3d8a0d250db8d3601e812e6c6e38ba97e12b7c9e455cda1b6bc33371b9dd6c78

Sharing

Copy URL

Twitter E-mail

General

Target

3d8a0d250db8d3601e812e6c6e38ba97e12b7c9e455cda1b6bc33371b9dd6c78
Size

751KB
MD5

c81f71163fbe9c29bf34ad33e1678cad
SHA1

f49416d11f6b88cd918567f0a5edbab0376b03b6
SHA256

3d8a0d250db8d3601e812e6c6e38ba97e12b7c9e455cda1b6bc33371b9dd6c78
SHA512

710a776f0e74b97a94cdab4606f5d923034b2cdcf22be5beab6addd7a56d9d02a389fbf2d01c94aa1a78c0ae081dbfde1c792c579fe4f77c6f03830f28712d5c
SSDEEP

12288:SnHtg5wP8Fri36Uhi+jCccmSrFP/OCtUZ8DWhVb/1d/uB27GjadnLwVystPaP+KC:025VyjCccvrFP/O4Uey1a27Gm1sUFO5r

Score

N/A

Malware Config

Signatures

Files

3d8a0d250db8d3601e812e6c6e38ba97e12b7c9e455cda1b6bc33371b9dd6c78
.exe windows x86

c8cff309584c668192c2b6b5430f70aa

Code Sign

97:31:78:60:37:43:69:27:7f:93:ca:4a:d5:05:e4:48
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15-01-2021 00:00

Not After

15-01-2024 23:59

Subject

CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,POSTALCODE=1404,STREET=Goze Delchev\, bl261,L=Sofia,C=BG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:a7:6f:0f:51:6d:c1:83:e0:9f:e5:94:2e:b4:61:44:7f:98:ed:c1:b8:a9:a1:fb:0f:26:de:5d:99:90:94:39
Signer

Actual PE Digest

6f:a7:6f:0f:51:6d:c1:83:e0:9f:e5:94:2e:b4:61:44:7f:98:ed:c1:b8:a9:a1:fb:0f:26:de:5d:99:90:94:39

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,POSTALCODE=1404,STREET=Goze Delchev\, bl261,L=Sofia,C=BG

30-06-2022 15:36
Valid: true

Chain 1

CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,POSTALCODE=1404,STREET=Goze Delchev\, bl261,L=Sofia,C=BG

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Chain 2

CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,POSTALCODE=1404,STREET=Goze Delchev\, bl261,L=Sofia,C=BG

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

bcrypt

BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty

wininet

InternetQueryDataAvailable
HttpOpenRequestA
HttpQueryInfoW
InternetQueryOptionW
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetSetOptionW
InternetReadFile
HttpAddRequestHeadersA

shlwapi

PathFileExistsW

ws2_32

freeaddrinfo
WSACleanup
__WSAFDIsSet
accept
bind
closesocket
gethostbyname
select
shutdown
listen
getaddrinfo
WSAStartup
inet_addr
gethostbyaddr
send
socket
connect
WSAAddressToStringW
recv
htons

kernel32

GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
HeapFree
GetCurrentProcess
HeapAlloc
LocalFree
GetProcessHeap
MultiByteToWideChar
FormatMessageW
CreateDirectoryW
FindFirstFileW
EnterCriticalSection
FindNextFileW
lstrlenW
WriteFile
lstrcpynW
GetUserDefaultUILanguage
LeaveCriticalSection
InitializeCriticalSection
CreateMutexW
InitializeCriticalSectionEx
FindClose
GetLocaleInfoW
WaitForSingleObject
CreateFileW
GetVersionExW
SetFilePointerEx
GetLastError
GetCurrentThread
LoadLibraryA
DeleteFileW
CloseHandle
RaiseException
LoadLibraryW
CreateThread
DecodePointer
GetProcAddress
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetModuleHandleW
FreeLibrary
CopyFileW
WideCharToMultiByte
SetUnhandledExceptionFilter
GetExitCodeProcess
GetModuleFileNameA
SetLastError
OutputDebugStringA
GetEnvironmentVariableW
GetEnvironmentVariableA
GetFileAttributesW
SuspendThread
GetCurrentDirectoryA
ResumeThread
GetVersionExA
GetThreadContext
ReadProcessMemory
CreateEventExW
WaitForMultipleObjects
SetEvent
ResetEvent
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlUnwind
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetCPInfo
EncodePointer
GetStringTypeW
ReadFile
HeapReAlloc
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
GetFileSizeEx
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
HeapSize
WriteConsoleW
Sleep
SetEndOfFile

user32

LoadStringW
GetSubMenu
ShowWindow
IsWindow
GetAsyncKeyState
OffsetRect
DispatchMessageW
SetTimer
CopyRect
SwitchToThisWindow
SetMenuItemInfoW
GetWindowTextA
SetWindowPlacement
SetMenuInfo
SetWindowTextA
SendDlgItemMessageW
DialogBoxIndirectParamW
MoveWindow
SetMenu
IsDlgButtonChecked
UnhookWindowsHookEx
DestroyMenu
SetFocus
TranslateAcceleratorW
TranslateMessage
FindWindowW
SendMessageA
SetWindowsHookExW
CheckMenuItem
GetDlgItem
AppendMenuW
SetRect
KillTimer
PostQuitMessage
GetDesktopWindow
GetParent
DialogBoxParamW
UpdateWindow
SetForegroundWindow
LoadImageW
GetCursorPos
GetWindowLongW
GetMessageW
GetMenuItemInfoW
DefWindowProcW
ModifyMenuW
AdjustWindowRectEx
LoadMenuW
PostMessageW
BeginPaint
EndPaint
EnableWindow
GetWindowTextW
GetWindowRect
DestroyWindow
SetWindowPos
MessageBoxW
CreateWindowExW
SendMessageW
CallNextHookEx
EndDialog
SetWindowTextW
MessageBeep
RegisterClassExW
GetWindowPlacement
LoadAcceleratorsW
MessageBoxA
TrackPopupMenu
LoadCursorW

gdi32

GetStockObject
SetTextColor
SetBkMode
GetObjectW
DeleteObject
CreateFontIndirectW
CreateSolidBrush

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

GetUserNameA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
RegCreateKeyW
CryptGetHashParam
CryptReleaseContext
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCloseKey

shell32

SHBrowseForFolderW
SHFileOperationW
SHGetFolderPathW
Shell_NotifyIconW
ShellExecuteExW
SHGetPathFromIDListW
ShellExecuteW

ole32

CoTaskMemAlloc
CoInitializeEx
PropVariantClear
OleInitialize
CoUninitialize
OleUninitialize
CoTaskMemFree
CLSIDFromString
CoCreateInstance

oleaut32

VariantClear
VariantInit

version

GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoA

Sections

.text
Size: 483KB - Virtual size: 482KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8cff309584c668192c2b6b5430f70aa

Code Sign

97:31:78:60:37:43:69:27:7f:93:ca:4a:d5:05:e4:48Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

6f:a7:6f:0f:51:6d:c1:83:e0:9f:e5:94:2e:b4:61:44:7f:98:ed:c1:b8:a9:a1:fb:0f:26:de:5d:99:90:94:39Signer

Signature Validations

Verification

30-06-2022 15:36 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

wininet

shlwapi

ws2_32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

version

Sections

.text Size: 483KB - Virtual size: 482KB

.rdata Size: 174KB - Virtual size: 174KB

.data Size: 28KB - Virtual size: 35KB

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 34KB - Virtual size: 34KB

97:31:78:60:37:43:69:27:7f:93:ca:4a:d5:05:e4:48
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

6f:a7:6f:0f:51:6d:c1:83:e0:9f:e5:94:2e:b4:61:44:7f:98:ed:c1:b8:a9:a1:fb:0f:26:de:5d:99:90:94:39
Signer

30-06-2022 15:36
Valid: true

.text
Size: 483KB - Virtual size: 482KB

.rdata
Size: 174KB - Virtual size: 174KB

.data
Size: 28KB - Virtual size: 35KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 34KB - Virtual size: 34KB