796d821e9574f547da9919079b1a6ddf496b68b4256ccfe33b5ff1588753b53f

Sharing

Copy URL

Twitter E-mail

General

Target

796d821e9574f547da9919079b1a6ddf496b68b4256ccfe33b5ff1588753b53f
Size

344KB
MD5

fc63e8813cca45e82fdde362a2836794
SHA1

dabc3082c188a8a79c3656968bf3a8101497514c
SHA256

796d821e9574f547da9919079b1a6ddf496b68b4256ccfe33b5ff1588753b53f
SHA512

58855be8582728b7b7a06f1825076f5a6e6a03d30552d43f87512e7ebbd885d80b4c26b78a44a4863f50aa538848f41b6ea221ad5d558b0f64fbf680ef447930
SSDEEP

6144:owU6MqwajF6Ka8YDU4p5EpagBjjNOEpeXcsmoByobE6Qk1ANR:owZSah6Ka8YDd3YagB1OEpZnWv9+r

Score

N/A

Malware Config

Signatures

Files

796d821e9574f547da9919079b1a6ddf496b68b4256ccfe33b5ff1588753b53f
.exe windows x86

1c1b62d93421ba2a0a20edd5aea32f74

Code Sign

ae:6d:3c:02:69:ef:64:97:e1:43:79:c5:1a:85:07:ba
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

23/10/2021, 23:59

Subject

CN=VELES PROPERTIES LIMITED,O=VELES PROPERTIES LIMITED,POSTALCODE=W14 8TH,STREET=Crown House 72 Hammersmith Road,L=LONDON,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:2e:24:11:c9:47:5c:88:9d:1f:1f:2c:1d:64:57:7c:6a:60:bb:17:37:c4:55:1e:50:9a:31:43:f7:ca:f9:90
Signer

Actual PE Digest

69:2e:24:11:c9:47:5c:88:9d:1f:1f:2c:1d:64:57:7c:6a:60:bb:17:37:c4:55:1e:50:9a:31:43:f7:ca:f9:90

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=VELES PROPERTIES LIMITED,O=VELES PROPERTIES LIMITED,POSTALCODE=W14 8TH,STREET=Crown House 72 Hammersmith Road,L=LONDON,C=GB

26/04/2022, 14:07
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalMemoryStatus
SetThreadContext
WritePrivateProfileStructA
SetLocalTime
GetNumberOfConsoleInputEvents
FindResourceExW
GetNamedPipeHandleStateA
WaitForSingleObject
CancelWaitableTimer
SetComputerNameW
FreeEnvironmentStringsA
SetTapeParameters
TlsSetValue
GlobalAlloc
GetPrivateProfileIntA
GetConsoleMode
GetPrivateProfileStructW
GetSystemPowerStatus
SizeofResource
CreateSemaphoreA
VerifyVersionInfoA
GetBinaryTypeA
lstrcatA
ExitThread
lstrlenW
VirtualUnlock
DeactivateActCtx
ReleaseActCtx
SetCurrentDirectoryA
OpenMutexW
GetLastError
IsDBCSLeadByteEx
GetProcAddress
LoadLibraryA
BuildCommDCBAndTimeoutsW
GetProfileStringA
SetFileApisToANSI
AddAtomA
SetSystemTime
SetEnvironmentVariableA
SetConsoleCursorInfo
WaitCommEvent
ContinueDebugEvent
GetCurrentDirectoryA
CompareStringA
_lopen
CloseHandle
FindActCtxSectionStringW
LocalFree
GetSystemTime
lstrcpyW
GetTimeZoneInformation
IsValidLocale
GetCommandLineA
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
GetModuleHandleA
RaiseException
HeapSize
GetLocaleInfoW
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
CompareStringW

user32

GetListBoxInfo

Sections

.text
Size: 313KB - Virtual size: 313KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 334KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c1b62d93421ba2a0a20edd5aea32f74

Code Sign

ae:6d:3c:02:69:ef:64:97:e1:43:79:c5:1a:85:07:baCertificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

69:2e:24:11:c9:47:5c:88:9d:1f:1f:2c:1d:64:57:7c:6a:60:bb:17:37:c4:55:1e:50:9a:31:43:f7:ca:f9:90Signer

Signature Validations

Verification

26/04/2022, 14:07 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 313KB - Virtual size: 313KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 334KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 8KB - Virtual size: 8KB

ae:6d:3c:02:69:ef:64:97:e1:43:79:c5:1a:85:07:ba
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

69:2e:24:11:c9:47:5c:88:9d:1f:1f:2c:1d:64:57:7c:6a:60:bb:17:37:c4:55:1e:50:9a:31:43:f7:ca:f9:90
Signer

26/04/2022, 14:07
Valid: false

.text
Size: 313KB - Virtual size: 313KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 334KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 8KB - Virtual size: 8KB