1b09fe2663baafee1ee17274c69ab41c98c6bfa1fd606bf75a40fa2756ff0f32

Sharing

Copy URL Twitter E-mail

General

Target
1b09fe2663baafee1ee17274c69ab41c98c6bfa1fd606bf75a40fa2756ff0f32
Size 607KB
Sample220207-qezzhacea2
SHA256 1b09fe2663baafee1ee17274c69ab41c98c6bfa1fd606bf75a40fa2756ff0f32
MD5 81aa595d115704c5f23b5a2a261fce16
SHA1 11166c97518aefd34e14ba1f809d5b4ceb3c20b6
SHA512 845bd8a58243cae6843a807c2663bbdbb0b5f12a528f74dc2f30c252af5aaab4cb0bae55a9882e3fbe6b5354516c058f3fc2ef83f37f0ec7f37c7fd07d4e91bc
SSDEEP 12288:FTsor70Aeojgc4+o07OCi6HY7FpW0zm0pF:FTXjeojgc4+lDZY5pF
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

1b09fe2663baafee1ee17274c69ab41c98c6bfa1fd606bf75a40fa2756ff0f32

.dll 607KB

1b09fe2663baafee1ee17274c69ab41c98c6bfa1fd606bf75a40fa2756ff0f32

IMPHASH 01f87ec9e1e36146b71b7ffce4fd5fa9
SHA256 1b09fe2663baafee1ee17274c69ab41c98c6bfa1fd606bf75a40fa2756ff0f32
MD5 81aa595d115704c5f23b5a2a261fce16
SHA1 11166c97518aefd34e14ba1f809d5b4ceb3c20b6
SHA512 845bd8a58243cae6843a807c2663bbdbb0b5f12a528f74dc2f30c252af5aaab4cb0bae55a9882e3fbe6b5354516c058f3fc2ef83f37f0ec7f37c7fd07d4e91bc
SSDEEP 12288:FTsor70Aeojgc4+o07OCi6HY7FpW0zm0pF:FTXjeojgc4+lDZY5pF
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

PE Signature issue

Digest

66:3c:3c:2b:4d:8b:14:8a:d6:e5:07:b8:a7:5e:af:4c:df:57:40:54

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=4koncepty bar s.r.o. ,OU=IT Dept.,O=4koncepty bar s.r.o. ,ST=Olomoucký kraj,C=CZ

Serial Number

fb:92:42:43:e1:af:04:45:83:dc:81:da:5d:93:f6:7c

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 1, 2022 - Feb 1, 2023

Minor OS version

Major OS version

Entry point

132996

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetThreadUILanguage AreFileApisANSI GetThreadErrorMode GetCurrentProcessorNumber GetCommandLineW GetTickCount IsSystemResumeAutomatic IsDebuggerPresent GetACP SwitchToThread GetLastError TlsAlloc GetCommandLineA UnregisterApplicationRestart FlushProcessWriteBuffers GetCurrentThreadId GetSystemDefaultUILanguage RaiseException InitializeCriticalSectionEx DeleteCriticalSection DecodePointer MultiByteToWideChar LoadResource SizeofResource FindResourceW GetModuleHandleW GetProcAddress LoadLibraryExW GetEnvironmentStringsW lstrcmpiW FreeLibrary WriteConsoleW CreateFileW ReadConsoleW SetStdHandle FreeEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers SetFilePointerEx GetFileSizeEx HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetStdHandle GetProcessHeap SetFileApisToOEM CloseHandle ReadFile FindClose GetTickCount64 GetModuleFileNameW LoadLibraryA HeapFree HeapReAlloc HeapAlloc GetModuleHandleExW ExitProcess InterlockedFlushSList RtlUnwindEx RtlPcToFileHeader OutputDebugStringW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW TlsFree TlsSetValue TlsGetValue InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte EncodePointer SetLastError

user32

IsProcessDPIAware GetForegroundWindow CreateMenu GetMenuCheckMarkDimensions CloseClipboard GetCapture GetKBCodePage GetMessageTime AnyPopup EmptyClipboard InSendMessage GetMessageExtraInfo GetClipboardSequenceNumber GetFocus SetCursor LoadCursorW CharNextW GetActiveWindow GetOpenClipboardWindow

advapi32

RegSetValueExW RegEnumKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegQueryInfoKeyW

ole32

CoTaskMemFree CoCreateInstance CoTaskMemAlloc CoFreeUnusedLibraries CoTaskMemRealloc

oleaut32

VarUI4FromStr

wininet

InternetQueryDataAvailable

Name

.text

Size

256KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

225KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gehcont

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ