475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57

Sharing

Copy URL Twitter E-mail

General

Target
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57
Size 2.9MB
Sample220210-dfvpyscgak
SHA256 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57
MD5 d54474edd997f5ae1772d45974bd7005
SHA1 1c6dd6518d61df04fe42b4280cbe1c0e62bb352b
SHA512 e9f187eebdbef0c0b38d01c163c827ed6e6e5fcbe355ac50cded01521425a558f3d090c8b6d1039c760c623ca20432fe830d647428188428761e4b3a75d067f9
SSDEEP 49152:ytmHL78O9qwSwtP0ffba5C0oP+rq2lHpkuubzjlS5VaZ24NSKC9AXIfiRmdqBQB3:CmHAW5nUZSzalPC9AH6d
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57

.exe 2.9MB

475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57

IMPHASH c69b279d5c75a660c6b0f4c0b8c5a57a
SHA256 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57
MD5 d54474edd997f5ae1772d45974bd7005
SHA1 1c6dd6518d61df04fe42b4280cbe1c0e62bb352b
SHA512 e9f187eebdbef0c0b38d01c163c827ed6e6e5fcbe355ac50cded01521425a558f3d090c8b6d1039c760c623ca20432fe830d647428188428761e4b3a75d067f9
SSDEEP 49152:ytmHL78O9qwSwtP0ffba5C0oP+rq2lHpkuubzjlS5VaZ24NSKC9AXIfiRmdqBQB3:CmHAW5nUZSzalPC9AH6d
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

79:95:3d:57:24:69:e7:f2:23:3a:e8:ff:60:67:97:59:40:da:f8:91:c8:34:ea:6f:a9:61:a8:c0:59:25:4e:7e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

PE Signature issue

Digest

20:9e:cc:59:6d:7e:29:96:67:e6:57:b2:ca:2f:29:d3:e4:47:78:ce

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Subject

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29

Issuer

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 7666,CN=1&1 Mail & Media GmbH,O=1&1 Mail & Media GmbH,L=Montabaur,ST=Rheinland-Pfalz,C=DE,1.3.6.1.4.1.311.60.2.1.1=#13094d6f6e746162617572,1.3.6.1.4.1.311.60.2.1.2=#130f526865696e6c616e642d5066616c7a,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0e:db:38:18:5e:4b:e6:af:3e:73:da:e8:aa:92:55:d6

Issuer

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 24, 2021 - Jul 31, 2024

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29

Issuer

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:db:38:18:5e:4b:e6:af:3e:73:da:e8:aa:92:55:d6

Issuer

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 24, 2021 - Jul 31, 2024

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

1891566

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

QueryPerformanceCounter GetTickCount FlushFileBuffers CreateFileMappingW MapViewOfFile UnmapViewOfFile GetDriveTypeW GetTempFileNameW CreateDirectoryW ResetEvent GetCurrentThread VirtualProtect VirtualFree GetStdHandle VirtualAlloc FindClose GetConsoleMode WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetACP ExitProcess SetEnvironmentVariableA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList FreeLibraryAndExitThread GetThreadTimes UnregisterWait GetSystemTime SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SwitchToThread FormatMessageW CreateTimerQueue GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeExA GetUserDefaultLCID LCMapStringA InterlockedExchange GetLogicalProcessorInformation SetWaitableTimer CreateWaitableTimerA SystemTimeToFileTime ResumeThread ReleaseSemaphore WaitForMultipleObjectsEx OpenEventA MoveFileExW FindFirstFileW RemoveDirectoryW GetCurrentDirectoryW DeviceIoControl GetCPInfo LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc QueryPerformanceFrequency SetFilePointerEx GetFileAttributesExW FindNextFileW FindFirstFileExW GetExitCodeThread DuplicateHandle TryEnterCriticalSection GetStringTypeW ExpandEnvironmentStringsA GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx UnlockFile DeleteFileW DeleteFileA LoadLibraryA CreateFileA GetFileAttributesA RegisterWaitForSingleObject GetDiskFreeSpaceA GetTempPathA GetVersionExW GetTempPathW SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LockFile GetDiskFreeSpaceW InterlockedCompareExchange GetFullPathNameW AreFileApisANSI ReleaseMutex OpenMutexW CreateMutexW IsWow64Process WaitForMultipleObjects Process32NextW OpenProcess Process32FirstW CreateToolhelp32Snapshot TerminateProcess GetExitCodeProcess CreateProcessW LocalAlloc GetCurrentProcess WaitForSingleObjectEx GetCurrentProcessId GetCommandLineW DecodePointer OpenEventW LocalFree FormatMessageA GetFileSizeEx WideCharToMultiByte GlobalFree GlobalHandle CreateEventA lstrcmpW MulDiv RaiseException GetCurrentThreadId InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement MultiByteToWideChar OutputDebugStringA LoadLibraryW GetFileAttributesW GlobalFindAtomW GetModuleHandleA SetLastError GlobalUnlock GlobalLock GlobalAlloc GetModuleFileNameW LeaveCriticalSection EnterCriticalSection WaitForSingleObject CreateEventW SetEvent WriteFile CreateFileW CloseHandle ReadFile GetProcessHeap HeapAlloc HeapFree HeapReAlloc PeekNamedPipe GetFileType GetSystemDirectoryA SleepEx VerifyVersionInfoA VerSetConditionMask SearchPathW GetLocaleInfoW LoadLibraryExW GetUserDefaultUILanguage GetSystemDefaultUILanguage LoadLibraryExA IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetLastError Sleep GetVersion GetModuleHandleW GetProcAddress GlobalDeleteAtom GlobalAddAtomW SignalObjectAndWait

user32

GetWindowRect MapWindowPoints GetParent MonitorFromWindow ShowWindow GetDlgItem GetDC ReleaseDC LoadImageW SendMessageW SendDlgItemMessageW DestroyAcceleratorTable GetDesktopWindow InvalidateRect CallWindowProcW InvalidateRgn FillRect ReleaseCapture SetWindowTextW MessageBoxW SetCapture MoveWindow ScreenToClient ClientToScreen GetSystemMetrics UnregisterClassW SetWindowLongW DefWindowProcW RegisterClassExW GetClassInfoExW LoadCursorW GetClientRect CharNextW GetSysColor GetClassNameW SetFocus GetFocus IsChild EndPaint BeginPaint GetWindowTextW CopyRect GetWindowTextLengthW RegisterWindowMessageW EndDialog FindWindowW AdjustWindowRectEx GetMenu GetMonitorInfoW MonitorFromPoint SetWindowPos CreateDialogIndirectParamW GetMessageW TranslateMessage DispatchMessageW SetForegroundWindow PostMessageW CreateAcceleratorTableW IsDialogMessageW SwitchToThisWindow FindWindowExW MonitorFromRect GetForegroundWindow GetWindowThreadProcessId LockSetForegroundWindow PostQuitMessage GetCursorPos GetKeyState SetCursorPos LoadStringA CharUpperW KillTimer SetTimer FlashWindowEx GetWindowLongW CreateWindowExW MapDialogRect DestroyWindow MessageBeep IsWindow SetWindowContextHelpId GetWindow RedrawWindow AllowSetForegroundWindow DestroyIcon GetCapture WindowFromPoint WaitMessage PtInRect CharLowerBuffW GetClassNameA WaitForInputIdle ShowWindowAsync IsIconic GetAncestor EnumChildWindows UpdateWindow EnumWindows PeekMessageW LoadStringW PostThreadMessageW

gdi32

CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject BitBlt GetStockObject GetObjectW GetDeviceCaps DeleteDC

advapi32

RegCreateKeyExW RegSetValueExW CryptAcquireContextA CryptGetHashParam CryptImportKey RegOpenKeyExW RegQueryValueExW RegDeleteValueW CryptGenRandom CryptHashData CryptEncrypt CryptDecrypt OpenProcessToken GetTokenInformation QueryServiceStatus ControlService StartServiceW OpenServiceW OpenSCManagerW CloseServiceHandle GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo SetEntriesInAclW FreeSid AllocateAndInitializeSid GetSecurityInfo CryptDestroyHash CryptCreateHash CryptDestroyKey CryptDeriveKey CryptReleaseContext CryptAcquireContextW RegEnumKeyExW RegDeleteKeyW GetSidSubAuthority RegCloseKey

shell32

ShellExecuteW SHLoadInProc SHGetFolderPathW ord171 Shell_NotifyIconW ShellExecuteExW SHChangeNotify CommandLineToArgvW

ole32

CoAddRefServerProcess CoReleaseServerProcess OleInitialize CoInitializeEx CLSIDFromString CLSIDFromProgID CoGetClassObject CoCreateInstance CoUninitialize OleUninitialize CoTaskMemFree CoTaskMemAlloc CreateStreamOnHGlobal StringFromGUID2 OleLockRunning

oleaut32

SysStringByteLen SafeArrayGetVartype SafeArrayCopy VariantChangeType SafeArrayDestroy SafeArrayCreate SafeArrayGetUBound SysAllocStringByteLen SafeArrayUnlock SafeArrayLock SysAllocString SysFreeString SysStringLen OleCreateFontIndirect SafeArrayGetLBound DispCallFunc LoadRegTypeLi LoadTypeLi SysAllocStringLen VariantClear VarBstrCmp VariantInit

shlwapi

ord176 ord219 PathQuoteSpacesW UrlCreateFromPathW

uxtheme

IsAppThemed

winmm

PlaySoundW

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

wininet

InternetCloseHandle InternetOpenW InternetConnectW HttpOpenRequestW HttpSendRequestW HttpQueryInfoW InternetReadFile InternetSetOptionW HttpAddRequestHeadersW

sensapi

IsNetworkAlive

dnsapi

DnsFree DnsQuery_W

ws2_32

gethostname htonl closesocket ntohl ioctlsocket sendto recvfrom accept freeaddrinfo getaddrinfo WSAIoctl socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind send recv WSASetLastError select __WSAFDIsSet WSAGetLastError WSACleanup WSAStartup listen

wldap32

ord46 ord143 ord211 ord60 ord50 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41

psapi

GetProcessImageFileNameW

oleacc

AccessibleChildren AccessibleObjectFromWindow

wintrust

WinVerifyTrust

crypt32

CryptQueryObject CryptHashCertificate CertFindCertificateInStore CryptMsgGetParam CertGetNameStringW CertFreeCertificateContext CryptMsgClose CertCloseStore

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

416KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

43KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ