9624a5c9b3fc17ab0b48544c13ed90b3952285356806e58285f1c31f8b4d260d

Sharing

Copy URL Twitter E-mail

General

Target
9624a5c9b3fc17ab0b48544c13ed90b3952285356806e58285f1c31f8b4d260d
Size 4.2MB
Sample260916-tg4bgssfla
SHA256 9624a5c9b3fc17ab0b48544c13ed90b3952285356806e58285f1c31f8b4d260d
MD5 559cc792a460e8b29b81941de4fbd75f
SHA1 1296438b577dd76d0dbfa0dc466ca45daf54845c
SHA512 005d1cb0131fb9426148e0e48aa1283094d516712c1d506a9d0c40c4d58acdb526b769153122ae78530dfa925e7ab911f92bc46e715243cb196f928ba110e9bd
SSDEEP 49152:HozIEfxzNbqJ7RlFa5Fn0SS5/fgCf2W8uvBGLAhdXJ83ZU9+OY1u6SeIL4O8b8I+:9ExXuLunuvB+2v8PRg
TLSH
T15916A11226D1CFE5D05F61B1EC29B6F8462B9D20DF110FCB6E407F6936B1691A930A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
9624a5c9b3fc17ab0b48544c13ed90b3952285356806e58285f1c31f8b4d260d

File Explorer

9624a5c9b3fc17ab0b48544c13ed90b3952285356806e58285f1c31f8b4d260d

.exe 4.2MB

9624a5c9b3fc17ab0b48544c13ed90b3952285356806e58285f1c31f8b4d260d

IMPHASH b3aee998a3d831af2829b9a1096669e0
SHA256 9624a5c9b3fc17ab0b48544c13ed90b3952285356806e58285f1c31f8b4d260d
MD5 559cc792a460e8b29b81941de4fbd75f
SHA1 1296438b577dd76d0dbfa0dc466ca45daf54845c
SHA512 005d1cb0131fb9426148e0e48aa1283094d516712c1d506a9d0c40c4d58acdb526b769153122ae78530dfa925e7ab911f92bc46e715243cb196f928ba110e9bd
SSDEEP 49152:HozIEfxzNbqJ7RlFa5Fn0SS5/fgCf2W8uvBGLAhdXJ83ZU9+OY1u6SeIL4O8b8I+:9ExXuLunuvB+2v8PRg
TLSH
T15916A11226D1CFE5D05F61B1EC29B6F8462B9D20DF110FCB6E407F6936B1691A930A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

5e:9e:34:5b:7e:a3:21:78:3e:9d:ef:c9:8d:d7:c5:dd:7a:7b:f3:9b:fc:cc:18:68:f1:89:bc:a7:94:9a:f2:ed

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Apr 12, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:84:8e:a3:9b:36:d7:bb:53:3c:f4:3d:96:d6:e1:3e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 6, 2025 - Oct 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2004176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\T\M\BuildResults\bin\Release\AcroRd32Exe.pdb

kernel32

LoadResource SizeofResource FindResourceW LoadLibraryA SetDllDirectoryW FindClose FindFirstFileW FindNextFileW GetFileAttributesW QueryDosDeviceW lstrcmpA lstrcmpW CreateEventA GetCurrentThread SetThreadPriority TerminateThread GetSystemPowerStatus CreateFileA FindFirstFileA FindNextFileA GetFinalPathNameByHandleW SetFilePointer GetSystemInfo VirtualQueryEx CreateFileMappingW LoadLibraryExA GetTempPathA GetSystemDirectoryA GetWindowsDirectoryA FindResourceExW LockResource SetErrorMode QueryPerformanceCounter HeapSetInformation WaitForMultipleObjects CreateSemaphoreW CreateProcessW GetSystemTime GetSystemTimeAsFileTime AddAtomW SystemTimeToFileTime GlobalAlloc GlobalUnlock GlobalLock GlobalFree MulDiv LoadLibraryExW GetVersionExW UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteProcThreadAttributeList GetExitCodeProcess InitializeCriticalSectionEx HeapSize HeapReAlloc HeapDestroy RaiseException DecodePointer GetLongPathNameW GetCurrentDirectoryW SetCurrentDirectoryW GetTickCount OpenMutexW GetVolumeInformationW CreateThread CreateEventW CreateMutexW ResetEvent SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WaitNamedPipeW CreateNamedPipeW TransactNamedPipe SetNamedPipeHandleState DisconnectNamedPipe ConnectNamedPipe ReadFile GetFileType GetStartupInfoW lstrlenW GetCurrentProcess GetTempPathW CreateFileW CreateDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot VerifyVersionInfoW lstrcmpiW LocalFree LocalAlloc VerSetConditionMask MultiByteToWideChar WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW GetTimeZoneInformation EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc ExitProcess SetStdHandle GetConsoleOutputCP FreeLibraryAndExitThread RtlUnwind VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetLocaleInfoEx FormatMessageW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapFree HeapAlloc DebugBreak IsDebuggerPresent GetModuleHandleExW SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA GetConsoleMode WideCharToMultiByte GetDynamicTimeZoneInformation LoadLibraryW GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameW FreeLibrary GetSystemDirectoryW OpenProcess GetCurrentThreadId GetCurrentProcessId Sleep SetLastError GetLastError CloseHandle OutputDebugStringW OutputDebugStringA WriteFile GetFileAttributesA GetCommandLineW IsProcessorFeaturePresent CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable QueryFullProcessImageNameW GlobalHandle GlobalSize GetComputerNameExW OpenEventW CreateDirectoryExW CompareFileTime GetFileTime GetFullPathNameW GetExitCodeThread GetTempFileNameW GetModuleHandleExA InitializeCriticalSectionAndSpinCount GetStdHandle ExitThread SearchPathW VirtualFree CreateJobObjectW CreateRemoteThread VirtualProtect VirtualQuery GetProcessId TerminateProcess DuplicateHandle GetProcessTimes ExpandEnvironmentStringsW ProcessIdToSessionId IsWow64Process GetProductInfo GetNativeSystemInfo DeleteFileW GetFileSizeEx GetLocalTime TryAcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency QueryThreadCycleTime GetThreadPriority UnregisterWaitEx RegisterWaitForSingleObject GetUserDefaultLangID GetThreadId TlsGetValue AcquireSRWLockExclusive MoveFileExW GetFileAttributesExW TlsAlloc TlsFree TlsSetValue SetFilePointerEx SetEndOfFile GetFileInformationByHandle FlushFileBuffers FindFirstFileExW GetWindowsDirectoryW lstrcmpiA SetEnvironmentVariableW GetEnvironmentVariableW GetLocaleInfoW GetDriveTypeW DeviceIoControl GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW GetFileSize VirtualProtectEx WriteProcessMemory VirtualAllocEx VirtualFreeEx GetVolumeInformationByHandleW GetProfileStringW ReadProcessMemory CreateIoCompletionPort TerminateJobObject GetQueuedCompletionStatus UnregisterWait PostQueuedCompletionStatus SetInformationJobObject IsProcessInJob QueryInformationJobObject ResumeThread GetUserDefaultLCID GetUserDefaultLocaleName SetHandleInformation SetProcessDEPPolicy AssignProcessToJobObject SignalObjectAndWait

user32

CreateWindowStationW CreateDesktopW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetClassNameW GetParent MessageBoxW RemovePropW GetPropW SetPropW GetActiveWindow GetDlgItem SendMessageW PostMessageW LoadIconW SetProcessWindowStation ReleaseDC GetDC MsgWaitForMultipleObjects RegisterClipboardFormatW PeekMessageW DispatchMessageW DdeDisconnect DdeConnect DdeAddData DdeCreateDataHandle DdeGetData EnumThreadWindows IsWindowVisible DdeFreeStringHandle DdeCreateStringHandleW DdeNameService DdeUninitialize DdeInitializeW SetWindowLongW ShowWindow SendNotifyMessageW RegisterWindowMessageA CloseDesktop SetThreadDesktop OpenInputDesktop CreateWindowExW RegisterClassExW DefWindowProcW RegisterWindowMessageW LoadIconA LoadCursorA FindWindowA KillTimer SetTimer DestroyWindow CreateWindowExA RegisterClassExA GetThreadDesktop PostThreadMessageW IsWindowEnabled AllowSetForegroundWindow CloseWindowStation GetFocus MonitorFromWindow GetMonitorInfoW GetAsyncKeyState EnumChildWindows EnableWindow GetRawInputDeviceInfoW SetActiveWindow PtInRect SetCursorPos CreateIconFromResourceEx GetWindowTextLengthW RegisterClassW GetWindowInfo SetDlgItemTextW GetRawInputDeviceList DdeClientTransaction GetProcessWindowStation SendDlgItemMessageW CloseWindow LoadCursorW GetClipboardData OpenClipboard CloseClipboard IsClipboardFormatAvailable EnumClipboardFormats CountClipboardFormats EmptyClipboard SetClipboardData GetClipboardFormatNameW GetClipboardFormatNameA GetClipboardSequenceNumber GetClipboardOwner GetPriorityClipboardFormat GetOpenClipboardWindow GetClipboardViewer GetWindowDC GetMessageW SystemParametersInfoW BeginPaint EndPaint ScreenToClient GetClientRect MapWindowPoints SetCursor IsChild IsDialogMessageW FillRect LoadBitmapW MapDialogRect SetWindowContextHelpId GetClassInfoExW GetSysColor CallWindowProcW RedrawWindow CreateAcceleratorTableW ClientToScreen MoveWindow SetCapture ReleaseCapture InvalidateRect InvalidateRgn SetFocus DestroyAcceleratorTable CreateDialogIndirectParamW UpdateWindow SetRect IsRectEmpty UnregisterClassA PostQuitMessage DefWindowProcA DispatchMessageA TranslateMessage GetMessageA UserHandleGrantAccess GetWindow EnumWindows SetParent GetWindowLongW GetWindowTextW GetAncestor FindWindowW GetDesktopWindow GetWindowRect SetForegroundWindow GetSystemMetrics keybd_event BringWindowToTop SetWindowPos WaitForInputIdle EnumDesktopWindows GetGUIThreadInfo SetWindowTextW GetForegroundWindow CharNextW EndDialog DialogBoxParamW UnregisterClassW GetWindowThreadProcessId FindWindowExW IsWindow SendMessageTimeoutW GetUserObjectInformationW GetPropA

advapi32

CryptGenKey RegGetValueW RegOpenKeyExA RegQueryValueA RegOpenKeyA EqualSid AllocateAndInitializeSid RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegCreateKeyW ReportEventW RegisterEventSourceW CloseEventLog ConvertSidToStringSidW LookupPrivilegeValueW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW SetSecurityInfo GetSecurityInfo SetEntriesInAclW SetTokenInformation GetSecurityDescriptorSacl GetLengthSid FreeSid DuplicateTokenEx CreateWellKnownSid CopySid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken CredFree CredReadW RegQueryValueExA RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey RegNotifyChangeKeyValue RegEnumValueW RegDeleteKeyExW SystemFunction036 GetNamedSecurityInfoW MapGenericMask AccessCheck OpenThreadToken InitializeSecurityDescriptor InitializeAcl SetSecurityDescriptorDacl GetAce SetKernelObjectSecurity GetKernelObjectSecurity InitializeSid GetAclInformation AddAce RevertToSelf RegDisablePredefinedCache CreateRestrictedToken DuplicateToken CreateProcessAsUserW SetThreadToken CheckTokenMembership RegDeleteTreeW SaferiIsExecutableFileType CryptAcquireContextA CryptAcquireContextW CryptReleaseContext CryptImportKey CryptDestroyKey CryptGetProvParam CryptSetProvParam CryptGenRandom CryptGetUserKey CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash CryptSignHashA CryptSignHashW CryptGetHashParam CryptSetHashParam CryptSetKeyParam CryptContextAddRef GetUserNameW ImpersonateAnonymousToken

shlwapi

UrlUnescapeW PathFindFileNameW PathRemoveFileSpecW PathIsURLW UrlIsW PathCanonicalizeW PathFileExistsW PathRemoveBackslashW PathAppendW PathFindExtensionA PathCombineW PathIsRelativeW AssocQueryStringW UrlGetPartW PathIsDirectoryW PathIsUNCW PathIsUNCServerShareW ord219 PathFindExtensionW UrlCanonicalizeW PathCreateFromUrlW PathAddBackslashW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winhttp

WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReadData WinHttpWriteData WinHttpQueryHeaders WinHttpSetStatusCallback WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSetTimeouts WinHttpSetCredentials WinHttpCloseHandle

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

618KB

Virtual Size

618KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

726KB

Virtual Size

725KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9624a5c9b3fc17ab0b48544c13ed90b3952285356806e58285f1c31f8b4d260d

PE Signature issue

kernel32

user32

advapi32

shlwapi

version

winhttp

generic