725f1cba21475deff5805909cbe95c392c0f9b

Sharing

Copy URL Twitter E-mail

General

Target
8151ee7e6a45fc672f189b5af0725f1cba21475deff5805909cbe95c392c0f9b
Size 148KB
Sample260916-p5ssfaba59
SHA256 8151ee7e6a45fc672f189b5af0725f1cba21475deff5805909cbe95c392c0f9b
MD5 e9f6d22a289d05fc8dddb77a0d298cd8
SHA1 2526972b6e949f9b39a04a90478cb834187d40f1
SHA512 3fcf8aa6f4e2b5765f73adb92854b8668282792ba31d5456d4b7400de09df6d0de4267915b9bc6feb05de9e8ff2414bbfaebc86b75ad8e17b16ae01bf6d7e042
SSDEEP 3072:r3+XRzZGu9mhYfYHmy9dOW6PeA2Nr2lQBV+UdE+rECWp7hKiAI:SBzZS9dOW6UBV+UdvrEFp7hKpI
TLSH
T1E4E38B423B89C3E9D9500530382AA74A55E3FE3D0F9A52D7B3112B0E5DBC7D25E7922B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
8151ee7e6a45fc672f189b5af0725f1cba21475deff5805909cbe95c392c0f9b

File Explorer

8151ee7e6a45fc672f189b5af0725f1cba21475deff5805909cbe95c392c0f9b

.dll 148KB

8151ee7e6a45fc672f189b5af0725f1cba21475deff5805909cbe95c392c0f9b

IMPHASH d5ccc8897141bac4b0507abaf970d880
SHA256 8151ee7e6a45fc672f189b5af0725f1cba21475deff5805909cbe95c392c0f9b
MD5 e9f6d22a289d05fc8dddb77a0d298cd8
SHA1 2526972b6e949f9b39a04a90478cb834187d40f1
SHA512 3fcf8aa6f4e2b5765f73adb92854b8668282792ba31d5456d4b7400de09df6d0de4267915b9bc6feb05de9e8ff2414bbfaebc86b75ad8e17b16ae01bf6d7e042
SSDEEP 3072:r3+XRzZGu9mhYfYHmy9dOW6PeA2Nr2lQBV+UdE+rECWp7hKiAI:SBzZS9dOW6UBV+UdvrEFp7hKpI
TLSH
T1E4E38B423B89C3E9D9500530382AA74A55E3FE3D0F9A52D7B3112B0E5DBC7D25E7922B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

4b:b0:19:20:43:b5:6d:31:fa:ec:b6:8c:09:b7:62:b4

Digest Algorithm

md5

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Serial Number

73:7e:5b:e4:2a:5d:46:2e:3e:c1:1d:6c:a4:14:4c:42

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 21, 2009

Minor OS version

Major OS version

Entry point

36438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

U:\develop\global\Release\bin\common\WebServices1.pdb

iphlpapi

GetAdaptersInfo GetIpStatistics

wininet

InternetSetOptionW InternetCloseHandle HttpQueryInfoW HttpSendRequestW HttpOpenRequestW InternetConnectW InternetCrackUrlW InternetOpenW

msi

ord215

kernel32

LeaveCriticalSection InterlockedIncrement InterlockedDecrement MultiByteToWideChar lstrlenW GetEnvironmentVariableW GetLastError CreateFileW GetFileSize CloseHandle WriteFile GetModuleFileNameW WideCharToMultiByte GetFileAttributesW InitializeCriticalSection FindFirstFileW FindNextFileW FindClose CompareFileTime DeleteFileW GlobalAlloc lstrlenA LoadLibraryW FreeLibrary GetProcAddress CreateThread CreateProcessW WaitForSingleObject GetSystemTimeAsFileTime EnterCriticalSection RaiseException DeleteCriticalSection GetVersionExA InterlockedExchange Sleep InterlockedCompareExchange TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId SetFilePointer

user32

UnregisterClassA PostMessageW

advapi32

RegQueryValueExW RegOpenKeyExW CryptDestroyHash CryptEncrypt CryptDeriveKey CryptHashData CryptCreateHash CryptReleaseContext CryptGenRandom CryptAcquireContextW RegCloseKey RegSetValueExW

ole32

CoCreateInstance

oleaut32

VarBstrCat SysAllocStringByteLen SysStringByteLen LoadTypeLi LoadRegTypeLi SysAllocStringLen SysStringLen SysAllocString SysFreeString

msvcr80

memset _CxxThrowException __CxxFrameHandler3 __clean_type_info_names_internal ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook _except_handler4_common __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _encoded_null _malloc_crt ??3@YAXPAX@Z ??_V@YAXPAX@Z free ??2@YAPAXI@Z ??_U@YAPAXI@Z _swprintf sprintf _purecall _localtime64_s _time64 memcpy_s wcsncpy _wtol _recalloc calloc wcschr atol wcsncat memcpy ?terminate@@YAXXZ _unlock _encode_pointer __dllonexit _lock _onexit _decode_pointer

Sharing

General

Malware Config

Signatures

File Explorer

8151ee7e6a45fc672f189b5af0725f1cba21475deff5805909cbe95c392c0f9b

PE Signature issue

iphlpapi

wininet

msi

kernel32

user32

advapi32

ole32

oleaut32

msvcr80

generic