57ee1087d64ff7370b773deee65c32073bb85f5fd93c72ff147763587d011860

Sharing

Copy URL Twitter E-mail

General

Target
57ee1087d64ff7370b773deee65c32073bb85f5fd93c72ff147763587d011860
Size 2.2MB
Sample261027-1a6xcsf18x
SHA256 57ee1087d64ff7370b773deee65c32073bb85f5fd93c72ff147763587d011860
MD5 4104851890c639d730bb33db79e780d4
SHA1 3948dce7fe6ccdbf6ae50e1bfaedcea9ba2f3fea
SHA512 a96dff8de92add57f912119ea46548dcdf01089272dc8bfd11ba9d0c9234e23115f307424bbdb66429c69d0bdf06ec6de444a09aff9b207f25d1a1c4bc31cf42
SSDEEP 24576:MGsQAs4aD0gvtl3Bf6z5g7oM9xdml4ZFKGyGpRw51/8EY6yhpxgrKfaNGd5:MGq1gvtlxSGLdrFxyGpRw5wFxgXNW5
TLSH
T1C3A5CF07BB9412E9E2B3C13CC9564B41FB72FC155720E7DB12A4469A1F132E24EFA726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
57ee1087d64ff7370b773deee65c32073bb85f5fd93c72ff147763587d011860

File Explorer

57ee1087d64ff7370b773deee65c32073bb85f5fd93c72ff147763587d011860

.exe 2.2MB

57ee1087d64ff7370b773deee65c32073bb85f5fd93c72ff147763587d011860

IMPHASH cd13eca80fc28b00e0054d78cdd9694e
SHA256 57ee1087d64ff7370b773deee65c32073bb85f5fd93c72ff147763587d011860
MD5 4104851890c639d730bb33db79e780d4
SHA1 3948dce7fe6ccdbf6ae50e1bfaedcea9ba2f3fea
SHA512 a96dff8de92add57f912119ea46548dcdf01089272dc8bfd11ba9d0c9234e23115f307424bbdb66429c69d0bdf06ec6de444a09aff9b207f25d1a1c4bc31cf42
SSDEEP 24576:MGsQAs4aD0gvtl3Bf6z5g7oM9xdml4ZFKGyGpRw51/8EY6yhpxgrKfaNGd5:MGq1gvtlxSGLdrFxyGpRw5wFxgXNW5
TLSH
T1C3A5CF07BB9412E9E2B3C13CC9564B41FB72FC155720E7DB12A4469A1F132E24EFA726
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

fa:c8:dc:b1:54:3e:b4:d7:e9:a3:35:95:ae:88:0b:d5:45:9a:1f:1a:37:93:35:0c:78:15:ca:4d:9b:14:61:03

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=202325236K,CN=SPRING (SG) PTE. LTD,O=SPRING (SG) PTE. LTD,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Oct 25, 2026

SERIALNUMBER=202325236K,CN=SPRING (SG) PTE. LTD,O=SPRING (SG) PTE. LTD,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=202325236K,CN=SPRING (SG) PTE. LTD,O=SPRING (SG) PTE. LTD,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=202325236K,CN=SPRING (SG) PTE. LTD,O=SPRING (SG) PTE. LTD,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Serial Number

01:53:bd:f6:07:26:a1:e0:07:0a:bc:98:2d:eb:48:65

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 18, 2024 - Mar 18, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1000048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\A147\installer\Build\x64\UnicodeRelease\SamanUninstaller\SamanUninstaller.pdb

kernel32

WaitForMultipleObjects GetExitCodeProcess SetDllDirectoryW GetUserDefaultUILanguage HeapAlloc GetProcessHeap DuplicateHandle TerminateThread LoadLibraryExA VirtualQuery GetSystemInfo WriteConsoleW SetEndOfFile HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler GetFileSizeEx GetConsoleOutputCP FlushFileBuffers SetFilePointerEx ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetTempPathW HeapReAlloc HeapFree GetCurrentThread CreateEventW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread GetTimeZoneInformation GetFileType SetStdHandle GetCommandLineW GetCommandLineA FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader RaiseException OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo CompareStringEx GetStringTypeW LCMapStringEx EncodePointer GetLocaleInfoEx LeaveCriticalSection EnterCriticalSection FormatMessageA WaitForSingleObject K32GetProcessImageFileNameW K32GetModuleFileNameExW K32EnumProcessModules Process32NextW Process32FirstW CreateToolhelp32Snapshot AllocConsole VerifyVersionInfoW GetVersionExW GetSystemDirectoryW GetCurrentThreadId TerminateProcess GetCurrentProcess CreateMutexW SetFileAttributesW QueryDosDeviceW GetLogicalDriveStringsW GetFinalPathNameByHandleW GetDiskFreeSpaceExW FindNextFileW FindFirstFileW FindClose GetEnvironmentVariableW GetStdHandle VerSetConditionMask lstrcmpiW lstrcpyW lstrcpynW GetLocalTime GlobalFree DeleteFileW CreateFileA GlobalAlloc LockResource SizeofResource FreeResource LoadResource FindResourceW SystemTimeToFileTime LocalFileTimeToFileTime GetFileAttributesW SetFilePointer SetFileTime WriteFile CreateDirectoryW LocalFree FormatMessageW InitializeCriticalSectionAndSpinCount ExitProcess GlobalUnlock GlobalLock CloseHandle ReadFile GetFileSize CreateFileW lstrlenW GetTickCount WideCharToMultiByte GetCurrentDirectoryW GetModuleFileNameW OpenProcess MulDiv GetProcAddress LoadLibraryW GetACP MultiByteToWideChar LoadLibraryExW MoveFileW CopyFileW Sleep DeleteCriticalSection InitializeCriticalSectionEx DecodePointer RemoveDirectoryW SetCurrentDirectoryW MoveFileExW GetModuleHandleW GetCurrentProcessId GetLastError GetModuleHandleExW RtlUnwind

user32

GetKeyboardLayout GetKeyNameTextW GetShellWindow SetFocus SetWindowTextW GetWindowRect MapVirtualKeyExW InflateRect UnionRect SetCursor LoadCursorW MonitorFromPoint MonitorFromWindow EnumWindows GetWindowThreadProcessId EnumChildWindows PostQuitMessage UnregisterClassW TrackPopupMenu EnableMenuItem AppendMenuW CreatePopupMenu MessageBoxW SetForegroundWindow DestroyMenu IsWindowEnabled UpdateWindow EqualRect GetWindowTextLengthW GetWindowTextW InvalidateRgn CreateAcceleratorTableW GetGUIThreadInfo OffsetRect DrawTextA GetCaretBlinkTime ClientToScreen SetCaretPos GetCaretPos HideCaret ShowCaret CreateCaret CharPrevW SetRect DrawTextW FillRect GetWindowRgn UpdateLayeredWindow SetWindowRgn MoveWindow GetMenu AdjustWindowRectEx GetPropW SetPropW CallWindowProcW GetWindowLongPtrW RegisterClassExW GetClassInfoExW RegisterClassW GetSystemMetrics EnableWindow ShowWindow SetWindowLongPtrW DefWindowProcW LoadImageW GetParent PostMessageW SetCapture KillTimer SetTimer GetFocus IsZoomed DispatchMessageW TranslateMessage GetMessageW InvalidateRect GetSysColor ReleaseCapture PtInRect GetCursorPos CreateWindowExW GetMonitorInfoW MapWindowPoints IntersectRect IsWindowVisible IsWindow IsRectEmpty GetUpdateRect EndPaint BeginPaint GetWindow GetActiveWindow IsIconic SetWindowLongW GetWindowLongW SetWindowPos GetClientRect DestroyWindow CharNextW GetKeyState ScreenToClient SendMessageW RegisterWindowMessageW ReleaseDC GetDC

gdi32

StretchBlt CombineRgn ExtSelectClipRgn CreateRectRgnIndirect GetClipBox SelectClipRgn PtInRegion CreateRectRgn CreateDIBSection CreateRoundRectRgn PlayEnhMetaFile CreateCompatibleBitmap GetEnhMetaFileHeader CreateDIBitmap AddFontMemResourceEx CreateDCA CloseEnhMetaFile CreateEnhMetaFileW SetWindowOrgEx Rectangle RestoreDC BitBlt SaveDC SelectObject CreateCompatibleDC RemoveFontMemResourceEx DeleteObject CreatePen CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps SelectPalette RealizePalette GetDIBits GetCurrentObject SetStretchBltMode CreateSolidBrush CreatePenIndirect MoveToEx LineTo GetObjectA SetBkMode SetTextColor SetBkColor GetCharABCWidthsW GetTextExtentPoint32W TextOutW GdiFlush EnumFontFamiliesExW CreatePatternBrush GetTextExtentPointA GetBitmapBits SetBitmapBits GetTextMetricsW DeleteDC

advapi32

CheckTokenMembership RegDeleteKeyExW RegDeleteValueW RegEnumValueW GetUserNameW RegSetValueExW LookupPrivilegeValueW GetTokenInformation FreeSid EqualSid DuplicateTokenEx RegCloseKey AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken RegDeleteTreeW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW

shell32

SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHCreateDirectoryExW DragQueryFileW SHChangeNotify ShellExecuteW

ole32

CoInitializeSecurity CoTaskMemFree CoTaskMemAlloc CoCreateGuid CLSIDFromProgID CLSIDFromString OleLockRunning CreateStreamOnHGlobal ReleaseStgMedium RegisterDragDrop DoDragDrop CoCreateInstance OleDuplicateData CoInitialize CoUninitialize StringFromGUID2

oleaut32

SysAllocString SysFreeString VariantClear VariantChangeType SetErrorInfo CreateErrorInfo GetErrorInfo VariantInit

comctl32

_TrackMouseEvent InitCommonControlsEx ord17

shlwapi

SHGetValueW PathIsDirectoryW PathFindExtensionW PathFindFileNameW SHDeleteKeyW SHDeleteValueW SHSetValueW PathIsRelativeW StrChrW StrStrIW PathFileExistsW PathIsNetworkPathW

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

451KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

57ee1087d64ff7370b773deee65c32073bb85f5fd93c72ff147763587d011860

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

generic