23ac2c4ed9592506163afa672282c521551d436b6b3b25b53c21ce619f845500

General

Target
23ac2c4ed9592506163afa672282c521551d436b6b3b25b53c21ce619f845500
Size 127KB
Sample260929-prrm8a1wey
SHA256 23ac2c4ed9592506163afa672282c521551d436b6b3b25b53c21ce619f845500
MD5 08d1868710401c7f0d9fe6de136d4e92
SHA1 dd07971046749a2143f24b0fced4809d35a45508
SHA512 d75fe031f7869270f893a8e751a672ad4608fc7da09b21f4f151773cba80de81ab57d5301949d18b2c6de312d15525ddb7f5b97cb9607510ba31bc078ab62296
SSDEEP 3072:SdZOLQpaGTnQcyL2QltfWLgo/iE+DiV7X5pbwmjNBOfoXcz:SOLQp5TQXLz
TLSH
T12BD3C6C1F6B84CB9F4F3593910298A7295BF793DF53B865E5A94014C0A23D838E25BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
23ac2c4ed9592506163afa672282c521551d436b6b3b25b53c21ce619f845500

File Explorer

23ac2c4ed9592506163afa672282c521551d436b6b3b25b53c21ce619f845500

.exe 127KB

23ac2c4ed9592506163afa672282c521551d436b6b3b25b53c21ce619f845500

IMPHASH 907bd326a444dbc0e31cef85b0646f45
SHA256 23ac2c4ed9592506163afa672282c521551d436b6b3b25b53c21ce619f845500
MD5 08d1868710401c7f0d9fe6de136d4e92
SHA1 dd07971046749a2143f24b0fced4809d35a45508
SHA512 d75fe031f7869270f893a8e751a672ad4608fc7da09b21f4f151773cba80de81ab57d5301949d18b2c6de312d15525ddb7f5b97cb9607510ba31bc078ab62296
SSDEEP 3072:SdZOLQpaGTnQcyL2QltfWLgo/iE+DiV7X5pbwmjNBOfoXcz:SOLQp5TQXLz
TLSH
T12BD3C6C1F6B84CB9F4F3593910298A7295BF793DF53B865E5A94014C0A23D838E25BE3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

5a:da:df:ef:07:14:1f:37:cc:be:78:9e:69:59:b0:4f:5d:f0:20:48:23:81:fd:24:cb:3d:13:c5:6c:d2:db:7f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

Chains

Oct 4, 2021

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Dropbox\, Inc,O=Dropbox\, Inc,L=San Francisco,ST=California,C=US

Serial Number

0f:7a:16:55:50:16:3d:5e:d7:d1:ca:a3:fc:13:da:06

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 16, 2020 - Feb 9, 2024

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

5

Entry point

19974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

DropboxUpdate_unsigned.pdb

advapi32

RegOpenKeyExW

kernel32

GetCommandLineW FindResourceExW FindResourceW FreeLibrary LoadResource LoadLibraryExW VerSetConditionMask GetModuleHandleW SizeofResource GetModuleFileNameW lstrlenW RaiseException VerifyVersionInfoW GetLastError GetProcAddress LockResource GetFileAttributesExW SetLastError LocalAlloc CloseHandle SetStdHandle InterlockedExchange LoadLibraryA EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW WideCharToMultiByte TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW SetFilePointer CreateFileA

ole32

CoCreateGuid

Sharing

General

Malware Config

Signatures

File Explorer

23ac2c4ed9592506163afa672282c521551d436b6b3b25b53c21ce619f845500

PE Signature issue

advapi32

kernel32

ole32

generic