iPodSupport64Setup (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
iPodSupport64Setup (1).exe
Size 32.3MB
Sample261013-3vaqrssx3m
SHA256 07bbe616b8efad8803d7b693c91eb0f54c3f134c43991cb40dc865394414d6cb
MD5 549785242d8fb5d3b399de839a3ad8fc
SHA1 4f0328865c33db1884827dbf9fc4f7df9f5d526a
SHA512 a298d494ea479af094bae8b06929ec5945a0061583e4fffa60143fccb8f2e26b4740d3d9506a1f3e4dc0ceb810c34c290df9c1c5da09e4c17a00dcf2254d3b97
SSDEEP 786432:BtseDDm36Aj5cJTxiSSs4tBkUCdZjM7ZEWMef6p9a:B+H1c9xiSSs4pCdZiE/eU9a
TLSH
T1ED773363B4BC58DBF1DDB83960E1516DFA26E07315423BFB2182A7201E572816F3BA5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

iPodSupport64Setup (1).exe

.exe 32.3MB

iPodSupport64Setup (1).exe

IMPHASH ae8bfceebeeec60037eacbb84288e54f
SHA256 07bbe616b8efad8803d7b693c91eb0f54c3f134c43991cb40dc865394414d6cb
MD5 549785242d8fb5d3b399de839a3ad8fc
SHA1 4f0328865c33db1884827dbf9fc4f7df9f5d526a
SHA512 a298d494ea479af094bae8b06929ec5945a0061583e4fffa60143fccb8f2e26b4740d3d9506a1f3e4dc0ceb810c34c290df9c1c5da09e4c17a00dcf2254d3b97
SSDEEP 786432:BtseDDm36Aj5cJTxiSSs4tBkUCdZjM7ZEWMef6p9a:B+H1c9xiSSs4pCdZiE/eU9a
TLSH
T1ED773363B4BC58DBF1DDB83960E1516DFA26E07315423BFB2182A7201E572816F3BA5C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

28:2e:af:e9:84:20:29:98:a7:0f:df:06:ed:44:58:8b:d3:1d:e7:84:da:26:9d:f9:5e:ef:63:c8:2b:ec:4d:93

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Chains

Feb 24, 2021

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

a2:08:1d:74:d7:a7:0e:18:1a:52:27:d9:f8:49:3f:de:a4:d5:99:86

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Chains

Feb 24, 2021

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Serial Number

4e:f1:65:86:a2:ff:12:d6:9c:55:6e:c4:c9:1b:ae:e1

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 6, 2020 - Mar 1, 2022

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

13004

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\BWA\F2CDC819-42D4-0\iTunesWinPackageData_Final-12112.2\objroot\FileCache_iPodSupport64\setup\setup.pdb

kernel32

CreateDirectoryA CreateFileA DeleteFileA LocalFileTimeToFileTime RemoveDirectoryA SetFileAttributesA SetFileTime GetTempPathA CloseHandle GetLastError WaitForSingleObject CreateMutexA GetCurrentProcess GetCurrentProcessId GetExitCodeProcess CreateProcessA GetTickCount GetSystemDirectoryA FreeLibrary FreeResource GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource LocalAlloc LocalFree SetProcessWorkingSetSize DosDateTimeToFileTime FindResourceA SetStdHandle HeapAlloc HeapFree GetProcessHeap GetLocalTime LoadLibraryExA LoadLibraryA HeapReAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException SetFilePointerEx ReadFile GetConsoleMode ReadConsoleW WriteFile GetConsoleCP CreateFileW GetFileType GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW LCMapStringW FlushFileBuffers MultiByteToWideChar WideCharToMultiByte SetEndOfFile FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW GetFileSizeEx WriteConsoleW HeapSize

Name

.text

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32.1MB

Virtual Size

32.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

iPodSupport64Setup (1).exe

kernel32

generic