Счет на оплату №1937[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Счет на оплату №1937.exe
Size 733KB
Sample261001-wpthcstx3r
SHA256 b25c9e7e793a86965779a71a8e8f81a2d43f40db54b7c252768faff306071fd6
MD5 a2cda3a5d03e5d1fdbb3ccd2f73b831d
SHA1 af873a0d74ce97e98c895a919c53ab8e3e3c3b98
SHA512 6d763794b8b5a7465944ecb030d57a1c2f214eb39dddd5729973e7881697ce4ed194f54e2b5a5fb9d1cea339aa99cc8fbd5706b28ff02aed221de91dd554f566
SSDEEP 12288:j9xz+NVpWT8kXURyIpsfgA7fkHT2X/6uUbBNX5qXI7r5VPL6Oufd4jXy:rk/WT9XURegAgz2kVq4v6OYQXy
TLSH
T15DF4BFBC76087CD6E66F177BDA96ADD903B527639ACBA8CC4064B7C30563361FE02805
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
Счет на оплату №1937.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Счет на оплату №1937.exe

File Explorer

Счет на оплату №1937.exe

.exe 733KB

Счет на оплату №1937.exe

IMPHASH c55f3881c0f7f32826397db8f177cf6c
SHA256 b25c9e7e793a86965779a71a8e8f81a2d43f40db54b7c252768faff306071fd6
MD5 a2cda3a5d03e5d1fdbb3ccd2f73b831d
SHA1 af873a0d74ce97e98c895a919c53ab8e3e3c3b98
SHA512 6d763794b8b5a7465944ecb030d57a1c2f214eb39dddd5729973e7881697ce4ed194f54e2b5a5fb9d1cea339aa99cc8fbd5706b28ff02aed221de91dd554f566
SSDEEP 12288:j9xz+NVpWT8kXURyIpsfgA7fkHT2X/6uUbBNX5qXI7r5VPL6Oufd4jXy:rk/WT9XURegAgz2kVq4v6OYQXy
TLSH
T15DF4BFBC76087CD6E66F177BDA96ADD903B527639ACBA8CC4064B7C30563361FE02805
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

85:8c:e9:8a:6c:84:ad:86:ee:09:1f:d2:e4:4b:ef:55:c5:88:81:cd:4d:76:63:b5:fd:90:b3:e0:0d:8b:8d:fa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Essie Sound,O=Essie Sound,POSTALCODE=8447DA,STREET=Turfsteker 45,L=Heerenveen,ST=Friesland,C=NL

Chains

Sep 30, 2026

CN=Essie Sound,O=Essie Sound,POSTALCODE=8447DA,STREET=Turfsteker 45,L=Heerenveen,ST=Friesland,C=NL

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Essie Sound,O=Essie Sound,POSTALCODE=8447DA,STREET=Turfsteker 45,L=Heerenveen,ST=Friesland,C=NL

Serial Number

33:00:07:5f:b8:51:69:1f:e5:36:5b:ad:b3:00:00:00:07:5f:b8

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Sep 29, 2026

Timespan

Sep 29, 2026 - Oct 2, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5b:4a:b5:8d:41:32:6d:dc:74:00:00:00:00:00:5b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

8000

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryW ResetEvent GetLocalTime HeapDestroy GlobalLock CreateFileMappingA LocalFree GetFileSize DeleteCriticalSection ExitProcess SetEnvironmentVariableA GetCurrentProcessId GetProcessHeap CreateProcessW GetModuleHandleW CopyFileW lstrcpyW SetCurrentDirectoryA GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateSemaphoreA QueryPerformanceCounter GetTickCount GlobalUnlock FlushFileBuffers CloseHandle GetVersion ExitThread DuplicateHandle UnmapViewOfFile ResumeThread lstrcmpA GetCurrentThreadId GetFileAttributesW FindClose lstrlenA GetTempPathW GetFullPathNameA SetFilePointer ExpandEnvironmentStringsA CreatePipe GetModuleFileNameW GetDriveTypeA RemoveDirectoryW GetSystemInfo lstrcpyA DeleteFileW GlobalAlloc QueryPerformanceFrequency GetVersionExA WriteFile lstrcatW TerminateThread GetSystemDirectoryA SetEvent GetLastError GetTempPathA Sleep GetStdHandle GetCurrentProcess GetCommandLineW SetConsoleTextAttribute MultiByteToWideChar HeapFree VirtualProtect MoveFileA FindFirstFileW GetLogicalDrives lstrcmpiA GetModuleFileNameA

user32

OpenClipboard wvsprintfW GetWindowThreadProcessId GetKeyState GetMessageA GetWindow DispatchMessageA GetWindowRect GetFocus LoadCursorA DestroyWindow IsWindowVisible SetWindowPos MessageBoxW GetSystemMetrics MessageBeep GetAsyncKeyState ClientToScreen SetWindowsHookExA SetWindowTextA GetForegroundWindow RegisterClassA EnumWindows BeginPaint GetCursorPos GetClientRect SetCursorPos InvalidateRect SetForegroundWindow FindWindowA GetWindowTextLengthA GetDesktopWindow KillTimer SetFocus TranslateMessage GetClipboardData FindWindowW LoadIconA CharUpperA PeekMessageA

advapi32

CryptReleaseContext SetSecurityDescriptorDacl RegCloseKey RegQueryValueExA CryptGenRandom OpenSCManagerA RegCreateKeyExA GetUserNameA CryptCreateHash CryptDeriveKey OpenServiceA RegEnumKeyExA CryptGetHashParam RegEnumValueA FreeSid OpenProcessToken IsValidSecurityDescriptor

shell32

ExtractIconA SHGetSpecialFolderLocation SHFileOperationA DragQueryFileA SHGetFolderPathA ExtractIconExA ShellExecuteA FindExecutableA DragAcceptFiles SHGetSpecialFolderPathA SHChangeNotify

crypt32

CertDuplicateCertificateContext CertEnumCertificatesInStore CryptMsgOpenToDecode CertCloseStore CertFindCertificateInStore CryptDecodeObject CertOpenSystemStoreA CryptMsgClose

comctl32

ord17 ImageList_ReplaceIcon _TrackMouseEvent

gdi32

SetBkColor MoveToEx SetBkMode TextOutA SetTextColor DeleteDC GetPixel GetStockObject CreateCompatibleDC SaveDC CreateCompatibleBitmap BitBlt DeleteObject

ole32

CLSIDFromProgID CoTaskMemRealloc CoLockObjectExternal CoUnmarshalInterface CoGetMalloc CoUninitialize CoCreateInstance CoCreateGuid CoTaskMemAlloc

shlwapi

StrToIntA PathStripPathA PathIsDirectoryA PathMatchSpecA PathRemoveBackslashA PathFileExistsA PathUnquoteSpacesA StrChrA PathFindFileNameA PathIsRelativeA StrRChrA wnsprintfA SHGetValueA PathCombineA PathCanonicalizeA PathRemoveFileSpecA PathFindExtensionA

Sharing

General

Malware Config

Signatures

File Explorer

Счет на оплату №1937.exe

PE Signature issue

kernel32

user32

advapi32

shell32

crypt32

comctl32

gdi32

ole32

shlwapi

generic