04837f20769b11f95da24ebd48c991fefbd1374a79685f3ceb2f8b7cef1635df

Sharing

Copy URL Twitter E-mail

General

Target
04837f20769b11f95da24ebd48c991fefbd1374a79685f3ceb2f8b7cef1635df
Size 905KB
Sample261106-kgtydabd77
SHA256 04837f20769b11f95da24ebd48c991fefbd1374a79685f3ceb2f8b7cef1635df
MD5 44411db9fc2bc5587322e8f69a813ee4
SHA1 60da0e4a92dcbe6b8484b5388e89e36165b9537f
SHA512 806982ceb1fdd41f3d3252bd6b538b3c78e9031b3618f706bab51a9f96658b82bc80641c41d9176834facf4a1201a8d121f650ca412b879a6faa039b6f15604f
SSDEEP 12288:Z1Ii1PXHxjul76Tks9kGpYEimmkX8e4IgYaN4jd1BtOkodxduog/TXJa/x82IEre:ZQgEruog/TXJmxOSI/rEH7U
TLSH
T1B815AF6BA2D4406DD0D00179BE71B7147DFDAC38DF21E1C3914DDA2E28E12D58A3DABA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
04837f20769b11f95da24ebd48c991fefbd1374a79685f3ceb2f8b7cef1635df

File Explorer

04837f20769b11f95da24ebd48c991fefbd1374a79685f3ceb2f8b7cef1635df

.exe 905KB

04837f20769b11f95da24ebd48c991fefbd1374a79685f3ceb2f8b7cef1635df

IMPHASH 028694e3a3d84ad907929b6b4a74636b
SHA256 04837f20769b11f95da24ebd48c991fefbd1374a79685f3ceb2f8b7cef1635df
MD5 44411db9fc2bc5587322e8f69a813ee4
SHA1 60da0e4a92dcbe6b8484b5388e89e36165b9537f
SHA512 806982ceb1fdd41f3d3252bd6b538b3c78e9031b3618f706bab51a9f96658b82bc80641c41d9176834facf4a1201a8d121f650ca412b879a6faa039b6f15604f
SSDEEP 12288:Z1Ii1PXHxjul76Tks9kGpYEimmkX8e4IgYaN4jd1BtOkodxduog/TXJa/x82IEre:ZQgEruog/TXJmxOSI/rEH7U
TLSH
T1B815AF6BA2D4406DD0D00179BE71B7147DFDAC38DF21E1C3914DDA2E28E12D58A3DABA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

91:fd:28:5c:76:3d:5f:53:a4:da:60:37:2f:f7:47:1d:26:f6:1c:58:0e:fc:b2:7e:0a:93:1a:04:d1:d2:a8:6a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Mar 19, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:ea:21:54:38:08:c9:da:79:e3:67:7c:a3:37:2c:65

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 6, 2025 - Oct 5, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

113311

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\FlashPlayer_CN_Windows\Main\code\build\win\results\FlashPlayerApp\Release\Win32\FlashPlayerApp.pdb

uxtheme

GetCurrentThemeName

kernel32

LoadLibraryW DecodePointer GetProcAddress DeleteCriticalSection SystemTimeToFileTime GetModuleHandleW GetSystemTime RemoveDirectoryW FindFirstFileW FindNextFileW FindClose DeleteFileW CreateFileW GetFileSizeEx CloseHandle CreateDirectoryW WideCharToMultiByte GetSystemWow64DirectoryW GetSystemDirectoryW GetVersionExA GetCommandLineW LoadLibraryA EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetUserDefaultUILanguage GetVersionExW CreateProcessW WaitForSingleObject GetExitCodeProcess RaiseException GetVersion FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW HeapReAlloc HeapSize GetStringTypeW GetConsoleCP LCMapStringW ReadConsoleW GetConsoleMode GetFileType SetFilePointerEx GetLastError FlushFileBuffers MultiByteToWideChar GetModuleHandleA GetFileAttributesW InitializeCriticalSectionAndSpinCount GetModuleFileNameW OutputDebugStringA SetLastError SetEndOfFile WriteConsoleW SetStdHandle ReadFile GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess RtlUnwind LoadLibraryExW FreeLibrary TlsFree UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW EncodePointer HeapAlloc HeapFree GetProcessHeap InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA TlsAlloc TlsGetValue TlsSetValue

user32

UnregisterClassW GetDesktopWindow SetWindowPos CreateWindowExW MapWindowPoints ClientToScreen ReleaseDC GetDC DestroyWindow CallWindowProcW DefWindowProcW MoveWindow GetWindowRect ShowWindow GetNextDlgTabItem GetFocus GetWindow GetClientRect GetParent DialogBoxParamW GetActiveWindow MessageBoxW EndDialog GetWindowTextW GetWindowTextLengthW SetFocus EnableWindow GetDlgItem SetWindowTextW GetWindowLongW SetWindowLongW SendMessageW

gdi32

SelectObject GetTextExtentPoint32W

advapi32

CheckTokenMembership FreeSid AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

SHGetFolderPathW ShellExecuteW ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHFileOperationW

ole32

CoTaskMemFree

Sharing

General

Malware Config

Signatures

File Explorer

04837f20769b11f95da24ebd48c991fefbd1374a79685f3ceb2f8b7cef1635df

PE Signature issue

uxtheme

kernel32

user32

gdi32

advapi32

shell32

ole32

generic