14ef360229140adc398e45a28c3ebedafd2e072f872a8206fcf563ac9074a1c1

Sharing

Copy URL Twitter E-mail

General

Target
14ef360229140adc398e45a28c3ebedafd2e072f872a8206fcf563ac9074a1c1
Size 987KB
Sample260916-yywp7adf45
SHA256 14ef360229140adc398e45a28c3ebedafd2e072f872a8206fcf563ac9074a1c1
MD5 868c7fe5163e7fe545114ba2c7e24fac
SHA1 a99c783385d5d0f8c6c1b47e5254b21cc56afd95
SHA512 7c72959b8a8fcdb99d09d43b7e8213c4e75f9614c9e4120414cccedf25b0f08f0375d4387d9ea8c18d4f48e49635848d00415c3d8f95c35a41fe5970f05644ea
SSDEEP 24576:yLeQjpsJSujlG1n92gC5m4xLPRs/p+O97ExIgRsDrEH7KX:ynsJSwgC5mQPRGF97ExIgRsP
TLSH
T140258D317552C133E57201B15A2AAB2BC829EC690F714CEFA3C8577D5A789C21A33F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
14ef360229140adc398e45a28c3ebedafd2e072f872a8206fcf563ac9074a1c1

File Explorer

14ef360229140adc398e45a28c3ebedafd2e072f872a8206fcf563ac9074a1c1

.exe 987KB

14ef360229140adc398e45a28c3ebedafd2e072f872a8206fcf563ac9074a1c1

IMPHASH 9a397249920d48712f17db2c361bc934
SHA256 14ef360229140adc398e45a28c3ebedafd2e072f872a8206fcf563ac9074a1c1
MD5 868c7fe5163e7fe545114ba2c7e24fac
SHA1 a99c783385d5d0f8c6c1b47e5254b21cc56afd95
SHA512 7c72959b8a8fcdb99d09d43b7e8213c4e75f9614c9e4120414cccedf25b0f08f0375d4387d9ea8c18d4f48e49635848d00415c3d8f95c35a41fe5970f05644ea
SSDEEP 24576:yLeQjpsJSujlG1n92gC5m4xLPRs/p+O97ExIgRsDrEH7KX:ynsJSwgC5mQPRGF97ExIgRsP
TLSH
T140258D317552C133E57201B15A2AAB2BC829EC690F714CEFA3C8577D5A789C21A33F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

02:84:8d:b3:21:e4:0d:90:b8:25:b9:7f:d3:1d:58:89:92:9f:01:21:ef:69:fc:89:78:b4:e4:84:20:1d:3e:f5

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=124-81-00998,CN=Samsung Electronics CO.\, LTD.,O=Samsung Electronics CO.\, LTD.,L=Suwon-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Dec 6, 2022

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

48:12:25:db:17:e5:1b:45:4c:eb:c0:a4:40:c9:ad:b9:77:0b:f0:40

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Dec 6, 2022

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

Serial Number

06:68:0c:ee:46:5b:85:6f:61:3a:3b:dd:20:48:2e:71

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 27, 2022 - Apr 23, 2025

Minor OS version

Major OS version

Entry point

495084

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\build\workspace\eline_release_dynamic_open_close\src\platforms\windows\Release\ss_conn_service2.pdb

ws2_32

listen WSAStartup WSACleanup WSASendTo WSARecvFrom WSARecv connect select getsockopt WSASocketW bind getsockname WSAStringToAddressW htonl ntohl htons ntohs WSASend setsockopt ioctlsocket closesocket WSASetLastError WSAGetLastError

mswsock

GetAcceptExSockaddrs AcceptEx

shell32

ShellExecuteExW SHGetFolderPathW

setupapi

CM_Get_Parent SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo CM_Get_Device_Interface_ListW CM_Get_Device_Interface_List_SizeW CM_Get_Device_IDW CM_Get_DevNode_Registry_PropertyW

user32

UnregisterDeviceNotification RegisterDeviceNotificationW

advapi32

DeleteService OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle CryptGenRandom CryptReleaseContext CryptAcquireContextW TraceMessage

kernel32

FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetFileType GetACP GetCommandLineW GetCommandLineA GetStdHandle GetConsoleCP GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary RaiseException InterlockedPushEntrySList RtlUnwind GetStartupInfoW IsDebuggerPresent GetConsoleMode ReadConsoleW HeapReAlloc GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle WriteConsoleW ExitProcess CreateEventW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CloseHandle WaitForSingleObjectEx CreateEventA SetEvent MultiByteToWideChar LeaveCriticalSection EnterCriticalSection InterlockedExchange PostQueuedCompletionStatus InterlockedCompareExchange GetLastError GetModuleHandleA GetProcAddress CreateIoCompletionPort InterlockedIncrement DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsFree TlsAlloc TlsGetValue VerifyVersionInfoW VerSetConditionMask WaitForSingleObject QueueUserAPC TerminateThread InterlockedExchangeAdd WaitForMultipleObjects InterlockedDecrement GetQueuedCompletionStatus SetWaitableTimer ReleaseSemaphore CreateSemaphoreA GetProcessHeap HeapFree GetSystemTimeAsFileTime WaitForMultipleObjectsEx HeapAlloc SetLastError TlsSetValue lstrlenW CreateFileW ReadFile GetCurrentThreadId WriteFile SleepEx HeapSize CreateWaitableTimerW QueryPerformanceCounter GetCurrentProcessId GetComputerNameW DuplicateHandle GetCurrentProcess GetTickCount WideCharToMultiByte GlobalAlloc GlobalFree GetFileSizeEx GetFileTime SetFilePointer GetLocalTime OutputDebugStringW GetModuleFileNameW DeviceIoControl QueryPerformanceFrequency GetStringTypeW SwitchToThread GetModuleHandleW EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent OpenEventA Sleep ResumeThread CreateWaitableTimerA SystemTimeToFileTime LocalFree FormatMessageA CreateDirectoryW FindClose FindNextFileW GetFileAttributesW SetFilePointerEx AreFileApisANSI InitializeSListHead

Sharing

General

Malware Config

Signatures

File Explorer

14ef360229140adc398e45a28c3ebedafd2e072f872a8206fcf563ac9074a1c1

PE Signature issue

PE Signature issue

ws2_32

mswsock

shell32

setupapi

user32

advapi32

kernel32

generic