PI-windows-x64-01[.]08[.]05[.]1353-20170809-t[.]exe

General

Target
PI-windows-x64-01.08.05.1353-20170809-t.exe
Size 233.6MB
Sample261013-133qeade38
SHA256 f02cafb2bd8c744573f5c3d0b870bef6c3b633132c72809f8ca89fc7e205d0dc
MD5 5de647abf6535d1fafd642e1b5ecbc16
SHA1 e6445186e23577797feaf5cec7ce289e82af74a9
SHA512 cad798b3cfe14784c5e5d99b03fec4bddd3b27664d8a0b10c706c5e2608062e4ace960b4a8b6dc69df307f3b6e8595f6d5bd13525d13e064377eeb60a2c12713
SSDEEP 6291456:b7V7Ynk1babD8+AJbWhmdesQlCDLd+jcKm0Ab5f2f:b7VMisD8TJbwu+jcKhp
TLSH
T1E0C833A17ADAC43BE13B08319939D75A40B5BD704F72848B63E43B2E5FB29C25231E57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
PI-windows-x64-01.08.05.1353-20170809-t.exe

File Explorer

PI-windows-x64-01.08.05.1353-20170809-t.exe

.exe 233.6MB

PI-windows-x64-01.08.05.1353-20170809-t.exe

IMPHASH eea8f1a5703b1f0584012e1cfa48e7f4
SHA256 f02cafb2bd8c744573f5c3d0b870bef6c3b633132c72809f8ca89fc7e205d0dc
MD5 5de647abf6535d1fafd642e1b5ecbc16
SHA1 e6445186e23577797feaf5cec7ce289e82af74a9
SHA512 cad798b3cfe14784c5e5d99b03fec4bddd3b27664d8a0b10c706c5e2608062e4ace960b4a8b6dc69df307f3b6e8595f6d5bd13525d13e064377eeb60a2c12713
SSDEEP 6291456:b7V7Ynk1babD8+AJbWhmdesQlCDLd+jcKm0Ab5f2f:b7VMisD8TJbwu+jcKhp
TLSH
T1E0C833A17ADAC43BE13B08319939D75A40B5BD704F72848B63E43B2E5FB29C25231E57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

34:68:57:7e:3b:54:7c:14:d2:fc:ed:31:57:ae:51:2e:8c:dc:c2:e4:ef:ca:ce:ba:b6:b9:87:77:07:77:f7:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=B97989230,CN=Pleiades Astrophoto\, S.L.,O=Pleiades Astrophoto\, S.L.,POSTALCODE=46185,STREET=Calle Ribarroja 28,L=La Pobla de Vallbona,ST=Madrid,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Oct 7, 2026

SERIALNUMBER=B97989230,CN=Pleiades Astrophoto\, S.L.,O=Pleiades Astrophoto\, S.L.,POSTALCODE=46185,STREET=Calle Ribarroja 28,L=La Pobla de Vallbona,ST=Madrid,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=B97989230,CN=Pleiades Astrophoto\, S.L.,O=Pleiades Astrophoto\, S.L.,POSTALCODE=46185,STREET=Calle Ribarroja 28,L=La Pobla de Vallbona,ST=Madrid,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

07:d6:6e:e2:f9:ce:a3:5e:91:58:00:49:fd:f6:6e:aa

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 26, 2015 - Dec 4, 2018

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

5

Entry point

846213

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Branch\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW WriteFile CloseHandle DeleteCriticalSection GetLastError InitializeCriticalSectionAndSpinCount HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap RaiseException SetEvent EnterCriticalSection InitializeCriticalSection LeaveCriticalSection SizeofResource LockResource LoadResource FindResourceW FindResourceExW lstrcpynW MulDiv WaitForSingleObject CreateThread GetProcAddress LoadLibraryExW DecodePointer GetCurrentThreadId Sleep GetDiskFreeSpaceExW SetLastError CreateEventW GetExitCodeThread GetCurrentProcessId CreateDirectoryW GetSystemDirectoryW FreeLibrary lstrlenW GetVersionExW lstrcmpiW GetModuleHandleW LoadLibraryW GetDriveTypeW CompareStringW InterlockedDecrement InterlockedIncrement GetModuleFileNameW GlobalUnlock GlobalLock GlobalAlloc lstrcmpW GetTempPathW GetSystemTime SystemTimeToFileTime GetTempFileNameW DeleteFileW FindFirstFileW RemoveDirectoryW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW SetFileAttributesW GetFileTime CopyFileW ReadFile FindClose MultiByteToWideChar WideCharToMultiByte InterlockedExchange GetCurrentProcess GetSystemInfo WaitForMultipleObjects VirtualProtect VirtualQuery LoadLibraryExA GetShortPathNameW GetStringTypeW SetUnhandledExceptionFilter FormatMessageW GetEnvironmentVariableW LocalFree LoadLibraryA GetModuleFileNameA GetCurrentThread GetFullPathNameW SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo SetFilePointer FlushFileBuffers OutputDebugStringW CreateProcessW GetExitCodeProcess GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultLangID GetWindowsDirectoryW FileTimeToSystemTime CreateToolhelp32Snapshot Process32FirstW Process32NextW MoveFileW ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetLocalTime CreateNamedPipeW ConnectNamedPipe TerminateThread LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree IsDebuggerPresent GetCPInfo TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LCMapStringW WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW QueryPerformanceCounter RtlUnwind QueryPerformanceFrequency GetACP ExitProcess GetModuleHandleExW GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode IsValidCodePage GetOEMCP SetFilePointerEx FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WriteConsoleW ReadConsoleW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

337KB

Virtual Size

337KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

228KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

PI-windows-x64-01.08.05.1353-20170809-t.exe

PE Signature issue

kernel32

generic