Xillys_Program_6[.]0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Xillys_Program_6.0.exe
Size 1.7MB
Sample261012-vl7edacy81
SHA256 7fe4a5241395933b2cbe5e775ce04d5da5f951b0267a415dc095ebe330d219ad
MD5 70d9a5a84b0a8c6afc8cbe2cd3f084db
SHA1 0850873394f2bddf8a28bdd0ea33039c2401ee3a
SHA512 1ca46de83c96c4d64e0e0e9d9372e89120b37d345a0a44b0e023d9983e20331cc8e7f246673e6e6f790682ac3eb206839741e902ed8c4438d8e00fce341d8c74
SSDEEP 49152:XYXwh9my4q9my42dI1cn5+whEsYuZGNG2:XqwJScnFhOuZGNG2
TLSH
T1B9850163734A0B89E53957309533EF7563BEBC684B2AD219B88E67B384B339C4C41167
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
Xillys_Program_6.0.exe
unpack001/costura.dll

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/siticone.desktop.ui.dll

File Explorer

Xillys_Program_6.0.exe

.exe 1.7MB
costura.dll

.dll 4KB
costura.pdb

2KB
siticone.desktop.ui.dll

.dll 1.8MB
system.diagnostics.diagnosticsource.dll

.dll 34KB

Xillys_Program_6.0.exe

SHA256 7fe4a5241395933b2cbe5e775ce04d5da5f951b0267a415dc095ebe330d219ad
MD5 70d9a5a84b0a8c6afc8cbe2cd3f084db
SHA1 0850873394f2bddf8a28bdd0ea33039c2401ee3a
SHA512 1ca46de83c96c4d64e0e0e9d9372e89120b37d345a0a44b0e023d9983e20331cc8e7f246673e6e6f790682ac3eb206839741e902ed8c4438d8e00fce341d8c74
SSDEEP 49152:XYXwh9my4q9my42dI1cn5+whEsYuZGNG2:XqwJScnFhOuZGNG2
TLSH
T1B9850163734A0B89E53957309533EF7563BEBC684B2AD219B88E67B384B339C4C41167
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Downloads\MouseManager\MouseManager\obj\Debug\Xilly's Program 6.0.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ad9a110c8dad457c6f8fca566e88bc12b5eec24debee15d856920b569cf61700
MD5 65700ff9c600ce4d2e89b8638513f725
SHA1 790691b8e17be618abe2c596b93eb925fc4c1142
SHA512 02ae13437374b91b1423c6375a8efcb2af2c330d8bb632bfc2f8a03c59c56e222ede20b7b2009d2ec7669efd470233511c63b68392fd7d1ae9c3bb3f7cb6c1a0
SSDEEP 48:6R+lni2qJfjVRPGwzCU4MhTN0+19sETrpJyH4A9ZQWk1qyFV/2Iby:Dg7KSyE/yYjWg2
TLSH
T17B91721087A8473BEABB4BB6ACB313495375BA519D27CB2E1D8562166C123180A32B72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\184432\Source\Costura_Fody\src\Costura\obj\Release\netstandard1.0\Costura.pdb

siticone.desktop.ui.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 902a9a38af0a9a5b08b4ba86d9733259c57601f8e049cefe9dfc4e204dd36c8b
MD5 64a4259f340e7e83dd03c7675df376b0
SHA1 ce9ab17ea61b15f25d954a5c92d0942d1273849c
SHA512 9df881f1c4c36d9767681cc3bef6c66b64fe1cebc60fcad7aa5405fd2712dbc0931fd2de6f876ee0c82084d7cc4e58fd7d1335ba750413a7640c285357ce15bd
SSDEEP 49152:/Xo2duEPi3XGx6LB6Uhp08hhprZW9P9Siibn1udXVVNtFd1N3GIeFZ7q5+52FjFU:gEPi3XGx6LB6Uhp08hhprZW9P9Hibn1D
TLSH
T1A7855C9EAFC2494EFF1914B17C9B823213F6E02836A7BB85435413389C4EA761F61B5D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

7a:0d:35:dc:1c:b2:3f:88:72:cd:53:d9:96:5c:86:6f:e0:e3:0b:66

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Siticone Technology

Chains

Apr 28, 2021

CN=Siticone Technology

Minor OS version

Major OS version

Entry point

1864498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Projects\Siticone.Desktop.UI\Siticone.Desktop.UI\bin\Release\Publish\Siticone.Desktop.UI.pdb

system.diagnostics.diagnosticsource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
MD5 8d9df432109f1cfdd86723b5f171e3d7
SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
TLSH
T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

d6:fb:4d:67:72:14:08:d2:75:46:a0:06:cb:be:f9:d3:5f:db:20:bd:97:db:cd:de:3c:cd:a0:78:2f:b1:93:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

bc:c6:7a:ba:4c:c6:19:72:95:75:c0:52:c5:b2:9c:4b:5f:0f:69:2e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:a1:a5:fd:b9:ee:a7:fc:9e:9d:00:00:00:00:00:a1

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

Major OS version

Entry point

24690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\System.Diagnostics.DiagnosticSource.pdb

Xillys_Program_6.0.exe

generic

costura.dll

mscoree

dotnet

costura.pdb

siticone.desktop.ui.dll

PE Signature issue

mscoree

dotnet

system.diagnostics.diagnosticsource.dll

PE Signature issue

mscoree

dotnet