cc566acb095ff9fa4f45063d3e5aa2a91ee7ce40875f2d32b1346a523a37fb83

Sharing

Copy URL Twitter E-mail

General

Target
cc566acb095ff9fa4f45063d3e5aa2a91ee7ce40875f2d32b1346a523a37fb83
Size 506KB
Sample261107-rssysacw6v
SHA256 cc566acb095ff9fa4f45063d3e5aa2a91ee7ce40875f2d32b1346a523a37fb83
MD5 8f930e5eaae4eb706d2cec4600deeaed
SHA1 7b33753083ccf895a55c4e7080570d4ae5a55901
SHA512 17a8c62c75af6fd358cd96c4c8700f0b1c0e3be342482a7a6b30ab68db31aaca09d0572592209d1ba8203b691d5df07c8c56fdfeeedeec443d9bc3f29050844b
SSDEEP 6144:EkF5kcdt1RE9X31zZsrjLQFEFM/4esnJcd9Cqodj4JfTySezdBkN93YWuWP7/:jF3dfRE99cLQFEF89Cquj4yd2G9G/
TLSH
T1F9B4F736A7B444A8E177B13889B34595D676FC45833186CF32903E5A3E33AD5F93A322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
cc566acb095ff9fa4f45063d3e5aa2a91ee7ce40875f2d32b1346a523a37fb83

File Explorer

cc566acb095ff9fa4f45063d3e5aa2a91ee7ce40875f2d32b1346a523a37fb83

.exe 506KB

cc566acb095ff9fa4f45063d3e5aa2a91ee7ce40875f2d32b1346a523a37fb83

IMPHASH 601987d22fb03dee80dd4ee711f86540
SHA256 cc566acb095ff9fa4f45063d3e5aa2a91ee7ce40875f2d32b1346a523a37fb83
MD5 8f930e5eaae4eb706d2cec4600deeaed
SHA1 7b33753083ccf895a55c4e7080570d4ae5a55901
SHA512 17a8c62c75af6fd358cd96c4c8700f0b1c0e3be342482a7a6b30ab68db31aaca09d0572592209d1ba8203b691d5df07c8c56fdfeeedeec443d9bc3f29050844b
SSDEEP 6144:EkF5kcdt1RE9X31zZsrjLQFEFM/4esnJcd9Cqodj4JfTySezdBkN93YWuWP7/:jF3dfRE99cLQFEF89Cquj4yd2G9G/
TLSH
T1F9B4F736A7B444A8E177B13889B34595D676FC45833186CF32903E5A3E33AD5F93A322
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

f9:3a:8b:75:76:f0:da:52:95:9f:d8:68:cd:0e:d5:ff:5e:16:34:38:39:81:2d:66:cd:8d:e5:7b:04:e1:97:12

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Premiere Pro\, AME\, After Effects\, Speedgrade,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jul 29, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

04:9f:34:69:b6:51:d0:9d:57:4e:a8:cc:ad:b1:2d:7b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 3, 2022 - May 1, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

527872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar GetCurrentProcessId OpenProcess QueryFullProcessImageNameW SetThreadUILanguage FindClose FindFirstFileW FindNextFileW FreeLibrary GetProcAddress LoadLibraryW SystemTimeToFileTime QueryPerformanceCounter QueryPerformanceFrequency GetTickCount64 InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitOnceExecuteOnce WideCharToMultiByte FindResourceExW DeleteFileW RemoveDirectoryW GetModuleFileNameW CloseHandle InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS WaitForSingleObject CreateThread GetThreadId GetModuleHandleA LoadLibraryA VirtualQuery LoadLibraryExW CreateToolhelp32Snapshot Module32FirstW Module32NextW GetModuleFileNameA GetCurrentProcess InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapAlloc HeapReAlloc HeapDestroy GetLastError RaiseException DecodePointer MulDiv CreateDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetModuleHandleW OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetSystemTime

user32

GetPropW SendMessageW DialogBoxIndirectParamW EndDialog GetDlgItem CheckDlgButton IsDlgButtonChecked GetDialogBaseUnits EnableWindow GetDC ReleaseDC SystemParametersInfoW CheckRadioButton GetSystemMetrics UnregisterClassW LoadStringW LoadCursorW GetParent SetWindowLongPtrW GetWindowLongPtrW DestroyIcon ClientToScreen SetCursor GetWindowRect RemovePropW PtInRect SetPropW InvalidateRect ReleaseCapture SetCapture GetCapture CallWindowProcW

gdi32

SetTextColor GetTextExtentPoint32W GetDeviceCaps DeleteObject CreateFontIndirectW GetObjectW

advapi32

RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenCurrentUser RegCloseKey RegGetValueA

shell32

ExtractIconW ShellExecuteW

dvacore

??0RegistryKey@utility@dvacore@@QEAA@XZ ?Create@RegistryKey@utility@dvacore@@QEAAHAEBW4RegistryRootKey@23@AEBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@@Z ?SetBooleanValue@RegistryKey@utility@dvacore@@QEAAHAEBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@_N@Z ??1RegistryKey@utility@dvacore@@QEAA@XZ ?StdToUTF8String@string@dvacore@@YA?AV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@PEBD@Z ?Recycle@MemoryRecycler@allocator@dvacore@@YAXPEAX_K@Z ?Allocate@MemoryRecycler@allocator@dvacore@@YAPEAX_KAEA_K@Z

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ _Mbrtowc _Strcoll _Strxfrm ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ??Bid@locale@std@@QEAA_KXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?uncaught_exception@std@@YA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ

shlwapi

PathRemoveFileSpecW PathAppendW PathFileExistsW

vcruntime140

__std_exception_copy __std_exception_destroy _CxxThrowException memcmp memcpy memmove __std_type_info_destroy_list __current_exception_context __current_exception __C_specific_handler strrchr strstr __std_type_info_compare memchr strchr __std_terminate memset

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initterm_e _invalid_parameter_noinfo_noreturn _initterm _errno _register_onexit_function _get_initial_narrow_environment _c_exit _initialize_onexit_table __p___argv _initialize_narrow_environment _register_thread_local_exe_atexit_callback __p___argc _configure_narrow_argv _seh_filter_dll _set_app_type _exit _seh_filter_exe _execute_onexit_table terminate _cexit _invalid_parameter_noinfo _crt_at_quick_exit _crt_atexit exit

api-ms-win-crt-convert-l1-1-0

strtol strtoll _strtod_l

api-ms-win-crt-stdio-l1-1-0

ferror fopen ungetc setvbuf fwrite _fseeki64 fsetpos fread fputc fgetpos fgetc fflush fclose _get_stream_buffer_pointers _close _wopen __stdio_common_vswprintf_s __stdio_common_vswprintf fseek ftell _locking __acrt_iob_func __stdio_common_vsprintf _wfopen feof __p__commode _set_fmode __stdio_common_vfprintf __stdio_common_vsscanf

api-ms-win-crt-heap-l1-1-0

_callnewh free realloc calloc _recalloc _set_new_mode malloc

api-ms-win-crt-string-l1-1-0

_wcsicmp _wcsdup tolower isalpha strcmp wmemcpy_s iswspace

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file _wstat64i32 _wfullpath

api-ms-win-crt-environment-l1-1-0

_wgetenv getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr _dclass

api-ms-win-crt-locale-l1-1-0

_create_locale _configthreadlocale

api-ms-win-crt-time-l1-1-0

strftime _mkgmtime64 _gmtime64

dbghelp

SymInitialize SymGetOptions SymSetOptions SymFromAddr

winhttp

WinHttpReceiveResponse WinHttpConnect WinHttpQueryHeaders WinHttpCloseHandle WinHttpSendRequest WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Name

.text

Size

278KB

Virtual Size

277KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

cc566acb095ff9fa4f45063d3e5aa2a91ee7ce40875f2d32b1346a523a37fb83

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

dvacore

msvcp140

shlwapi

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

dbghelp

winhttp

version

generic