f6c1a032cd23dcbd4b275a2ef4db0dfff705f8f743d7eb4bce911b70e624cfe9

Sharing

Copy URL Twitter E-mail

General

Target
f6c1a032cd23dcbd4b275a2ef4db0dfff705f8f743d7eb4bce911b70e624cfe9
Size 222KB
Sample261003-ls7jaawbmc
SHA256 f6c1a032cd23dcbd4b275a2ef4db0dfff705f8f743d7eb4bce911b70e624cfe9
MD5 748507ecba0dd528f28045201500e9c8
SHA1 dcfc2611da7078d7f9b980eb9eef004c62e179cc
SHA512 bef42fb2134938af65231f8ac03e4b4bcc47b07172306c40618b46a30ff821b56f458a9fea6472fd110078ecafbffef1c7315184172c76f7ad33c6bed1715dc7
SSDEEP 6144:58U+cxf/2az5oFE3KSUlVBV+UdvrEFp7hKt:OU+cxX2a+FsdUlVBjvrEH7W
TLSH
T17824AE4139C1C3F5E4A319303478AB715EFDF93C0F6646DBA384022ADF2C5D26969A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
f6c1a032cd23dcbd4b275a2ef4db0dfff705f8f743d7eb4bce911b70e624cfe9

File Explorer

f6c1a032cd23dcbd4b275a2ef4db0dfff705f8f743d7eb4bce911b70e624cfe9

.exe 222KB

f6c1a032cd23dcbd4b275a2ef4db0dfff705f8f743d7eb4bce911b70e624cfe9

IMPHASH 8a097f85bf71afff8f74990d74c0c639
SHA256 f6c1a032cd23dcbd4b275a2ef4db0dfff705f8f743d7eb4bce911b70e624cfe9
MD5 748507ecba0dd528f28045201500e9c8
SHA1 dcfc2611da7078d7f9b980eb9eef004c62e179cc
SHA512 bef42fb2134938af65231f8ac03e4b4bcc47b07172306c40618b46a30ff821b56f458a9fea6472fd110078ecafbffef1c7315184172c76f7ad33c6bed1715dc7
SSDEEP 6144:58U+cxf/2az5oFE3KSUlVBV+UdvrEFp7hKt:OU+cxX2a+FsdUlVBjvrEH7W
TLSH
T17824AE4139C1C3F5E4A319303478AB715EFDF93C0F6646DBA384022ADF2C5D26969A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

2a:ee:26:79:12:c2:3b:65:03:0d:09:28:68:29:18:27:75:2d:22:c2:dc:c5:75:e3:ac:f8:b5:81:5b:23:cf:0a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,OU=SYS BG-PC BU-SW RD Ctr,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Oct 14, 2021

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

07:20:7b:3a:1a:cb:44:e4:dc:39:eb:d3:89:a9:6d:65

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 4, 2021 - May 8, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

21041

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\H5600QE\Data\Code\Project\LiveUpdateClient\Src\client\Output\Release\UpdateChecker.pdb

kernel32

CreateDirectoryA GetPrivateProfileStringA FreeLibrary GetProcAddress GetLocalTime CreateThread WritePrivateProfileStringA CloseHandle DeleteFileA LoadLibraryA TerminateThread CreateFileA Sleep GetModuleHandleA WaitForSingleObject TerminateProcess IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringA CreateFileW MultiByteToWideChar DeleteFileW FindClose FindFirstFileW FindNextFileW RemoveDirectoryW SetFileAttributesW GetModuleFileNameW RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree HeapAlloc GetFileType HeapSize HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap SetStdHandle GetStringTypeW GetConsoleMode GetConsoleCP SetFilePointerEx FlushFileBuffers WriteConsoleW GetModuleFileNameA DeleteCriticalSection DecodePointer GetUserGeoID RaiseException GetLastError InitializeCriticalSectionEx LocalFree

advapi32

LookupAccountSidW FreeSid AllocateAndInitializeSid OpenProcessToken AddAccessAllowedAce AdjustTokenPrivileges GetLengthSid GetTokenInformation InitializeAcl InitializeSecurityDescriptor SetFileSecurityW SetSecurityDescriptorDacl RegCloseKey RegQueryValueExA RegOpenKeyExA LookupPrivilegeValueW LookupAccountNameW SetSecurityDescriptorOwner RegGetValueW RegDeleteValueA

shell32

ShellExecuteExA

ole32

CoUninitialize CoInitializeEx CoCreateInstance CoInitialize

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

shlwapi

PathFileExistsA

sensapi

IsNetworkAlive

wininet

InternetCheckConnectionA

Name

.text

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ALU_UPDA

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f6c1a032cd23dcbd4b275a2ef4db0dfff705f8f743d7eb4bce911b70e624cfe9

PE Signature issue

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

sensapi

wininet

generic