492ebfcedbaf4538da77117d75496395f70e8ac1becaf4c0cde93cc07de6b337

Sharing

Copy URL

Twitter E-mail

General

Target

492ebfcedbaf4538da77117d75496395f70e8ac1becaf4c0cde93cc07de6b337
Size

66KB
MD5

d923bd5e780810959661a7823a1b1d3c
SHA1

2aeaba004e51e4eab8ca0c529af5ba1e8cee7355
SHA256

492ebfcedbaf4538da77117d75496395f70e8ac1becaf4c0cde93cc07de6b337
SHA512

125f26647e03aaf58f651162e31943929a991d90b2ec9c3a112b7eb2b8b9e5c4164509ef122e69b3c0b3a74fa951885f7fd2f8d8463f1f69380c6190bb19cc8d
SSDEEP

768:XXvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5L7+PKgti:DeytM3alnawrRIwxVSHMweio3BQbQL

Score

N/A

Malware Config

Signatures

Files

492ebfcedbaf4538da77117d75496395f70e8ac1becaf4c0cde93cc07de6b337
.exe windows x86

ba2ce247fa49357770ce28f139e2f1ab

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2031 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:bc:41:9e:02:bb:1a:27:21:1a:fc:14:39:42:cc:6a
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-07-2018 00:00

Not After

11-08-2021 12:00

Subject

SERIALNUMBER=711524,CN=Advanced Micro Devices\, Inc.,OU=MS Interface EV Cert Token (Jim Rigopoulos),O=Advanced Micro Devices\, Inc.,L=Sunnyvale,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8d:7f:83:9b:18:2d:1f:e8:d9:90:38:16:b7:44:c3:52:f4:d8:83:e1
Signer

Actual PE Digest

8d:7f:83:9b:18:2d:1f:e8:d9:90:38:16:b7:44:c3:52:f4:d8:83:e1

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=711524,CN=Advanced Micro Devices\, Inc.,OU=MS Interface EV Cert Token (Jim Rigopoulos),O=Advanced Micro Devices\, Inc.,L=Sunnyvale,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

03-02-2020 18:47
Valid: true

Chain 1

SERIALNUMBER=711524,CN=Advanced Micro Devices\, Inc.,OU=MS Interface EV Cert Token (Jim Rigopoulos),O=Advanced Micro Devices\, Inc.,L=Sunnyvale,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointerEx
CloseHandle
lstrlenW
CreateFileW
HeapCreate
GetCurrentProcess
ExitProcess
CreateThread
GetCurrentThread
SetThreadPriority
WaitForMultipleObjects
Sleep
GetLogicalDrives
SetFilePointer
FindClose
lstrcmpiA
lstrcmpiW
lstrcpyA
ReadFile
lstrcatW
GetModuleFileNameW
CreateProcessW
GetEnvironmentVariableW
GetDriveTypeA
GetTempPathW
GetTempFileNameW
SetFileAttributesW
GetFileAttributesW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileExW
SetPriorityClass
MultiByteToWideChar
WideCharToMultiByte
CompareStringA
WriteFile
GetFileSizeEx
GetLastError
lstrlenA
GetProcessHeap
HeapFree
HeapReAlloc
lstrcpyW
HeapAlloc

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW

shell32

SHChangeNotify
ShellExecuteExW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathAddBackslashW

ntdll

_aulldiv
_alldiv
_allrem
_chkstk
RtlUnwind
NtQueryVirtualMemory

Sections

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ba2ce247fa49357770ce28f139e2f1ab

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77Certificate

Key Usages

07:bc:41:9e:02:bb:1a:27:21:1a:fc:14:39:42:cc:6aCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

8d:7f:83:9b:18:2d:1f:e8:d9:90:38:16:b7:44:c3:52:f4:d8:83:e1Signer

Signature Validations

Verification

03-02-2020 18:47 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

shlwapi

ntdll

Sections

.rdata Size: 48KB - Virtual size: 48KB

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

07:bc:41:9e:02:bb:1a:27:21:1a:fc:14:39:42:cc:6a
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

8d:7f:83:9b:18:2d:1f:e8:d9:90:38:16:b7:44:c3:52:f4:d8:83:e1
Signer

03-02-2020 18:47
Valid: true

.rdata
Size: 48KB - Virtual size: 48KB