b9931966abd62c3f06f9072af2b74900fffb0c5305ca58a486fb9291f3d1f9f9

Sharing

Copy URL

Twitter E-mail

General

Target

b9931966abd62c3f06f9072af2b74900fffb0c5305ca58a486fb9291f3d1f9f9
Size

73KB
MD5

d4b7c1a8597b37290ce836cdebdd1b1f
SHA1

621a3838729afc06e7f9d678e06f3a2ffb28cfdd
SHA256

b9931966abd62c3f06f9072af2b74900fffb0c5305ca58a486fb9291f3d1f9f9
SHA512

4273cb57fb01b841784a91fe03a050be59f62535e1f34df503f2f1677bce9677ae8367384882b9dabe06c992d1d953f005e70d0f0754533df15c8b70ae236f30
SSDEEP

768:W9NJK3qZRhxXHIQBsLL16BKc+bBQZ/UMc2q074e:QXzXol6cc+lQZMMc2574e

Score

N/A

Malware Config

Signatures

Files

b9931966abd62c3f06f9072af2b74900fffb0c5305ca58a486fb9291f3d1f9f9
.exe windows x86

d99e35e9d4559cb6df0e1eb507b928cc

Code Sign

6b:00:00:03:f4:e3:a6:7a:23:48:55:0c:33:00:00:00:00:03:f4
Certificate

Issuer

CN=Microsoft RSA TLS CA 01,O=Microsoft Corporation,C=US

Not Before

28-08-2020 22:17

Not After

28-08-2021 22:17

Subject

CN=www.microsoft.com,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

78:33:e2:3c:6d:53:f8:70:3e:15:73:d5:56:a1:62:17:d7:48:bd:98
Signer

Actual PE Digest

78:33:e2:3c:6d:53:f8:70:3e:15:73:d5:56:a1:62:17:d7:48:bd:98

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=www.microsoft.com,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

13-02-2022 02:30
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlGetNtVersionNumbers
strrchr
wcsncmp
wcstombs
_vsnwprintf
wcsstr
wcsrchr
NtQueryInformationProcess
RtlGetCurrentPeb
NtYieldExecution
vsprintf
mbstowcs
sprintf
_stricmp
_chkstk
memset
memcpy
_allrem
RtlUnwind

msvcrt

??3@YAXPAX@Z
free
??2@YAPAXI@Z
malloc

kernel32

GetTempPathW
SwitchToThread
ExpandEnvironmentStringsW
CreateThread
DeleteFileA
SetFileAttributesW
ResumeThread
WriteProcessMemory
LocalFree
DeleteFileW
GetWindowsDirectoryW
CloseHandle
GetFullPathNameW
ExitProcess
GetCommandLineW
GetComputerNameA
CreateFileA
GetFileSize
SetPriorityClass
FindFirstFileW
SetFilePointer
GetLocaleInfoA
MapViewOfFile
UnmapViewOfFile
GetDriveTypeW
FreeLibrary
HeapAlloc
SetUnhandledExceptionFilter
InterlockedIncrement
MoveFileExW
InterlockedDecrement
GetCurrentProcess
GetLogicalDriveStringsW
HeapFree
WaitForSingleObject
GetSystemDefaultLCID
OutputDebugStringW
GetTickCount
GetProcessHeap
FormatMessageA
WriteFile
InitializeCriticalSection
GetSystemDirectoryW
Sleep
CopyFileW
LeaveCriticalSection
HeapCreate
CreateProcessA
ReadFile
CreateFileW
SetThreadPriority
FlushFileBuffers
OutputDebugStringA
GetFileSizeEx
GetLastError
GetProcAddress
QueueUserAPC
MoveFileW
EnterCriticalSection
VirtualAllocEx
FindClose
GetLocalTime
LoadLibraryA
CreateFileMappingA
LocalAlloc
DeviceIoControl
WaitForMultipleObjects
GetModuleFileNameA
GetModuleHandleA
FindNextFileW
GetShortPathNameW

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

ws2_32

WSAStartup
connect
send
gethostbyname
closesocket
socket
htons

user32

MessageBoxA
wsprintfW

advapi32

GetUserNameA
RegSetValueExW
RegCloseKey
GetCurrentHwProfileW
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA

shell32

CommandLineToArgvW

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d99e35e9d4559cb6df0e1eb507b928cc

Code Sign

6b:00:00:03:f4:e3:a6:7a:23:48:55:0c:33:00:00:00:00:03:f4Certificate

78:33:e2:3c:6d:53:f8:70:3e:15:73:d5:56:a1:62:17:d7:48:bd:98Signer

Signature Validations

Verification

13-02-2022 02:30 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

msvcrt

kernel32

mpr

ws2_32

user32

advapi32

shell32

Sections

.text Size: 22KB - Virtual size: 21KB

.data Size: 8KB - Virtual size: 70KB

.tls Size: 512B - Virtual size: 12B

.reloc Size: 2KB - Virtual size: 2KB

6b:00:00:03:f4:e3:a6:7a:23:48:55:0c:33:00:00:00:00:03:f4
Certificate

78:33:e2:3c:6d:53:f8:70:3e:15:73:d5:56:a1:62:17:d7:48:bd:98
Signer

13-02-2022 02:30
Valid: false

.text
Size: 22KB - Virtual size: 21KB

.data
Size: 8KB - Virtual size: 70KB

.tls
Size: 512B - Virtual size: 12B

.reloc
Size: 2KB - Virtual size: 2KB