nc-c612f22c3036e1d3d47195ab2e68439f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
nc-c612f22c3036e1d3d47195ab2e68439f.exe
Size 37KB
Sample261002-g2819aaf86
SHA256 e8fbec25db4f9d95b5e8f41cca51a4b32be8674a4dea7a45b6f7aeb22dbc38db
MD5 5dcf26e3fbce71902b0cd7c72c60545b
SHA1 970bbe298c8ec673fe2257ad6363d29942171fd1
SHA512 b5b5ebe0e333a7331a08f488a66e9a3ff4ea5f5d2552bbc1477627df32f92fdf2a0c279e929cc93a61e20d90f7797f552f2c3a710903cbccc441d14b018928e1
SSDEEP 768:mucfgSLKkEXRYxLKlVMGmmkn2TocrC+q4rPBn:vcfpKkEqKlGGmjwTrC+q4rPBn
TLSH
T10603170AD10BE1B2DE5248F8C4DDADFF9376E04689201D65EB898834A73AF51677C378
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
nc-c612f22c3036e1d3d47195ab2e68439f.exe

File Explorer

nc-c612f22c3036e1d3d47195ab2e68439f.exe

.exe 37KB

nc-c612f22c3036e1d3d47195ab2e68439f.exe

IMPHASH 98ce7b6533cbd67993e36dafb4e95946
SHA256 e8fbec25db4f9d95b5e8f41cca51a4b32be8674a4dea7a45b6f7aeb22dbc38db
MD5 5dcf26e3fbce71902b0cd7c72c60545b
SHA1 970bbe298c8ec673fe2257ad6363d29942171fd1
SHA512 b5b5ebe0e333a7331a08f488a66e9a3ff4ea5f5d2552bbc1477627df32f92fdf2a0c279e929cc93a61e20d90f7797f552f2c3a710903cbccc441d14b018928e1
SSDEEP 768:mucfgSLKkEXRYxLKlVMGmmkn2TocrC+q4rPBn:vcfpKkEqKlGGmjwTrC+q4rPBn
TLSH
T10603170AD10BE1B2DE5248F8C4DDADFF9376E04689201D65EB898834A73AF51677C378
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

61:2e:98:a6:da:ba:99:9f:46:ee:8c:e8:21:76:e1:0b:77:b6:0c:87

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Jernej Simoncic,C=SI

Chains

Sep 16, 2011

CN=Jernej Simoncic,C=SI

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:23:9e:0f:ac:b3

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 28, 1999 - Jan 27, 2017

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Serial Number

04:00:00:00:00:01:20:19:c1:90:66

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 18, 2009 - Jan 28, 2028

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Serial Number

01:00:00:00:00:01:25:b0:b4:cc:01

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 21, 2009 - Dec 22, 2020

Subject

CN=Jernej Simoncic,C=SI

Serial Number

01:00:00:00:00:01:30:7a:27:87:2d

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 10, 2011 - Jun 10, 2012

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:23:9e:0f:af:24

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Aug 26, 2014

Timespan

Jan 22, 2004 - Jan 27, 2017

Minor OS version

Major OS version

Entry point

4752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CloseHandle CreatePipe CreateProcessA CreateThread DeleteCriticalSection DisconnectNamedPipe DuplicateHandle EnterCriticalSection ExitProcess ExitThread FreeConsole FreeLibrary GetCurrentProcess GetLastError GetModuleHandleA GetProcAddress GetStdHandle InitializeCriticalSection LeaveCriticalSection LoadLibraryA PeekNamedPipe ReadFile SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread TlsGetValue VirtualProtect VirtualQuery WaitForMultipleObjects WriteFile

msvcrt

_close _dup _itoa _kbhit _open _read _strcmpi _strnicmp _write __getmainargs __p__environ __p__fmode __set_app_type _cexit _errno _iob _isatty _onexit _setjmp _setmode _sleep _winmajor abort atexit atoi calloc exit fflush fprintf fputc free fwrite getenv gets longjmp malloc memcmp memcpy memset rand signal sprintf srand strcat strchr strcmp strcpy strlen strncmp strncpy time vfprintf

wsock32

WSACleanup WSAGetLastError WSASetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect gethostbyaddr gethostbyname getservbyname getservbyport getsockname htons inet_addr inet_ntoa listen ntohs recv recvfrom select send setsockopt shutdown socket

Name

.text

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

nc-c612f22c3036e1d3d47195ab2e68439f.exe

PE Signature issue

kernel32

msvcrt

wsock32

generic