NotPetya[.]exe | Triage™

Target
NotPetya.exe
Size 353KB
Sample260918-rmhkvsxtes
SHA256 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
MD5 71b6a493388e7d0b40c83ce903bc6b04
SHA1 34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d
SHA512 072205eca5099d9269f358fe534b370ff21a4f12d7938d6d2e2713f69310f0698e53b8aff062849f0b2a521f68bee097c1840993825d2a5a3aa8cf4145911c6f
SSDEEP 6144:y/Bt80VmNTBo/x95ZjAetGDN3VFNq7pC+9OqFoK30b3ni5rdQY/CdUOs2:y/X4NTS/x9jNG+w+9OqFoK323qdQYKUG
TLSH
T1BC74126171C341B2F1F38A3455CAB75B8FFDE06687B065CECA2B1A0A1821746F739297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
NotPetya.exe

File Explorer

NotPetya.exe

.dll 353KB

NotPetya.exe

IMPHASH 52dd60b5f3c9e2f17c2e303e8c8d4eab
SHA256 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
MD5 71b6a493388e7d0b40c83ce903bc6b04
SHA1 34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d
SHA512 072205eca5099d9269f358fe534b370ff21a4f12d7938d6d2e2713f69310f0698e53b8aff062849f0b2a521f68bee097c1840993825d2a5a3aa8cf4145911c6f
SSDEEP 6144:y/Bt80VmNTBo/x95ZjAetGDN3VFNq7pC+9OqFoK30b3ni5rdQY/CdUOs2:y/X4NTS/x9jNG+w+9OqFoK323qdQYKUG
TLSH
T1BC74126171C341B2F1F38A3455CAB75B8FFDE06687B065CECA2B1A0A1821746F739297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3b:65:0e:49:c6:e9:34:29:f5:80:58:4e:cc:af:af:dd:dd:e9:ce:e5

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 27, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:a2:30:00:00:00:00:00:08

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

Major OS version

Entry point

32057

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

ConnectNamedPipe GetModuleHandleW CreateNamedPipeW TerminateThread DisconnectNamedPipe FlushFileBuffers GetTempPathW GetProcAddress DeleteFileW FreeLibrary GlobalAlloc LoadLibraryW GetComputerNameExW GlobalFree ExitProcess GetVersionExW GetModuleFileNameW DisableThreadLibraryCalls ResumeThread GetEnvironmentVariableW GetFileSize SetFilePointer SetLastError LoadResource GetCurrentThread OpenProcess GetSystemDirectoryW SizeofResource GetLocalTime Process32FirstW LockResource Process32NextW GetModuleHandleA lstrcatW CreateToolhelp32Snapshot GetCurrentProcess VirtualFree VirtualAlloc LoadLibraryA VirtualProtect WideCharToMultiByte GetExitCodeProcess WaitForMultipleObjects CreateProcessW PeekNamedPipe GetTempFileNameW InterlockedExchange LeaveCriticalSection MultiByteToWideChar CreateFileA GetTickCount CreateThread LocalFree FindNextFileW CreateFileMappingW LocalAlloc FindClose GetFileSizeEx CreateFileW Sleep FlushViewOfFile GetLogicalDrives WaitForSingleObject GetDriveTypeW UnmapViewOfFile MapViewOfFile FindFirstFileW CloseHandle DeviceIoControl GetLastError GetSystemDirectoryA ReadFile WriteFile GetProcessHeap InitializeCriticalSection HeapReAlloc GetWindowsDirectoryW EnterCriticalSection HeapFree SetFilePointerEx HeapAlloc FindResourceW

user32

ExitWindowsEx wsprintfA wsprintfW

advapi32

CryptGenRandom CryptAcquireContextA CryptExportKey CryptAcquireContextW CreateProcessAsUserW InitiateSystemShutdownExW DuplicateTokenEx SetTokenInformation GetTokenInformation GetSidSubAuthorityCount OpenThreadToken GetSidSubAuthority AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetThreadToken CredEnumerateW CredFree SetSecurityDescriptorDacl InitializeSecurityDescriptor CryptDestroyKey CryptGenKey CryptEncrypt CryptImportKey CryptSetKeyParam CryptReleaseContext

shell32

CommandLineToArgvW SHGetFolderPathW

ole32

CoCreateGuid CoTaskMemFree StringFromCLSID

crypt32

CryptStringToBinaryW CryptBinaryToStringW CryptDecodeObjectEx

shlwapi

PathAppendW StrToIntW PathFindFileNameW PathFileExistsW StrCmpW StrCmpIW StrChrW StrCatW StrStrW PathFindExtensionW PathCombineW StrStrIW

iphlpapi

GetIpNetTable GetAdaptersInfo

ws2_32

inet_ntoa gethostbyname __WSAFDIsSet ntohl ioctlsocket connect inet_addr select recv send htons closesocket socket WSAStartup

mpr

WNetOpenEnumW WNetEnumResourceW WNetCancelConnection2W WNetAddConnection2W WNetCloseEnum

netapi32

NetServerEnum NetApiBufferFree NetServerGetInfo

dhcpsapi

DhcpEnumSubnetClients DhcpRpcFreeMemory DhcpGetSubnetInfo DhcpEnumSubnets

msvcrt

malloc _itoa free memset rand memcpy

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

NotPetya.exe

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

crypt32

shlwapi

iphlpapi

ws2_32

mpr

netapi32

dhcpsapi

msvcrt

generic