343c1dd90b72d40e34e3c9c68e86aaeb82ec70068aa7fec80d77c4bd8cd6a282

General

Target
343c1dd90b72d40e34e3c9c68e86aaeb82ec70068aa7fec80d77c4bd8cd6a282
Size 286KB
Sample260922-knnd6sscrd
SHA256 343c1dd90b72d40e34e3c9c68e86aaeb82ec70068aa7fec80d77c4bd8cd6a282
MD5 e4f79b637744bd97551359412408b776
SHA1 0bef35293c3e1c80b37be4950f270e3a4cb75be3
SHA512 3e03c10e7521bc5f7eba22e87170c5c12bd0b84747bb0fd9006972a22a2e844fb4d9957ecf780ccc0a74ff67963bd6d22d55dc217a191c6ca9942d185042ef7b
SSDEEP 6144:u7gKNkhSR/5kHQq0R1uyXnZhB+h8WHlBV+UdvrEFp7hKI7:u7gKNkhm/Nq0R1uyXnPB+h8WHlBjvrEL
TLSH
T13F54D51233F84BADF4F35E3068349F2599BABC399D39E76E1650118D2D39A02D961B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
343c1dd90b72d40e34e3c9c68e86aaeb82ec70068aa7fec80d77c4bd8cd6a282

File Explorer

343c1dd90b72d40e34e3c9c68e86aaeb82ec70068aa7fec80d77c4bd8cd6a282

.exe 286KB

343c1dd90b72d40e34e3c9c68e86aaeb82ec70068aa7fec80d77c4bd8cd6a282

IMPHASH e00d60405a249a05d3b09aa7fe924b17
SHA256 343c1dd90b72d40e34e3c9c68e86aaeb82ec70068aa7fec80d77c4bd8cd6a282
MD5 e4f79b637744bd97551359412408b776
SHA1 0bef35293c3e1c80b37be4950f270e3a4cb75be3
SHA512 3e03c10e7521bc5f7eba22e87170c5c12bd0b84747bb0fd9006972a22a2e844fb4d9957ecf780ccc0a74ff67963bd6d22d55dc217a191c6ca9942d185042ef7b
SSDEEP 6144:u7gKNkhSR/5kHQq0R1uyXnZhB+h8WHlBV+UdvrEFp7hKI7:u7gKNkhm/Nq0R1uyXnPB+h8WHlBjvrEL
TLSH
T13F54D51233F84BADF4F35E3068349F2599BABC399D39E76E1650118D2D39A02D961B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

0c:c3:b2:fb:71:b4:a9:f3:a9:4e:a2:ec:a5:d0:41:7c:31:4e:60:56:dd:b7:53:62:f0:03:5e:bd:74:40:9c:8b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 22, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

1

Major OS version

5

Entry point

46610

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

MicrosoftEdgeUpdate_unsigned.pdb

kernel32

GetModuleFileNameW GetLastError CloseHandle GetProcAddress CreateProcessW FreeLibrary GetTempFileNameW LoadLibraryExW GetCommandLineW GetModuleHandleW WriteConsoleW RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW LocalFree FormatMessageA CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle RemoveDirectoryW SetFilePointerEx AreFileApisANSI SetLastError CopyFileW MultiByteToWideChar WideCharToMultiByte InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCPInfo HeapAlloc HeapFree IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode DecodePointer

ole32

CoTaskMemFree

Sharing

General

Malware Config

Signatures

File Explorer

343c1dd90b72d40e34e3c9c68e86aaeb82ec70068aa7fec80d77c4bd8cd6a282

PE Signature issue

kernel32

ole32

generic