457f422b4f28f343767c384d56873161127c0d151c470cc1769457b926cdc6eb

Sharing

Copy URL Twitter E-mail

General

Target
457f422b4f28f343767c384d56873161127c0d151c470cc1769457b926cdc6eb
Size 535KB
Sample261104-2dgmbady4s
SHA256 457f422b4f28f343767c384d56873161127c0d151c470cc1769457b926cdc6eb
MD5 3494ee0c27160c94692e87a865f5b81d
SHA1 6f8ae85148897232f7fc9e336acb3d87b7af3829
SHA512 b0928968f57da12d275bd15aac1dfbe6b22eae4f3ac0d466589ed1034676e55da9c8e3417ff5af68db7437899d1ab5d97ce2e14f7d13b5c95bc1a158e75405fd
SSDEEP 12288:9pWgqU33VA33333V3333333A333333333333+cg9qK:9pdN33VA33333V3333333A333333333G
TLSH
T12BC44FA60340605BE8180736914AA97CC76DEEC3F771685B9D1EFBC974B7C18B78E248
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
457f422b4f28f343767c384d56873161127c0d151c470cc1769457b926cdc6eb

File Explorer

457f422b4f28f343767c384d56873161127c0d151c470cc1769457b926cdc6eb

.exe 535KB

457f422b4f28f343767c384d56873161127c0d151c470cc1769457b926cdc6eb

IMPHASH c3430a32a4a8625e8857bcb6b6bf3839
SHA256 457f422b4f28f343767c384d56873161127c0d151c470cc1769457b926cdc6eb
MD5 3494ee0c27160c94692e87a865f5b81d
SHA1 6f8ae85148897232f7fc9e336acb3d87b7af3829
SHA512 b0928968f57da12d275bd15aac1dfbe6b22eae4f3ac0d466589ed1034676e55da9c8e3417ff5af68db7437899d1ab5d97ce2e14f7d13b5c95bc1a158e75405fd
SSDEEP 12288:9pWgqU33VA33333V3333333A333333333333+cg9qK:9pdN33VA33333V3333333A333333333G
TLSH
T12BC44FA60340605BE8180736914AA97CC76DEEC3F771685B9D1EFBC974B7C18B78E248
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

91:66:46:61:63:58:0e:b0:24:36:81:6e:36:1d:be:12:2d:86:4e:0f:78:39:63:97:f1:ae:b7:eb:74:e9:13:5f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

May 10, 2022

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Serial Number

0c:98:38:f6:73:f9:b1:cc:e3:95:cf:ab:2b:66:84:e4

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 8, 2020 - Oct 12, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

Major OS version

Entry point

566504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??Bid@locale@std@@QEAA_KXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ

crypt32

CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CertCloseStore CryptQueryObject CertFreeCertificateContext CryptMsgClose CryptDecodeObject

wintrust

WinVerifyTrust

shlwapi

PathAppendW PathFileExistsW PathRemoveFileSpecW

mfc140u

ord6729 ord8656 ord14209 ord11625 ord3713 ord3718 ord11771 ord8830 ord11415 ord11414 ord1120 ord9979 ord9975 ord9977 ord9978 ord9976 ord2346 ord2350 ord8900 ord9941 ord5555 ord6614 ord983 ord13545 ord6122 ord14289 ord6123 ord14290 ord6121 ord14288 ord7719 ord12212 ord14088 ord11665 ord11664 ord2011 ord7668 ord12625 ord3949 ord4011 ord9089 ord14216 ord7650 ord14210 ord12223 ord12222 ord2439 ord10163 ord5183 ord8023 ord14360 ord7913 ord9946 ord3209 ord3212 ord9068 ord4445 ord12544 ord12606 ord10124 ord11929 ord8084 ord1450 ord7393 ord8167 ord11901 ord11933 ord7920 ord11921 ord5706 ord3731 ord4511 ord7745 ord3726 ord1503 ord1033 ord296 ord7922 ord5227 ord7450 ord7461 ord7460 ord5062 ord5229 ord5083 ord5339 ord9041 ord5552 ord5363 ord5080 ord2212 ord2187 ord878 ord1369 ord10691 ord8947 ord3173 ord13513 ord11944 ord11940 ord1700 ord1722 ord1748 ord1734 ord1755 ord4776 ord3951 ord4843 ord3308 ord4788 ord3307 ord4806 ord3071 ord4800 ord446 ord4794 ord6285 ord4853 ord4837 ord4782 ord2801 ord4859 ord4814 ord4752 ord4767 ord4828 ord4360 ord5582 ord9384 ord4352 ord2967 ord14211 ord7651 ord14217 ord6631 ord11406 ord13354 ord5723 ord13767 ord2629 ord11806 ord3812 ord3279 ord3278 ord3172 ord11850 ord4726 ord8468 ord7233 ord10727 ord11813 ord6000 ord13397 ord2697 ord8901 ord11854 ord1089 ord8731 ord10704 ord7716 ord488 ord11644 ord11085 ord10070 ord5676 ord2370 ord5451 ord4656

kernel32

DeleteCriticalSection GetPackageFullName WritePrivateProfileStringW GetPackageId GetPrivateProfileIntW GetPackageFamilyName GetProcessId WaitForSingleObject GetPrivateProfileStringW Sleep SystemTimeToFileTime VirtualAllocEx ReadProcessMemory GetCurrentProcessId GlobalMemoryStatusEx QueryFullProcessImageNameW VirtualFreeEx SetProcessWorkingSetSize CreateMutexW LocalFree CloseHandle GetLastError OpenProcess InitializeCriticalSectionEx DeleteFileW FileTimeToLocalFileTime GetProcessHeap HeapAlloc FileTimeToSystemTime OutputDebugStringW lstrcmpA SetLastError GetPackagePathByFullName GetSystemInfo GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SetFileAttributesW GetModuleHandleA GetCurrentProcess GetLocalTime CreateFileW GetModuleHandleW GetProcAddress HeapFree

user32

GetWindowTextW EnableWindow GetParent GetClientRect SetRectEmpty GetClassNameW FindWindowW LoadIconW TranslateMessage EnumWindows IsWindowEnabled CopyRect GetKeyState DrawIcon GetWindowLongW GetWindowThreadProcessId GetSystemMetrics PostMessageW FindWindowExW GetWindowRect IsWindowVisible EnumChildWindows SendMessageW IsIconic

advapi32

RegQueryValueExW RegSetValueExW RegCloseKey RegCreateKeyExW RegOpenKeyExW

shell32

ShellExecuteExW SHGetFolderPathW

comctl32

InitCommonControlsEx

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeSecurity CoInitializeEx

oleaut32

SysAllocString VariantClear SysFreeString

psapi

EnumProcessModules GetModuleBaseNameW EnumProcesses QueryWorkingSet

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeExW

vcruntime140

memmove _CxxThrowException memset __std_exception_copy __std_exception_destroy __std_terminate __C_specific_handler __CxxFrameHandler3 memcpy

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsscanf _wfopen __stdio_common_vswprintf_s __stdio_common_vsnwprintf_s _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite __acrt_iob_func fgetc __stdio_common_vfprintf __stdio_common_vfwprintf fclose fflush fputc _set_fmode

api-ms-win-crt-string-l1-1-0

wcsncpy_s _wcsicmp wcstok_s wcscpy_s _wcsnicmp _stricmp strncpy_s

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment _invalid_parameter_noinfo_noreturn _seh_filter_exe terminate _crt_atexit _register_onexit_function _initialize_onexit_table _set_app_type _register_thread_local_exe_atexit_callback _c_exit _cexit _configure_wide_argv _exit _initterm_e _initterm _get_wide_winmain_command_line exit

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free realloc _set_new_mode

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file _wmkdir _wremove _wsplitpath_s

api-ms-win-crt-convert-l1-1-0

_itow_s wcstol

api-ms-win-crt-time-l1-1-0

_mktime64 _localtime64_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

448KB

Virtual Size

448KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

46KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

457f422b4f28f343767c384d56873161127c0d151c470cc1769457b926cdc6eb

PE Signature issue

msvcp140

crypt32

wintrust

shlwapi

mfc140u

kernel32

user32

advapi32

shell32

comctl32

ole32

oleaut32

psapi

version

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic