e802ba75f63f64018ca2218a04e6a75baeca3e80f1f922db015b3f5973f2ca85

Sharing

Copy URL Twitter E-mail

General

Target
e802ba75f63f64018ca2218a04e6a75baeca3e80f1f922db015b3f5973f2ca85
Size 611KB
Sample220204-sjf4asbfdm
SHA256 e802ba75f63f64018ca2218a04e6a75baeca3e80f1f922db015b3f5973f2ca85
MD5 88f697dfdd735b4e426532660b1127b6
SHA1 bef6d81ac3065432719487ec1d86e27380614985
SHA512 e446760039bf38173fc7bde514b5da248698f83d7271d50eeea3709737e03b58ac522c2ef25cef27142a1c1b6cb767c0e06cc72fddc861a10b470c5fcc2ccc62
SSDEEP 12288:FTsor70Aeojgc4+o07OCi6HY7FpW0zm0pF:FTXjeojgc4+lDZY5pF
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

e802ba75f63f64018ca2218a04e6a75baeca3e80f1f922db015b3f5973f2ca85

.dll 611KB

e802ba75f63f64018ca2218a04e6a75baeca3e80f1f922db015b3f5973f2ca85

IMPHASH 01f87ec9e1e36146b71b7ffce4fd5fa9
SHA256 e802ba75f63f64018ca2218a04e6a75baeca3e80f1f922db015b3f5973f2ca85
MD5 88f697dfdd735b4e426532660b1127b6
SHA1 bef6d81ac3065432719487ec1d86e27380614985
SHA512 e446760039bf38173fc7bde514b5da248698f83d7271d50eeea3709737e03b58ac522c2ef25cef27142a1c1b6cb767c0e06cc72fddc861a10b470c5fcc2ccc62
SSDEEP 12288:FTsor70Aeojgc4+o07OCi6HY7FpW0zm0pF:FTXjeojgc4+lDZY5pF
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

PE Signature issue

Digest

c8:98:d7:37:b2:db:a3:92:55:8d:40:40:25:69:31:ee:e3:e4:27:eb

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=4koncepty bar s.r.o. ,OU=IT Dept.,O=4koncepty bar s.r.o. ,ST=Olomoucký kraj,C=CZ

Serial Number

fb:92:42:43:e1:af:04:45:83:dc:81:da:5d:93:f6:7c

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 1, 2022 - Feb 1, 2023

Minor OS version

Major OS version

Entry point

132996

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetThreadUILanguage AreFileApisANSI GetThreadErrorMode GetCurrentProcessorNumber GetCommandLineW GetTickCount IsSystemResumeAutomatic IsDebuggerPresent GetACP SwitchToThread GetLastError TlsAlloc GetCommandLineA UnregisterApplicationRestart FlushProcessWriteBuffers GetCurrentThreadId GetSystemDefaultUILanguage RaiseException InitializeCriticalSectionEx DeleteCriticalSection DecodePointer MultiByteToWideChar LoadResource SizeofResource FindResourceW GetModuleHandleW GetProcAddress LoadLibraryExW GetEnvironmentStringsW lstrcmpiW FreeLibrary WriteConsoleW CreateFileW ReadConsoleW SetStdHandle FreeEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers SetFilePointerEx GetFileSizeEx HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetStdHandle GetProcessHeap SetFileApisToOEM CloseHandle ReadFile FindClose GetTickCount64 GetModuleFileNameW LoadLibraryA HeapFree HeapReAlloc HeapAlloc GetModuleHandleExW ExitProcess InterlockedFlushSList RtlUnwindEx RtlPcToFileHeader OutputDebugStringW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW TlsFree TlsSetValue TlsGetValue InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte EncodePointer SetLastError

user32

IsProcessDPIAware GetForegroundWindow CreateMenu GetMenuCheckMarkDimensions CloseClipboard GetCapture GetKBCodePage GetMessageTime AnyPopup EmptyClipboard InSendMessage GetMessageExtraInfo GetClipboardSequenceNumber GetFocus SetCursor LoadCursorW CharNextW GetActiveWindow GetOpenClipboardWindow

advapi32

RegSetValueExW RegEnumKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegQueryInfoKeyW

ole32

CoTaskMemFree CoCreateInstance CoTaskMemAlloc CoFreeUnusedLibraries CoTaskMemRealloc

oleaut32

VarUI4FromStr

wininet

InternetQueryDataAvailable

Name

.text

Size

256KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

225KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gehcont

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ