570ccd549eab2709bf1e4af8d87ba3a9aab475fb61496be69d0507da795d4121

Sharing

Copy URL Twitter E-mail

General

Target
570ccd549eab2709bf1e4af8d87ba3a9aab475fb61496be69d0507da795d4121
Size 454KB
Sample261030-v2rnvszyey
SHA256 570ccd549eab2709bf1e4af8d87ba3a9aab475fb61496be69d0507da795d4121
MD5 a5599c64aeef485f0ca0dd0ce9d5cc9d
SHA1 667a9870760b9d51e2bea151da2df69860af4e42
SHA512 ba7c04102104eed58691c070b5b66d86328b8107974522917fbfd89bb1b6df170f02adfae7d41da6ff4f53c7354b98390adc93190e337536bcac3471d9704c88
SSDEEP 6144:cbQvAodhO2SRGi4wAduCrYnOLfNKk6CZmTT6yg5EE6Yo17sD3JGped:cbQvAorO2SRGqAsCrRfNlqmMYoipd
TLSH
T18CA4E511E4079332D74D03FC2E2DBAD5695E5A3C0B65A8C77F8089EEF8621C257B4A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
570ccd549eab2709bf1e4af8d87ba3a9aab475fb61496be69d0507da795d4121

File Explorer

570ccd549eab2709bf1e4af8d87ba3a9aab475fb61496be69d0507da795d4121

.dll 454KB

570ccd549eab2709bf1e4af8d87ba3a9aab475fb61496be69d0507da795d4121

IMPHASH 5e4e9e8461043a91efbe23b55e927fe3
SHA256 570ccd549eab2709bf1e4af8d87ba3a9aab475fb61496be69d0507da795d4121
MD5 a5599c64aeef485f0ca0dd0ce9d5cc9d
SHA1 667a9870760b9d51e2bea151da2df69860af4e42
SHA512 ba7c04102104eed58691c070b5b66d86328b8107974522917fbfd89bb1b6df170f02adfae7d41da6ff4f53c7354b98390adc93190e337536bcac3471d9704c88
SSDEEP 6144:cbQvAodhO2SRGi4wAduCrYnOLfNKk6CZmTT6yg5EE6Yo17sD3JGped:cbQvAorO2SRGqAsCrRfNlqmMYoipd
TLSH
T18CA4E511E4079332D74D03FC2E2DBAD5695E5A3C0B65A8C77F8089EEF8621C257B4A27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

70:41:78:4d:7e:5e:77:54:15:79:b5:50:90:ef:36:bd:3a:b0:a4:e4:f3:12:e7:f2:22:6f:ee:92:79:00:4e:f3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 18, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

177194

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

bcrypt

BCryptFinishHash BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptImportKeyPair BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptEncrypt BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt BCryptVerifySignature BCryptGetProperty BCryptDestroyKey

crypt32

CryptStringToBinaryA CryptDecodeObjectEx CryptImportPublicKeyInfoEx2

kernel32

FreeEnvironmentStringsW GetCommandLineA GetCommandLineW GetEnvironmentStringsW ReadFile WriteFile OutputDebugStringA SetFilePointer CreateFileW Sleep GetLastError CloseHandle GetFileSize DebugBreak MultiByteToWideChar WideCharToMultiByte SetFilePointerEx VirtualProtect HeapFree SetLastError VirtualFree VirtualAlloc LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcAddress GetProcessHeap FreeLibrary IsBadReadPtr LocalFree SetHandleInformation TerminateProcess CreatePipe PeekNamedPipe WaitForSingleObject CreateProcessW GetSystemTimeAsFileTime GetOEMCP SetStdHandle HeapSize GetConsoleOutputCP GetConsoleMode FlushFileBuffers SetUnhandledExceptionFilter GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue UnhandledExceptionFilter WriteConsoleW GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlUnwind RaiseException InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegEnumValueW RegQueryValueExW RegCloseKey

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpCloseHandle

ws2_32

ioctlsocket htons recv inet_ntoa connect socket send inet_addr WSACleanup WSAStartup inet_pton gethostbyname closesocket WSAGetLastError

Name

.text

Size

311KB

Virtual Size

311KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

570ccd549eab2709bf1e4af8d87ba3a9aab475fb61496be69d0507da795d4121

PE Signature issue

bcrypt

crypt32

kernel32

advapi32

winhttp

ws2_32

generic