nc64-5a1d7f5b96510ec159056e713a4ae48e[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
nc64-5a1d7f5b96510ec159056e713a4ae48e.exe
Size 44KB
Sample261002-g2819aaf85
SHA256 3e59379f585ebf0becb6b4e06d0fbbf806de28a4bb256e837b4555f1b4245571
MD5 523613a7b9dfa398cbd5ebd2dd0f4f38
SHA1 3e92f697d642d68bb766cc93e3130b36b2da2bab
SHA512 2ca42e21ebc26233c3822851d9fc82f950186820e10d3601c92b648415eb720f0e1a3a6d9d296497a3393a939a9424c47b1e5eaedfd864f96e3ab8986f6b35b5
SSDEEP 768:gaGHu/aKUAvRCXA/e6PfVVCJrxg/KKjMozd6jSemG0nf2Fcc5C+qLaVp:CuSzAvRCxmNVCgi+IjNmDO15C+qLaVp
TLSH
T152134B7BF21684FED117C6BCA6D65871A4F4BC500A71606E63E68A373F39EB05BB8101
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
nc64-5a1d7f5b96510ec159056e713a4ae48e.exe

File Explorer

nc64-5a1d7f5b96510ec159056e713a4ae48e.exe

.exe 44KB

nc64-5a1d7f5b96510ec159056e713a4ae48e.exe

IMPHASH 567531f08180ab3963b70889578118a3
SHA256 3e59379f585ebf0becb6b4e06d0fbbf806de28a4bb256e837b4555f1b4245571
MD5 523613a7b9dfa398cbd5ebd2dd0f4f38
SHA1 3e92f697d642d68bb766cc93e3130b36b2da2bab
SHA512 2ca42e21ebc26233c3822851d9fc82f950186820e10d3601c92b648415eb720f0e1a3a6d9d296497a3393a939a9424c47b1e5eaedfd864f96e3ab8986f6b35b5
SSDEEP 768:gaGHu/aKUAvRCXA/e6PfVVCJrxg/KKjMozd6jSemG0nf2Fcc5C+qLaVp:CuSzAvRCxmNVCgi+IjNmDO15C+qLaVp
TLSH
T152134B7BF21684FED117C6BCA6D65871A4F4BC500A71606E63E68A373F39EB05BB8101
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

37:ea:ae:1a:3b:e8:aa:d0:ff:79:2c:1c:e8:07:d2:0f:92:26:a4:e2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Jernej Simoncic,C=SI

Chains

Sep 16, 2011

CN=Jernej Simoncic,C=SI

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:23:9e:0f:ac:b3

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 28, 1999 - Jan 27, 2017

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Serial Number

04:00:00:00:00:01:20:19:c1:90:66

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 18, 2009 - Jan 28, 2028

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Serial Number

01:00:00:00:00:01:25:b0:b4:cc:01

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 21, 2009 - Dec 22, 2020

Subject

CN=Jernej Simoncic,C=SI

Serial Number

01:00:00:00:00:01:30:7a:27:87:2d

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 10, 2011 - Jun 10, 2012

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:23:9e:0f:af:24

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Aug 26, 2014

Timespan

Jan 22, 2004 - Jan 27, 2017

Minor OS version

Major OS version

Entry point

5904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CloseHandle CreatePipe CreateProcessA CreateThread DeleteCriticalSection DisconnectNamedPipe DuplicateHandle EnterCriticalSection ExitThread FreeConsole GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetStartupInfoA GetStdHandle GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryA PeekNamedPipe QueryPerformanceCounter ReadFile RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WriteFile

msvcrt

_close _dup _itoa _kbhit _open _read _strcmpi _strnicmp _write __dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _fmode _initterm _isatty _lock _onexit _setjmp _setmode _sleep _time64 _unlock abort atoi calloc exit fflush fprintf fputc free fwrite getenv gets longjmp malloc memcmp memcpy memset rand signal sprintf srand strcat strchr strcmp strcpy strlen strncmp strncpy vfprintf

wsock32

WSACleanup WSAGetLastError WSASetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect gethostbyaddr gethostbyname getservbyname getservbyport getsockname htons inet_addr inet_ntoa listen ntohs recv recvfrom select send setsockopt shutdown socket

Name

.text

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

nc64-5a1d7f5b96510ec159056e713a4ae48e.exe

PE Signature issue

kernel32

msvcrt

wsock32

generic