IMG_958742253158[.]scr[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
IMG_958742253158.scr.exe
Size 428KB
Sample261015-vtthgsty2m
SHA256 9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129
MD5 8772dce19de3eec069559fe06557572d
SHA1 867f19fdd663cc4d589ca54b5ca1bca56979b145
SHA512 f9c77d517351fe7f0a8493c8e48cf77f439b999225f25de7efe165cc68284e7a87a2994106c9cc0f0d8a45a8f7f9f5742751935d0417b79c741bdde64d63477c
SSDEEP 6144:NZz0G5YAAKapwLu4Aa/0kxgh6tCDNrzgel8d3+GMC8vON0d4NWSVLyztM3G:/0GeGLujuxgYUp8qLC20vWUmzt7
TLSH
T1E994D012B66A11FAE36AA635C5918606FF72BC62075169CF17903EF74E336D08E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

IMG_958742253158.scr.exe

.exe 428KB

IMG_958742253158.scr.exe

IMPHASH 669be9f29dcbe71721164fb8b8e8b304
SHA256 9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129
MD5 8772dce19de3eec069559fe06557572d
SHA1 867f19fdd663cc4d589ca54b5ca1bca56979b145
SHA512 f9c77d517351fe7f0a8493c8e48cf77f439b999225f25de7efe165cc68284e7a87a2994106c9cc0f0d8a45a8f7f9f5742751935d0417b79c741bdde64d63477c
SSDEEP 6144:NZz0G5YAAKapwLu4Aa/0kxgh6tCDNrzgel8d3+GMC8vON0d4NWSVLyztM3G:/0GeGLujuxgYUp8qLC20vWUmzt7
TLSH
T1E994D012B66A11FAE36AA635C5918606FF72BC62075169CF17903EF74E336D08E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

a1:1a:46:94:a1:55:47:d8:aa:a3:05:b1:65:e2:3a:54:df:ca:14:60:e4:0b:25:0d:f6:b5:84:76:a3:c6:f7:0f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=998932769,CN=SOFTWARE DYNAMICS AS,O=SOFTWARE DYNAMICS AS,L=Inderøy,ST=Trøndelag,C=NO,1.3.6.1.4.1.311.60.2.1.3=#13024e4f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 30, 2026

SERIALNUMBER=998932769,CN=SOFTWARE DYNAMICS AS,O=SOFTWARE DYNAMICS AS,L=Inderøy,ST=Trøndelag,C=NO,1.3.6.1.4.1.311.60.2.1.3=#13024e4f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

SERIALNUMBER=998932769,CN=SOFTWARE DYNAMICS AS,O=SOFTWARE DYNAMICS AS,L=Inderøy,ST=Trøndelag,C=NO,1.3.6.1.4.1.311.60.2.1.3=#13024e4f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

SERIALNUMBER=998932769,CN=SOFTWARE DYNAMICS AS,O=SOFTWARE DYNAMICS AS,L=Inderøy,ST=Trøndelag,C=NO,1.3.6.1.4.1.311.60.2.1.3=#13024e4f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

4a:2d:7e:6f:c1:a8:b2:71:98:36:4c:d0:67:f2:2b:58

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 18, 2026 - Mar 18, 2027

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

20360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\steve\Documents\GitHub\AdvIns\x64\Release\AdvIns.pdb

kernel32

MultiByteToWideChar CloseHandle HeapAlloc GetProcessHeap CreateProcessW FindFirstFileW SetLastError FindNextFileW FindClose GetLastError CreateFileW SizeofResource LockResource LoadResource FindResourceW WriteConsoleW GetConsoleMode GetConsoleOutputCP WriteFile HeapFree OutputDebugStringW CreateDirectoryW FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

cabinet

ord23 ord20 ord22

bcrypt

BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGetProperty BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptSetProperty

winhttp

WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpReceiveResponse WinHttpCloseHandle WinHttpOpen

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

Name

.text

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

249KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

IMG_958742253158.scr.exe

kernel32

shell32

ole32

cabinet

bcrypt

winhttp

rpcrt4

generic