Office_2024_EN_64Bits[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Office_2024_EN_64Bits.exe
Size 3.4MB
Sample261027-rvybaasv2k
SHA256 04c3c5cf2f26c10a82444d4f9498557c89a4521331dace6427a1eb035327d605
MD5 79dda55ff521d810eb573385a3d199be
SHA1 35bbd616d043182317254929d436dce01e980203
SHA512 bda342cb122eb8462e1407f33789b8103fdf4b00182512403987fe06f4e34e5ac07d7b6a40291eeb1621e5d75d928b04a1571d1d244e2fc9c8ec40b350ccf27b
SSDEEP 98304:2Eou88dAT+XHnlFmP6spyLFuSvoQJa9TBqB5nbEx5e3t:2LByHnlPVpuZv9Yvb6e3t
TLSH
T10DF53305776504B9D4660AF9813AE950CFBAF013ADF0CC0F73A8529D2E92786E5B2F71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Office_2024_EN_64Bits.exe

.exe 3.4MB

Office_2024_EN_64Bits.exe

IMPHASH f2f9102c7663962c22d17a8dabc5e7ce
SHA256 04c3c5cf2f26c10a82444d4f9498557c89a4521331dace6427a1eb035327d605
MD5 79dda55ff521d810eb573385a3d199be
SHA1 35bbd616d043182317254929d436dce01e980203
SHA512 bda342cb122eb8462e1407f33789b8103fdf4b00182512403987fe06f4e34e5ac07d7b6a40291eeb1621e5d75d928b04a1571d1d244e2fc9c8ec40b350ccf27b
SSDEEP 98304:2Eou88dAT+XHnlFmP6spyLFuSvoQJa9TBqB5nbEx5e3t:2LByHnlPVpuZv9Yvb6e3t
TLSH
T10DF53305776504B9D4660AF9813AE950CFBAF013ADF0CC0F73A8529D2E92786E5B2F71
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

21:c3:f6:2c:61:9f:ed:b1:63:05:9d:a8:57:5e:37:7c:29:76:eb:af:12:05:a5:49:d4:d4:f4:24:2a:15:e2:ea

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 6377,CN=Technik Markt TMA e.K.,O=Technik Markt TMA e.K.,ST=Bayern,C=DE,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 16, 2025

SERIALNUMBER=HRA 6377,CN=Technik Markt TMA e.K.,O=Technik Markt TMA e.K.,ST=Bayern,C=DE,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=HRA 6377,CN=Technik Markt TMA e.K.,O=Technik Markt TMA e.K.,ST=Bayern,C=DE,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=HRA 6377,CN=Technik Markt TMA e.K.,O=Technik Markt TMA e.K.,ST=Bayern,C=DE,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

9f:ab:28:ff:25:12:cc:84:23:74:41:08:75:c4:db:35

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 21, 2025 - Feb 21, 2028

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

42910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA FindExecutableA SHBrowseForFolderA SHGetMalloc

user32

GetClientRect SetRect EndPaint LoadCursorA GetLastActivePopup KillTimer ShowWindow PostMessageA SendMessageA EnableWindow SetTimer SetWindowTextA SetForegroundWindow SetActiveWindow SetDlgItemTextA GetKeyState CharUpperBuffA PeekMessageA GetSysColor DispatchMessageA GetParent SendDlgItemMessageA GetDlgItem InvalidateRect UpdateWindow LoadStringA MessageBoxA DialogBoxParamA GetWindowLongA SetWindowLongA GetDlgItemTextA EndDialog GetWindowRect GetSystemMetrics SetWindowPos SetCursor CharNextA BeginPaint SetWindowWord GetWindowWord DefWindowProcA RegisterClassA TranslateMessage

kernel32

GetLocaleInfoA GetStringTypeW GetStringTypeA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetStdHandle HeapCreate HeapDestroy VirtualAlloc VirtualFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapSize Sleep GetCurrentThreadId SetLastError TlsFree TlsSetValue GetVersionExA FindClose FindFirstFileA GetCurrentDirectoryA SetCurrentDirectoryA CreateDirectoryA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime LocalAlloc GetDriveTypeA GetEnvironmentVariableA SetFilePointer CreateFileA GetWindowsDirectoryA GlobalFree GlobalUnlock GlobalHandle _lclose _llseek _lread _lopen GlobalLock GlobalAlloc GlobalMemoryStatus GetVersion GetModuleFileNameA WriteFile GetSystemTime LocalFree ExitProcess FormatMessageA GetLastError GetModuleHandleA GetVolumeInformationA WideCharToMultiByte CreateProcessA lstrcmpiA SetErrorMode MultiByteToWideChar GetLocalTime lstrlenA CreateFileW ReadFile GetConsoleCP GetConsoleMode LoadLibraryA InitializeCriticalSection SetStdHandle WriteConsoleA GetConsoleOutputCP FlushFileBuffers WriteConsoleW CloseHandle RtlUnwind HeapAlloc HeapFree HeapReAlloc RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetProcessHeap GetStartupInfoA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetProcAddress TlsGetValue TlsAlloc

gdi32

SetTextColor SetTextAlign GetBkColor GetTextExtentPoint32A ExtTextOutA CreateDCA GetDeviceCaps CreateFontIndirectA DeleteDC SelectObject DeleteObject SetBkColor

advapi32

RegQueryValueA

comctl32

ord17

Sharing

General

Malware Config

Signatures

File Explorer

Office_2024_EN_64Bits.exe

shell32

user32

kernel32

gdi32

advapi32

comctl32

generic