DS for Windows_20740[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
DS for Windows_20740.exe
Size 757KB
Sample261030-eccweaws6n
SHA256 92ad1b3bb31cf3eb7c4a4fee45342aa96ee11f4896e03d3ad77029ee92052822
MD5 b7076bfc53274089c48178397c4f4e6a
SHA1 f5cb1815ba0d42addd902a0d8180c419e68bc256
SHA512 43a1e53625bec4082ffe0cc2827b4d1725b25bc537da554493bb2242bc77cceb790453bb6baa6f2f5b96987141be31f5aa6c0ca7e8c2c19b37e2b489a7be3d7c
SSDEEP 12288:m7Eco2Bn/3TxWr3n72NS2ppogrj55ZU3V4h45R02DeDiIbjArlZrTfwL9ekmJZJi:mYQJTsHN0LloZJIZgJHi
TLSH
T11FF48E3A76AC41E9D173E179C9964506F7F2784613319ACB43908AAA5F2B6F41F3F320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
DS for Windows_20740.exe

File Explorer

DS for Windows_20740.exe

.exe 757KB

DS for Windows_20740.exe

IMPHASH 660ccf2b4d82bf9a8916cea7c6aeb153
SHA256 92ad1b3bb31cf3eb7c4a4fee45342aa96ee11f4896e03d3ad77029ee92052822
MD5 b7076bfc53274089c48178397c4f4e6a
SHA1 f5cb1815ba0d42addd902a0d8180c419e68bc256
SHA512 43a1e53625bec4082ffe0cc2827b4d1725b25bc537da554493bb2242bc77cceb790453bb6baa6f2f5b96987141be31f5aa6c0ca7e8c2c19b37e2b489a7be3d7c
SSDEEP 12288:m7Eco2Bn/3TxWr3n72NS2ppogrj55ZU3V4h45R02DeDiIbjArlZrTfwL9ekmJZJi:mYQJTsHN0LloZJIZgJHi
TLSH
T11FF48E3A76AC41E9D173E179C9964506F7F2784613319ACB43908AAA5F2B6F41F3F320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

4e:ce:c3:4a:3f:d3:b4:fe:70:22:89:cc:f4:cf:0f:88:c8:0b:bc:64:7e:60:69:0f:c6:6f:b2:17:bd:eb:da:8e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=AN Soft,O=AN Soft,L=Bergen op Zoom,ST=North Brabant,C=NL

Chains

Jan 1, 0001

Subject

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1c:cf:9d:67:cd:e2:19:ff:12:d9:9a:ff:36:82:e5:a7

Issuer

CN=SSL.com Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 7, 2019 - Mar 3, 2034

Subject

CN=AN Soft,O=AN Soft,L=Bergen op Zoom,ST=North Brabant,C=NL

Serial Number

77:37:bb:9f:e3:4b:0f:1b:d5:af:da:23:3e:ea:b2:95

Issuer

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2026 - Jun 11, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Minor OS version

Major OS version

Entry point

398160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Samim\Desktop\Installer\x64\Release\Installer.pdb

comctl32

ord410 ord413 InitCommonControlsEx

kernel32

GetModuleHandleW SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose WaitForSingleObject HeapReAlloc GetACP IsValidCodePage ReadConsoleW ReadFile GetFileAttributesExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetFileType SetFilePointerEx GetFileSizeEx GetExitCodeProcess GetTempFileNameW CreateProcessW CreateThread CloseHandle DeleteFileW GetLastError Sleep MultiByteToWideChar GetOEMCP GetTempPathW GetModuleFileNameW CreateDirectoryW GetFileAttributesW GetTimeZoneInformation HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapAlloc WriteFile GetStdHandle GetProcAddress TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlUnwind RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW WideCharToMultiByte GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetLocaleInfoEx LCMapStringEx WakeAllConditionVariable CompareStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime

user32

MessageBoxW SetWindowPos DestroyWindow PostMessageW DefWindowProcW CreateWindowExW GetWindowTextW EnableWindow EndPaint BeginPaint InvalidateRect SendMessageW PostQuitMessage DrawTextW GetClientRect SetWindowLongW LoadCursorW TranslateMessage FrameRect TrackMouseEvent DispatchMessageW ShowWindow RegisterClassExW GetWindowLongPtrW SetClassLongPtrW FillRect GetSystemMetrics UpdateWindow GetWindow GetMessageW GetWindowTextLengthW GetWindowLongW GetDC RegisterClassW ReleaseDC SetWindowTextW

gdi32

GetTextExtentPoint32W SelectObject CreateFontW GetStockObject SetTextColor SetBkMode LineTo CreatePen MoveToEx SetBkColor DeleteObject CreateSolidBrush RoundRect

advapi32

RegGetValueW RegSetValueExW RegCloseKey RegCreateKeyExW

shell32

SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

ole32

CoTaskMemFree

urlmon

URLDownloadToFileW URLOpenBlockingStreamA

gdiplus

GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipCloneImage GdipAlloc GdipLoadImageFromStream GdipGetImageWidth GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipDisposeImage GdipDrawImageRectI

wininet

HttpOpenRequestA InternetCrackUrlA InternetOpenUrlA InternetOpenA InternetCloseHandle HttpSendRequestA InternetReadFile InternetOpenUrlW InternetOpenW InternetConnectA

Name

.text

Size

573KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DS for Windows_20740.exe

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

urlmon

gdiplus

wininet

generic