Aspectexternalcrackeado[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Aspectexternalcrackeado.exe
Size 4.5MB
Sample261011-zzhemaha29
SHA256 66a1f6ccc9f869945bec8149f1af5ce5bb587d3d25c8008cfdc0bf3c0cebf9c2
MD5 42fe4a56c232d4f65bfa7ad9eab99812
SHA1 ff382fff460371f167ae09d2f2cf54d7d6264a0b
SHA512 3694acd3980705493876209de679cd316f596f5255be2a0eb23971dbef18a8c54adb08f7dad42217ca855768910bba8d6f1d9d69f74429f2a64af9f9fc29c1c6
SSDEEP 98304:+bwdaDFrhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1Y:+bUEFHGpELcoR1Y
TLSH
T131269DC6BF88F5E0C4A48834B916D5BDC6737C7A8A11468732D7FB1F2A37180552B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Aspectexternalcrackeado.exe

.exe 4.5MB

Aspectexternalcrackeado.exe

IMPHASH 84da1a1e6e5b4e368d1238a8a636444b
SHA256 66a1f6ccc9f869945bec8149f1af5ce5bb587d3d25c8008cfdc0bf3c0cebf9c2
MD5 42fe4a56c232d4f65bfa7ad9eab99812
SHA1 ff382fff460371f167ae09d2f2cf54d7d6264a0b
SHA512 3694acd3980705493876209de679cd316f596f5255be2a0eb23971dbef18a8c54adb08f7dad42217ca855768910bba8d6f1d9d69f74429f2a64af9f9fc29c1c6
SSDEEP 98304:+bwdaDFrhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1Y:+bUEFHGpELcoR1Y
TLSH
T131269DC6BF88F5E0C4A48834B916D5BDC6737C7A8A11468732D7FB1F2A37180552B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

85:28:2e:f8:01:e3:2e:56:88:71:6e:bd:ec:e0:16:8e:45:e5:12:aa:59:ad:1a:59:65:d5:a0:7b:2f:9e:52:28

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 27, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ba:2b:8e:e1:83:51:fe:29:1a:00:00:00:00:00:ba

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 29, 2025 - May 28, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

507856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\dbs\sh\odct\0126_161408\client\onedrive\Product\UX\Exe\obj\amd64\OneDrive.pdb

kernel32

GetFileType GetFinalPathNameByHandleW GetVolumePathNameW ReadFile RemoveDirectoryW SetFileAttributesW SetFileInformationByHandle SetFilePointer GetCompressedFileSizeW FindFirstFileNameW IsDebuggerPresent SetHandleInformation CreatePipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus DeviceIoControl OpenMutexW IsWow64Process LoadLibraryExW GlobalAlloc GlobalUnlock GlobalLock GlobalFree ReadDirectoryChangesW CreateSymbolicLinkW CompareStringOrdinal CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessIoCounters GetPrivateProfileStringW WritePrivateProfileStringW CopyFileW MoveFileExW ReplaceFileW GetComputerNameW RegisterApplicationRestart GetFileInformationByHandleEx OpenFileById GetModuleHandleW GetDllDirectoryW WriteConsoleW ReadConsoleW SetEndOfFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx SetStdHandle SetEnvironmentVariableW GetFileSizeEx GetEnvironmentStringsW GetCommandLineA FindNextFileW FindFirstFileExW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetTimeFormatW GetFileSize GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindVolumeClose FindNextVolumeW FindFirstVolumeW CreateFileW CreateDirectoryW SetThreadInformation GetSystemTimes SetProcessShutdownParameters GetExitCodeProcess GetProcessTimes WaitForMultipleObjects CreateEventW ReleaseMutex GetLongPathNameW SetLastError VerifyVersionInfoW GetProductInfo VerSetConditionMask ExpandEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW K32GetModuleFileNameExW GetUserDefaultLCID GetUserGeoID LCIDToLocaleName SystemTimeToFileTime MoveFileW LocalAlloc GetModuleFileNameW GetVersionExW GetSystemTimeAsFileTime GetSystemTime OpenProcess TerminateProcess GetCurrentProcess CreateMutexW WaitForSingleObject GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc FindFirstFileW FindClose DeleteFileW LCMapStringW WideCharToMultiByte MultiByteToWideChar CloseHandle CreateProcessW InitializeCriticalSectionEx GetCurrentProcessId FreeLibrary GetProcAddress LoadLibraryW SetDllDirectoryW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc WriteFile GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentThreadId GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext Sleep LocalFree DeleteCriticalSection DecodePointer GetLastError FreeEnvironmentStringsW SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetLocaleInfoEx QueryPerformanceCounter GetStringTypeW LeaveCriticalSection EnterCriticalSection RaiseException OutputDebugStringW

user32

PostMessageW EnumWindows GetClassNameW GetWindowThreadProcessId SystemParametersInfoW SendMessageTimeoutW GetMessageW TranslateMessage DispatchMessageW RegisterPowerSettingNotification UnregisterPowerSettingNotification RegisterSuspendResumeNotification SetClipboardData RegisterClipboardFormatW CloseClipboard OpenClipboard UnregisterSuspendResumeNotification RegisterClassW CreateWindowExW DestroyWindow ShowWindow

advapi32

SetNamedSecurityInfoW AdjustTokenPrivileges CreateProcessWithTokenW GetUserNameW SetFileSecurityW ConvertSidToStringSidW GetNamedSecurityInfoW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegDeleteTreeW RegUnLoadKeyW RegNotifyChangeKeyValue RegLoadKeyW RegEnumKeyW RegDeleteKeyExW RegCreateKeyTransactedW GetAclInformation FreeSid DuplicateTokenEx CreateWellKnownSid AllocateAndInitializeSid CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegGetValueW RegSetKeyValueW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW GetTokenInformation OpenProcessToken

shell32

SHSetKnownFolderPath ord526 SHFileOperationW SHGetSpecialFolderPathW SHGetKnownFolderPath SHChangeNotify SHParseDisplayName ShellExecuteExW SHCreateItemFromParsingName SHGetFolderPathW SHGetPropertyStoreFromParsingName SHAssocEnumHandlers SHCreateDirectoryExW SHGetFolderPathAndSubDirW CommandLineToArgvW

ole32

CoInitialize CoInitializeSecurity CoUninitialize StringFromCLSID CoTaskMemFree CoCreateInstance StringFromGUID2 CreateBindCtx CoCreateGuid CoInitializeEx CoSetProxyBlanket CreateItemMoniker GetRunningObjectTable

oleaut32

LoadTypeLi LoadRegTypeLi GetRecordInfoFromTypeInfo

crypt32

CertFindExtension CryptStringToBinaryW CryptBinaryToStringW

rpcrt4

RpcBindingFree RpcBindingFromStringBindingW RpcBindingVectorFree RpcStringBindingComposeW RpcStringFreeW RpcServerInqBindings RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqW RpcBindingSetAuthInfoExW RpcEpRegisterW RpcEpUnregister RpcServerInqCallAttributesW UuidCreate

secur32

GetUserNameExW

shlwapi

PathIsDirectoryW PathFileExistsW SHRegGetValueW SHRegGetBoolUSValueW PathStripPathW SHRegGetUSValueW PathIsPrefixW SHDeleteKeyW SHDeleteValueW SHGetValueA SHSetValueW SHRegGetPathW PathIsDirectoryEmptyW SHGetValueW PathRemoveFileSpecW StrStrIW SHCreateStreamOnFileW AssocQueryStringW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

InternetCheckConnectionW InternetCanonicalizeUrlW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

userenv

GetDefaultUserProfileDirectoryW CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

Aspectexternalcrackeado.exe

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

secur32

shlwapi

version

wininet

wtsapi32

userenv

generic