c37bc8b01cea05068f43d22f68ab00be2df63289314d4bc0b8d3a5659606457e

Sharing

Copy URL Twitter E-mail

General

Target
c37bc8b01cea05068f43d22f68ab00be2df63289314d4bc0b8d3a5659606457e
Size 811KB
Sample261101-e3knyasxaz
SHA256 c37bc8b01cea05068f43d22f68ab00be2df63289314d4bc0b8d3a5659606457e
MD5 e9b59f81ad8efc00c079fd89adcbf8c2
SHA1 d762ae183e1ec62632bddea967e3a5f6132efe28
SHA512 7c9411a0be7cc2c3df64183bb6f30f1f1e2b617d7434a986eba7b850ed14721323520271d8070c655d00b3f4da4253b67d97e6cd159fcd6e5be468abf9b978a8
SSDEEP 24576:2rsVSoni8KcsSJ9S39PiqGgHpv5mVrEH7k6:KonReSJo3JAgHpRmQ
TLSH
T18C05BF2279E1C1B6D1333170195CC758A6FAF4350A3A4EA7B7CC636D2F385818B35BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
c37bc8b01cea05068f43d22f68ab00be2df63289314d4bc0b8d3a5659606457e

File Explorer

c37bc8b01cea05068f43d22f68ab00be2df63289314d4bc0b8d3a5659606457e

.exe 811KB

c37bc8b01cea05068f43d22f68ab00be2df63289314d4bc0b8d3a5659606457e

IMPHASH 6fe2f907eca9dbc413e5e0339b4fd597
SHA256 c37bc8b01cea05068f43d22f68ab00be2df63289314d4bc0b8d3a5659606457e
MD5 e9b59f81ad8efc00c079fd89adcbf8c2
SHA1 d762ae183e1ec62632bddea967e3a5f6132efe28
SHA512 7c9411a0be7cc2c3df64183bb6f30f1f1e2b617d7434a986eba7b850ed14721323520271d8070c655d00b3f4da4253b67d97e6cd159fcd6e5be468abf9b978a8
SSDEEP 24576:2rsVSoni8KcsSJ9S39PiqGgHpv5mVrEH7k6:KonReSJo3JAgHpRmQ
TLSH
T18C05BF2279E1C1B6D1333170195CC758A6FAF4350A3A4EA7B7CC636D2F385818B35BA6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

89:83:fc:23:dd:41:d6:66:d1:1c:b6:5b:fe:d7:99:82:98:ef:a6:7d:94:2e:64:ee:7c:30:39:2a:f2:f4:fa:8b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Chains

Jun 5, 2024

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Serial Number

06:0e:2f:8f:9e:1b:8b:e5:18:d5:fe:2b:69:cf:cc:b1

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 9, 2023 - Mar 11, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

262054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CLSIDFromString StringFromGUID2 IIDFromString OleRun CoUninitialize CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance

shell32

Shell_NotifyIconA ShellExecuteA SHGetFolderPathW

wininet

InternetReadFile InternetTimeToSystemTime InternetCrackUrlA InternetTimeFromSystemTime InternetOpenA InternetCloseHandle InternetConnectA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetErrorDlg

user32

SetWindowLongA LoadImageA GetDesktopWindow GetWindowLongA GetCursorPos MessageBoxW SetForegroundWindow wsprintfA CharNextA LoadStringA GetMessageA GetMessageW TranslateMessage DispatchMessageA DispatchMessageW PeekMessageA PostMessageA DefWindowProcA PostQuitMessage RegisterClassA CreateWindowExA DestroyWindow ShowWindow MsgWaitForMultipleObjectsEx IsWindowUnicode GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu

version

VerQueryValueW GetFileVersionInfoA GetFileVersionInfoSizeA

kernel32

GetDriveTypeW VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetFileType GetSystemTimeAsFileTime GetModuleHandleW GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringEx EncodePointer InitializeCriticalSectionEx GetStringTypeW GetConsoleOutputCP GetConsoleMode GetFileInformationByHandle GetStdHandle GetModuleFileNameW InitializeSListHead WriteConsoleW GetFullPathNameW CreateDirectoryW GetCommandLineA DecodePointer CloseHandle RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection WaitForSingleObject CreateMutexA CreateEventA WaitForMultipleObjects FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryExA LoadResource SizeofResource lstrcmpA lstrcmpiA lstrcatA lstrlenA FindResourceA SetDllDirectoryA SystemTimeToTzSpecificLocalTime MultiByteToWideChar WideCharToMultiByte IsDBCSLeadByte ResetEvent CreateThread lstrcpyA lstrcpynA CreateFileA WriteFile OpenEventA Sleep DeleteFileA GetTempPathA GetCurrentProcess GetVersionExA LocalFree ReadFile FileTimeToSystemTime GetCurrentProcessId GetCurrentThreadId GetLocalTime FormatMessageW GetEnvironmentVariableA FindClose ExitProcess TerminateProcess GetSystemDirectoryA LockResource LoadLibraryA LocalAlloc FormatMessageA GetCommandLineW SetLastError GetNativeSystemInfo GetModuleHandleExW SetHandleInformation CreatePipe PeekNamedPipe GetExitCodeProcess CreateProcessA SetEndOfFile SetFilePointerEx GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage GetFileAttributesA GetModuleHandleExA LoadLibraryW SetStdHandle LoadLibraryExW OpenMutexA QueryPerformanceCounter CreateFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection IsDebuggerPresent OutputDebugStringW HeapFree HeapAlloc HeapSize HeapReAlloc GetTimeZoneInformation CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetFileSizeEx ReadConsoleW GetCurrentDirectoryW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetEvent

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyA CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegQueryValueExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExA RegQueryInfoKeyW RegOpenKeyExA RegNotifyChangeKeyValue RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegCloseKey

oleaut32

VariantChangeType GetErrorInfo SysFreeString VarUI4FromStr SysAllocString SysStringByteLen SysAllocStringByteLen VariantInit VariantClear

shlwapi

ord12

gdi32

GetStockObject

crypt32

CryptUnprotectData CryptProtectData CryptStringToBinaryA CryptBinaryToStringA

msi

ord117 ord189 ord31 ord159 ord160 ord91 ord115 ord44 ord204 ord168 ord137 ord141 ord8 ord67

Sharing

General

Malware Config

Signatures

File Explorer

c37bc8b01cea05068f43d22f68ab00be2df63289314d4bc0b8d3a5659606457e

PE Signature issue

ole32

shell32

wininet

user32

version

kernel32

advapi32

oleaut32

shlwapi

gdi32

crypt32

msi

generic