978e857a662edafcae978e21297b920a30a78b5ad3ed96b385f6bad84e639362

Sharing

Copy URL Twitter E-mail

General

Target
978e857a662edafcae978e21297b920a30a78b5ad3ed96b385f6bad84e639362
Size 631KB
Sample260916-tzlt6axt7n
SHA256 978e857a662edafcae978e21297b920a30a78b5ad3ed96b385f6bad84e639362
MD5 7ac40acb55bd379ecf3b72c1a7b00924
SHA1 726aaa1d8c4b0038ee6a057e2e9f7e97bd7a766f
SHA512 0da1c21cbe3a9d4047f303c71240df27ec204ebef88700a136501925300fcf6fe1ee99161700796924704c7708251ae6bcc78d87c40ae34d9b5d931d0b7133a0
SSDEEP 6144:phDRX+Rsd+TevUB0f/ZOYYHR3YOOasT1NDyaaSqYEwHejSmK:phD8RE7QU/pYHptwNuSjViSmK
TLSH
T1C3D41B34E2A15DBDDF37A9FCD08E44DBA75BB9A203C4012717F086E28B613D4542EE69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

978e857a662edafcae978e21297b920a30a78b5ad3ed96b385f6bad84e639362

.exe 631KB

978e857a662edafcae978e21297b920a30a78b5ad3ed96b385f6bad84e639362

IMPHASH 2bf1fc659e1e270e26d98d8a21b8f037
SHA256 978e857a662edafcae978e21297b920a30a78b5ad3ed96b385f6bad84e639362
MD5 7ac40acb55bd379ecf3b72c1a7b00924
SHA1 726aaa1d8c4b0038ee6a057e2e9f7e97bd7a766f
SHA512 0da1c21cbe3a9d4047f303c71240df27ec204ebef88700a136501925300fcf6fe1ee99161700796924704c7708251ae6bcc78d87c40ae34d9b5d931d0b7133a0
SSDEEP 6144:phDRX+Rsd+TevUB0f/ZOYYHR3YOOasT1NDyaaSqYEwHejSmK:phD8RE7QU/pYHptwNuSjViSmK
TLSH
T1C3D41B34E2A15DBDDF37A9FCD08E44DBA75BB9A203C4012717F086E28B613D4542EE69
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

b7:01:91:a5:30:16:cd:a1:9d:10:f7:3f:ef:5e:e2:8b:b1:cc:31:30:d8:ec:01:6c:d3:20:98:d3:d1:74:7f:6c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=SC331902,CN=SimpleHelp Ltd,O=SimpleHelp Ltd,POSTALCODE=ML12 6HQ,STREET=Galavale,L=Broughton,ST=Scottish Borders,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Jul 11, 2023

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

d5:e4:2e:f3:6d:05:86:73:7d:f3:36:a7:bf:5d:1b:41:a4:2b:43:27

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 11, 2023

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

67:de:f4:3e:f1:7b:da:e2:4f:f5:94:06:06:d2:c0:84

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Subject

Serial Number

c7:4f:79:c7:83:93:eb:f2:28:58:e9:ad:39:14:56:7f

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 25, 2021 - Feb 25, 2024

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:48:90:3d:c2:8a:bc:a7:a1:19:4d:0c:1c:57:b8:29

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Minor OS version

Major OS version

Entry point

122720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winmm

timeGetTime

wininet

InternetQueryOptionA InternetCloseHandle InternetOpenA HttpSendRequestA InternetErrorDlg HttpOpenRequestA InternetSetOptionA InternetReadFile InternetCrackUrlA InternetConnectA InternetOpenUrlA HttpQueryInfoA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpOpen WinHttpGetProxyForUrl

comctl32

InitCommonControlsEx

kernel32

GetLocaleInfoA GetStringTypeW LCMapStringW LCMapStringA RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentProcessId GetTickCount QueryPerformanceCounter GetStringTypeA HeapReAlloc MoveFileExA FreeLibrary Sleep GetProcAddress LoadLibraryA GetVersion GetTempPathA WaitForSingleObject SetEvent TerminateThread CreateEventA GetLastError GetModuleHandleA CloseHandle CreateMutexA ReleaseMutex CreateThread SetEnvironmentVariableA GlobalFree DeleteFileA InitializeCriticalSection SetStdHandle EnterCriticalSection DeleteCriticalSection GetExitCodeProcess CreateProcessA GetCurrentDirectoryA lstrlenA FormatMessageA GetShortPathNameA SetCurrentDirectoryA LocalAlloc GetVersionExA LocalFree GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer HeapSize ReadFile FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount GetOEMCP GetACP GetCPInfo FlsAlloc TlsSetValue SetLastError FlsFree TlsFree FlsSetValue WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA CompareStringA CompareStringW SetEndOfFile LeaveCriticalSection RaiseException HeapFree HeapAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA FindNextFileA FindClose MoveFileA ExitProcess GetCurrentProcess GetDateFormatA GetTimeFormatA GetDriveTypeA GetFullPathNameA GetTimeZoneInformation GetSystemTimeAsFileTime ExitThread GetCurrentThreadId MultiByteToWideChar WideCharToMultiByte GetFileAttributesA CreateDirectoryA RemoveDirectoryA GetCommandLineA GetProcessHeap HeapSetInformation HeapCreate WriteFile GetStdHandle GetModuleFileNameA RtlUnwindEx TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlCaptureContext FlsGetValue

user32

SetTimer GetWindowRect KillTimer SetWindowPos GetDesktopWindow DestroyWindow GetMessageA GetWindowLongPtrA PostThreadMessageA MonitorFromPoint LoadIconA SendMessageA GetMonitorInfoA TranslateMessage CreateWindowExA PeekMessageA DefWindowProcA GetCursorPos ShowWindow SetWindowLongPtrA DispatchMessageA SystemParametersInfoA LoadCursorA ValidateRect RegisterClassA

advapi32

GetExplicitEntriesFromAclA GetNamedSecurityInfoA GetUserNameA EqualSid ConvertStringSidToSidA SetNamedSecurityInfoA SetEntriesInAclA

Sharing

General

Malware Config

Signatures

File Explorer

978e857a662edafcae978e21297b920a30a78b5ad3ed96b385f6bad84e639362

winmm

wininet

version

winhttp

comctl32

kernel32

user32

advapi32

generic