3317bb0f6350fcafa46c50971b15f4904bfa1e7eca3ad1d01dfce96b6a3be699

Sharing

Copy URL Twitter E-mail

General

Target
3317bb0f6350fcafa46c50971b15f4904bfa1e7eca3ad1d01dfce96b6a3be699
Size 607KB
Sample220207-qezzhacea3
SHA256 3317bb0f6350fcafa46c50971b15f4904bfa1e7eca3ad1d01dfce96b6a3be699
MD5 974e849606f49bc265eb817ba3324231
SHA1 a085020631e4c3cc6110f5bf9845a55439daa075
SHA512 9bb0da9b58c78f6dc47477872f20329c558feb824214a51b7b6df0fe43d1fbc1c5b152941116913c315d56b64e45749c477e1acbf98147fbb2c08c27bcca3a19
SSDEEP 12288:FTsor70Aeojgc4+o07OCi6HY7FpW0zm0pF:FTXjeojgc4+lDZY5pF
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

3317bb0f6350fcafa46c50971b15f4904bfa1e7eca3ad1d01dfce96b6a3be699

.dll 607KB

3317bb0f6350fcafa46c50971b15f4904bfa1e7eca3ad1d01dfce96b6a3be699

IMPHASH 01f87ec9e1e36146b71b7ffce4fd5fa9
SHA256 3317bb0f6350fcafa46c50971b15f4904bfa1e7eca3ad1d01dfce96b6a3be699
MD5 974e849606f49bc265eb817ba3324231
SHA1 a085020631e4c3cc6110f5bf9845a55439daa075
SHA512 9bb0da9b58c78f6dc47477872f20329c558feb824214a51b7b6df0fe43d1fbc1c5b152941116913c315d56b64e45749c477e1acbf98147fbb2c08c27bcca3a19
SSDEEP 12288:FTsor70Aeojgc4+o07OCi6HY7FpW0zm0pF:FTXjeojgc4+lDZY5pF
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

PE Signature issue

Digest

08:6f:02:91:86:e2:9b:ec:f9:59:38:46:be:d2:b2:4b:b5:84:40:9a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=4koncepty bar s.r.o. ,OU=IT Dept.,O=4koncepty bar s.r.o. ,ST=Olomoucký kraj,C=CZ

Serial Number

fb:92:42:43:e1:af:04:45:83:dc:81:da:5d:93:f6:7c

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 1, 2022 - Feb 1, 2023

Minor OS version

Major OS version

Entry point

132996

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetThreadUILanguage AreFileApisANSI GetThreadErrorMode GetCurrentProcessorNumber GetCommandLineW GetTickCount IsSystemResumeAutomatic IsDebuggerPresent GetACP SwitchToThread GetLastError TlsAlloc GetCommandLineA UnregisterApplicationRestart FlushProcessWriteBuffers GetCurrentThreadId GetSystemDefaultUILanguage RaiseException InitializeCriticalSectionEx DeleteCriticalSection DecodePointer MultiByteToWideChar LoadResource SizeofResource FindResourceW GetModuleHandleW GetProcAddress LoadLibraryExW GetEnvironmentStringsW lstrcmpiW FreeLibrary WriteConsoleW CreateFileW ReadConsoleW SetStdHandle FreeEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers SetFilePointerEx GetFileSizeEx HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetStdHandle GetProcessHeap SetFileApisToOEM CloseHandle ReadFile FindClose GetTickCount64 GetModuleFileNameW LoadLibraryA HeapFree HeapReAlloc HeapAlloc GetModuleHandleExW ExitProcess InterlockedFlushSList RtlUnwindEx RtlPcToFileHeader OutputDebugStringW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW TlsFree TlsSetValue TlsGetValue InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte EncodePointer SetLastError

user32

IsProcessDPIAware GetForegroundWindow CreateMenu GetMenuCheckMarkDimensions CloseClipboard GetCapture GetKBCodePage GetMessageTime AnyPopup EmptyClipboard InSendMessage GetMessageExtraInfo GetClipboardSequenceNumber GetFocus SetCursor LoadCursorW CharNextW GetActiveWindow GetOpenClipboardWindow

advapi32

RegSetValueExW RegEnumKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegQueryInfoKeyW

ole32

CoTaskMemFree CoCreateInstance CoTaskMemAlloc CoFreeUnusedLibraries CoTaskMemRealloc

oleaut32

VarUI4FromStr

wininet

InternetQueryDataAvailable

Name

.text

Size

256KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

225KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gehcont

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ