417ae48c3c541f873abe6fa34785054c461d3219544fcbf59281bfee10e76904

Sharing

Copy URL Twitter E-mail

General

Target
417ae48c3c541f873abe6fa34785054c461d3219544fcbf59281bfee10e76904
Size 380KB
Sample261102-qsbttscv3q
SHA256 417ae48c3c541f873abe6fa34785054c461d3219544fcbf59281bfee10e76904
MD5 7e8989ef6e1cfde4a0039883e7626ee0
SHA1 c460a7b0d3c1b57d145302d06e9bcfa000943713
SHA512 71ae3de8ef2b062e30278efdf56d00091c12c9214cb470ebec967ef0894a173ba59e83aa1fef88d8d16ac5286939cc0f230a65276d3e93f8f34e6250b3dc31e2
SSDEEP 6144:THjE18e5uBgrD1CpK61/IJmGmgD9Sy7IvGM0RRClerrIFiDfjknqYdh7wBKUZWyZ:THj1ekmApj/IJmGmcQGICZn
TLSH
T100842851F7E826E4E9BB933C8DB64505EB7678590730C6DF13A0422A2E337C18D7A762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
417ae48c3c541f873abe6fa34785054c461d3219544fcbf59281bfee10e76904

File Explorer

417ae48c3c541f873abe6fa34785054c461d3219544fcbf59281bfee10e76904

.exe 380KB

417ae48c3c541f873abe6fa34785054c461d3219544fcbf59281bfee10e76904

IMPHASH 311648e8fca1117bce2d80e41de3fac0
SHA256 417ae48c3c541f873abe6fa34785054c461d3219544fcbf59281bfee10e76904
MD5 7e8989ef6e1cfde4a0039883e7626ee0
SHA1 c460a7b0d3c1b57d145302d06e9bcfa000943713
SHA512 71ae3de8ef2b062e30278efdf56d00091c12c9214cb470ebec967ef0894a173ba59e83aa1fef88d8d16ac5286939cc0f230a65276d3e93f8f34e6250b3dc31e2
SSDEEP 6144:THjE18e5uBgrD1CpK61/IJmGmgD9Sy7IvGM0RRClerrIFiDfjknqYdh7wBKUZWyZ:THj1ekmApj/IJmGmcQGICZn
TLSH
T100842851F7E826E4E9BB933C8DB64505EB7678590730C6DF13A0422A2E337C18D7A762
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

e6:c1:83:71:b8:95:08:2c:de:89:b5:a5:3a:b4:b7:99:96:ec:b6:c1:7d:ad:cb:dd:12:2b:49:d3:48:d8:34:24

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

Jun 21, 2024

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Serial Number

06:55:f9:45:96:13:df:a4:09:d8:3e:84:d9:65:70:40

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 2, 2024 - Apr 1, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

411000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateMutexW CreateFileW ReleaseMutex DisconnectNamedPipe CreateEventW GetLastError SetEvent GetOverlappedResult WaitNamedPipeW ConnectNamedPipe FlushFileBuffers GetExitCodeProcess HeapFree MultiByteToWideChar LoadLibraryW ResetEvent HeapAlloc GetProcAddress GetProcessHeap CreateProcessW FreeLibrary WideCharToMultiByte GetExitCodeThread TerminateThread WaitForSingleObjectEx GetNamedPipeClientProcessId EncodePointer SetLastError FormatMessageW WriteConsoleW GetConsoleMode GetConsoleOutputCP HeapReAlloc HeapSize SetFilePointerEx GetStringTypeW SetStdHandle K32GetModuleFileNameExW CreateNamedPipeW WriteFile TerminateProcess ReadFile CreateThread CloseHandle WaitForSingleObject lstrcmpiW GetModuleHandleW Sleep OpenProcess FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP InterlockedPushEntrySList RaiseException RtlPcToFileHeader IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType EnumSystemLocalesW GetUserDefaultLCID RtlUnwindEx IsValidLocale GetLocaleInfoW LCMapStringW GetModuleFileNameW GetCurrentProcessId FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle GetModuleHandleExW ExitProcess GetCommandLineW GetCommandLineA LoadLibraryExW TlsFree TlsSetValue TlsGetValue EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead TlsAlloc

user32

LoadCursorW GetWindowThreadProcessId GetMessageW DefWindowProcW PostMessageW CreateWindowExW RegisterClassExW DispatchMessageW SetTimer TranslateMessage LoadIconW FindWindowW KillTimer PostQuitMessage

advapi32

InitializeSecurityDescriptor RegOpenKeyExW RegCloseKey EventWriteTransfer EventRegister EventSetInformation EventUnregister SetSecurityDescriptorDacl RegQueryValueExW

ole32

CoInitializeEx CoCreateInstance CoUninitialize CoTaskMemAlloc CoCreateFreeThreadedMarshaler

oleaut32

SysAllocString SetErrorInfo GetErrorInfo SysFreeString SysStringLen

wlanapi

WlanEnumInterfaces WlanQueryInterface WlanCloseHandle WlanOpenHandle WlanFreeMemory

iphlpapi

GetAdaptersAddresses

ws2_32

WSAStartup WSACleanup WSAGetLastError htons inet_ntoa connect ntohs socket bind getsockname inet_addr listen closesocket GetHostNameW accept

Name

.text

Size

210KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

51KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

417ae48c3c541f873abe6fa34785054c461d3219544fcbf59281bfee10e76904

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

wlanapi

iphlpapi

ws2_32

generic