c46ee22f3e440fe59590c4c8aef302fe34c8d725b075759cfb5c3ea321cb52e6

Sharing

Copy URL Twitter E-mail

General

Target
c46ee22f3e440fe59590c4c8aef302fe34c8d725b075759cfb5c3ea321cb52e6
Size 182KB
Sample261011-nsrh6sha49
SHA256 c46ee22f3e440fe59590c4c8aef302fe34c8d725b075759cfb5c3ea321cb52e6
MD5 21a0719aa66fb006c4becea80116d100
SHA1 c8f551bc135ea86aa907ed54cd08e59f240cad30
SHA512 6fe7fbb35866abc7b7d9bfea2d66bfbcb12b551288075499d4572c3cefbb30dcc4ca501c2648702eec80d1255e54b6a5dce5bbd5fb1a0cec0be677a6ad40d2f6
SSDEEP 3072:DEe8906kLNmf5b7RnfRXb0IVggDSLbK9+Yd3q3jTic86j4xXQ8c:wB9/57RJoPLg9xMvic86El
TLSH
T16D04D00ADFDB09C5E0BE84BDE8B6607BE2F0750E17E4C9CF255482170F72AD16A78991
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
c46ee22f3e440fe59590c4c8aef302fe34c8d725b075759cfb5c3ea321cb52e6

File Explorer

c46ee22f3e440fe59590c4c8aef302fe34c8d725b075759cfb5c3ea321cb52e6

.exe 182KB

c46ee22f3e440fe59590c4c8aef302fe34c8d725b075759cfb5c3ea321cb52e6

IMPHASH 0d5eb99004525e9e1f94c0940472bb9f
SHA256 c46ee22f3e440fe59590c4c8aef302fe34c8d725b075759cfb5c3ea321cb52e6
MD5 21a0719aa66fb006c4becea80116d100
SHA1 c8f551bc135ea86aa907ed54cd08e59f240cad30
SHA512 6fe7fbb35866abc7b7d9bfea2d66bfbcb12b551288075499d4572c3cefbb30dcc4ca501c2648702eec80d1255e54b6a5dce5bbd5fb1a0cec0be677a6ad40d2f6
SSDEEP 3072:DEe8906kLNmf5b7RnfRXb0IVggDSLbK9+Yd3q3jTic86j4xXQ8c:wB9/57RJoPLg9xMvic86El
TLSH
T16D04D00ADFDB09C5E0BE84BDE8B6607BE2F0750E17E4C9CF255482170F72AD16A78991
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

5c:ac:45:89:9b:d9:3a:82:7a:59:b8:c7:75:eb:4e:f0:03:df:7a:98:d1:76:5e:68:0c:d7:ee:bd:83:69:74:1c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=22178368,CN=MICRO-STAR INTERNATIONAL CO.\, LTD.,O=MICRO-STAR INTERNATIONAL CO.\, LTD.,STREET=No. 69\, Lide St.\, Zhonghe Dist.,L=New Taipei,ST=New Taipei,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 15, 2023

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

0d:d7:1f:dd:49:a3:e4:3d:fc:5d:e6:f5

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 16, 2023 - Apr 11, 2026

Minor OS version

Major OS version

Entry point

69648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileW GetFileAttributesW HeapSize CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetLastError Process32NextW LockResource DeleteFileW Process32FirstW HeapReAlloc CloseHandle LoadLibraryW FindResourceExW WaitForSingleObject FindResourceW HeapAlloc GetLocalTime HeapDestroy GetWindowsDirectoryW GetProcAddress GetFileSize DeleteCriticalSection GetProcessHeap WideCharToMultiByte OutputDebugStringW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx GetProcessId GetModuleFileNameW WriteFile HeapFree SizeofResource LoadResource CreateDirectoryW SetEvent ResetEvent IsDebuggerPresent WaitForSingleObjectEx CreateEventW GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter

user32

PeekMessageW DispatchMessageW

advapi32

RegDeleteKeyW RegOpenKeyExW RegDeleteValueW RegCloseKey

shell32

ShellExecuteExW

oleaut32

SysAllocStringLen

msvcp140

?_Throw_C_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_destroy_in_situ _Mtx_lock _Mtx_init_in_situ _Mtx_unlock

shlwapi

PathStripToRootW StrCmpIW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception memmove wcsrchr __std_terminate __current_exception_context memcpy __std_exception_destroy __C_specific_handler memset _CxxThrowException wcsstr __std_exception_copy

api-ms-win-crt-string-l1-1-0

wcsnlen wmemcpy_s

api-ms-win-crt-time-l1-1-0

_difftime64 _localtime64_s _mktime64 _time64

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vfwprintf __p__commode __acrt_iob_func __stdio_common_vswprintf_s __stdio_common_vswprintf

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback __p___argc _initterm_e terminate _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _initterm _get_initial_narrow_environment _exit __p___argv _configure_narrow_argv exit _set_app_type _invalid_parameter_noinfo_noreturn _seh_filter_exe _cexit _errno _invalid_parameter_noinfo _crt_atexit

api-ms-win-crt-filesystem-l1-1-0

_chdir _findnext64i32 _findfirst64i32

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

144KB

Virtual Size

336KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

c46ee22f3e440fe59590c4c8aef302fe34c8d725b075759cfb5c3ea321cb52e6

PE Signature issue

kernel32

user32

advapi32

shell32

oleaut32

msvcp140

shlwapi

version

vcruntime140_1

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic