install_flash_player[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
install_flash_player.exe
Size 20.6MB
Sample261110-ftp3qszsft
SHA256 358e18ee59384ff0f9fb208e478b56a7a3b021e50103e9df535307821edc669f
MD5 51a0107eef0903d22534f72c41b70239
SHA1 fe2da642d943822b9e0b6ccec302367230a90835
SHA512 dd9382af4b9663531f38bd296818d9fba5c92fc16a497715904f7c9462cfcaa2928932855cdb289d8d07a17e2d2b64bd7085dda847fb2f33351cd65865f6641c
SSDEEP 393216:/FALWw+/VAXgW/I7CVh0ma6Bq/5epZVmTkbwzGKYT2s/DzRq0Ifv7iEBTqlcdJtd:/iKp/V/W/I7OB1AA4pYT7/hV+GNcd1sK
TLSH
T1FF273302A3F5AEA1D4A239F8456367D407B93F6A0D3B81AD5FC77D4DD834A434A382E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

install_flash_player.exe

.exe 20.6MB

install_flash_player.exe

IMPHASH c1be9c728b397b56da39d1bd446310a2
SHA256 358e18ee59384ff0f9fb208e478b56a7a3b021e50103e9df535307821edc669f
MD5 51a0107eef0903d22534f72c41b70239
SHA1 fe2da642d943822b9e0b6ccec302367230a90835
SHA512 dd9382af4b9663531f38bd296818d9fba5c92fc16a497715904f7c9462cfcaa2928932855cdb289d8d07a17e2d2b64bd7085dda847fb2f33351cd65865f6641c
SSDEEP 393216:/FALWw+/VAXgW/I7CVh0ma6Bq/5epZVmTkbwzGKYT2s/DzRq0Ifv7iEBTqlcdJtd:/iKp/V/W/I7OB1AA4pYT7/hV+GNcd1sK
TLSH
T1FF273302A3F5AEA1D4A239F8456367D407B93F6A0D3B81AD5FC77D4DD834A434A382E1
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

2e:9a:42:6b:28:73:60:e9:ec:ff:99:2e:34:a2:68:9e:09:df:d7:7f:5d:d4:6c:0b:dc:85:f9:41:6d:f5:65:4a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 24, 2020

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

0d:2c:ac:cd:3e:9e:ec:06:73:84:10:ba:31:bf:65:95

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 31, 2019 - Feb 3, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

167051

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\r\ws\St_Make\code\build\win\int\Morphology.build\Release\Win32\Morpheme.pdb

kernel32

GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileExW GetVersionExA WideCharToMultiByte SetThreadLocale GetUserDefaultUILanguage CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateThread ExitThread QueueUserAPC ReleaseMutex GetFileSize ReadFile CreateWaitableTimerW SetWaitableTimer FreeResource LockResource TerminateProcess Sleep LoadResource SizeofResource WriteFile SetFilePointer FindResourceW GetThreadLocale CreateProcessW LoadLibraryA OutputDebugStringW FindResourceA GetSystemDirectoryA InterlockedIncrement InterlockedDecrement GlobalAddAtomW DecodePointer HeapReAlloc SetFileAttributesW FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA SetEndOfFile WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW GetACP GetStdHandle GetModuleFileNameA GetModuleHandleExW GetFileType GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx DuplicateHandle LoadLibraryExW TlsFree TlsSetValue TlsGetValue CreateFileW MultiByteToWideChar RemoveDirectoryW CreateDirectoryW SetDllDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW GetSystemWow64DirectoryW GetTempFileNameW GetSystemDirectoryW GetEnvironmentVariableW GetCommandLineW GetModuleHandleW GetModuleFileNameW LoadLibraryW CreateMutexW SystemTimeToFileTime GetSystemTime CloseHandle FindClose GetFileSizeEx WaitForSingleObject GetLastError GetExitCodeProcess ExitProcess GetCurrentProcessId GetCurrentProcess OpenProcess GetProcessHeap HeapFree HeapAlloc LocalFree LocalAlloc GetProcAddress FreeLibrary HeapSize TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError RaiseException EncodePointer RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter

user32

MessageBoxW GetForegroundWindow EndPaint LoadStringW DrawTextW SetRect ClientToScreen LoadCursorW GetWindow GetParent SetWindowLongW GetWindowLongW FillRect MapWindowPoints SetCursor GetWindowRect SetWindowPos SetWindowTextW GetPropW SetPropW InvalidateRect GetClientRect BeginPaint ReleaseDC GetDC SetForegroundWindow SetTimer ReleaseCapture SetCapture GetKeyState MoveWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW DispatchMessageW TranslateMessage GetMessageW

gdi32

SetTextColor SetBkMode GetTextExtentExPointW CreateFontA CreateDIBSection StretchBlt SelectObject DeleteObject DeleteDC CreateSolidBrush CreateCompatibleDC BitBlt CreateCompatibleBitmap

advapi32

RegSetValueExW RegQueryValueExW RegDeleteValueW OpenServiceW OpenSCManagerW ControlService CloseServiceHandle CryptHashData CryptGetHashParam CryptReleaseContext RegSetValueExA RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegEnumKeyExW RegCreateKeyExW RegCloseKey CheckTokenMembership FreeSid AllocateAndInitializeSid

shell32

ord680 CommandLineToArgvW SHFileOperationW ShellExecuteExW ShellExecuteW SHGetFolderPathW

ole32

CoInitializeEx StringFromGUID2 CoCreateGuid CoInitializeSecurity CoCreateInstance CoInitialize CoUninitialize

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

install_flash_player.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic