48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1

Sharing

Copy URL

Twitter E-mail

General

Target

48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1
Size

797KB
MD5

4f035feeae93816049e986e757f04525
SHA1

f7727fe7d403a6e18c1a21a944613c202112ff92
SHA256

48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1
SHA512

9768e4f1163e7c31325c3f4a407d74cedaa19c9796525d3b03e82e94f1f89fffb3f43b0643d6a0b850fc36a37f1a0e74d7ee8e282bd430f5485cc1689e275a03
SSDEEP

12288:yfSss8octoIp0OB5OzuR6bwWGqfN22xYeEcpoCHwBhXh25Z:yfSsoct7zOzM7W9fN229EiBZ

Score

N/A

Malware Config

Signatures

Files

48d1ea76ce5d582d654507d1611b64fb21b72a603054e35556ba27a1a293a1f1
.exe windows x64

e6981a42fc7d4b9fb0d6a5980cf38926

Code Sign

97:31:78:60:37:43:69:27:7f:93:ca:4a:d5:05:e4:48
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15-01-2021 00:00

Not After

15-01-2024 23:59

Subject

CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,POSTALCODE=1404,STREET=Goze Delchev\, bl261,L=Sofia,C=BG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f2:db:70:a4:5a:1b:ef:16:ef:be:4d:58:24:39:aa:6c:a8:e2:ab:db:1e:e1:e0:50:7b:8d:c4:d7:03:7c:57:47
Signer

Actual PE Digest

f2:db:70:a4:5a:1b:ef:16:ef:be:4d:58:24:39:aa:6c:a8:e2:ab:db:1e:e1:e0:50:7b:8d:c4:d7:03:7c:57:47

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,POSTALCODE=1404,STREET=Goze Delchev\, bl261,L=Sofia,C=BG

13-07-2022 16:55
Valid: true

Chain 1

CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,POSTALCODE=1404,STREET=Goze Delchev\, bl261,L=Sofia,C=BG

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Chain 2

CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,POSTALCODE=1404,STREET=Goze Delchev\, bl261,L=Sofia,C=BG

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcrypt

BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty

wininet

InternetQueryDataAvailable
HttpOpenRequestA
HttpQueryInfoW
InternetQueryOptionW
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetSetOptionW
InternetReadFile
HttpAddRequestHeadersA

shlwapi

PathFileExistsW

ws2_32

freeaddrinfo
WSACleanup
__WSAFDIsSet
accept
bind
closesocket
gethostbyname
select
shutdown
listen
getaddrinfo
WSAStartup
inet_addr
gethostbyaddr
send
socket
connect
WSAAddressToStringW
recv
htons

kernel32

GetFileSizeEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
HeapFree
GetCurrentProcess
HeapAlloc
LocalFree
GetProcessHeap
MultiByteToWideChar
FormatMessageW
CreateDirectoryW
FindFirstFileW
EnterCriticalSection
FindNextFileW
lstrlenW
WriteFile
lstrcpynW
GetUserDefaultUILanguage
LeaveCriticalSection
InitializeCriticalSection
CreateMutexW
InitializeCriticalSectionEx
FindClose
GetLocaleInfoW
WaitForSingleObject
CreateFileW
GetVersionExW
Sleep
GetLastError
GetCurrentThread
GetFileType
DeleteFileW
CloseHandle
RaiseException
LoadLibraryW
CreateThread
DecodePointer
GetProcAddress
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetModuleHandleW
FreeLibrary
CopyFileW
WideCharToMultiByte
SetUnhandledExceptionFilter
GetExitCodeProcess
GetModuleFileNameA
SetLastError
RtlCaptureContext
OutputDebugStringA
GetEnvironmentVariableW
GetEnvironmentVariableA
GetFileAttributesW
SuspendThread
GetCurrentDirectoryA
ResumeThread
GetVersionExA
GetThreadContext
ReadProcessMemory
CreateEventExW
WaitForMultipleObjects
SetEvent
ResetEvent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlUnwindEx
RtlPcToFileHeader
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetCPInfo
GetStringTypeW
EncodePointer
ReadFile
HeapReAlloc
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointerEx
SetEnvironmentVariableW
SetStdHandle
HeapSize
WriteConsoleW
SetEndOfFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount

user32

RegisterClassExW
GetWindowPlacement
LoadAcceleratorsW
TrackPopupMenu
LoadStringW
GetSubMenu
ShowWindow
IsWindow
GetAsyncKeyState
OffsetRect
DispatchMessageW
SetTimer
CopyRect
SwitchToThisWindow
SetMenuItemInfoW
GetWindowTextA
SetWindowPlacement
SetMenuInfo
SetWindowTextA
SendDlgItemMessageW
DialogBoxIndirectParamW
MoveWindow
SetMenu
IsDlgButtonChecked
UnhookWindowsHookEx
DestroyMenu
SetFocus
TranslateAcceleratorW
FindWindowW
LoadCursorW
SendMessageA
SetWindowsHookExW
CheckMenuItem
GetDlgItem
AppendMenuW
SetRect
KillTimer
PostQuitMessage
GetDesktopWindow
GetParent
DialogBoxParamW
GetWindowLongW
GetMessageW
GetMenuItemInfoW
DefWindowProcW
UpdateWindow
SetForegroundWindow
LoadImageW
GetCursorPos
BeginPaint
EndPaint
EnableWindow
GetWindowTextW
ModifyMenuW
AdjustWindowRectEx
LoadMenuW
PostMessageW
GetWindowRect
DestroyWindow
SetWindowPos
MessageBoxW
CreateWindowExW
SendMessageW
CallNextHookEx
EndDialog
SetWindowTextW
MessageBoxA
MessageBeep
TranslateMessage

gdi32

GetStockObject
SetTextColor
SetBkMode
GetObjectW
DeleteObject
CreateFontIndirectW
CreateSolidBrush

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

GetUserNameA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
RegCreateKeyW
CryptGetHashParam
CryptReleaseContext
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCloseKey

shell32

SHGetFolderPathW
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
Shell_NotifyIconW
ShellExecuteExW
SHFileOperationW

ole32

CoTaskMemAlloc
CoInitializeEx
PropVariantClear
OleInitialize
CoUninitialize
OleUninitialize
CoTaskMemFree
CLSIDFromString
CoCreateInstance

oleaut32

VariantInit
VariantClear

version

GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoA

Sections

.text
Size: 518KB - Virtual size: 518KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 198KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6981a42fc7d4b9fb0d6a5980cf38926

Code Sign

97:31:78:60:37:43:69:27:7f:93:ca:4a:d5:05:e4:48Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

f2:db:70:a4:5a:1b:ef:16:ef:be:4d:58:24:39:aa:6c:a8:e2:ab:db:1e:e1:e0:50:7b:8d:c4:d7:03:7c:57:47Signer

Signature Validations

Verification

13-07-2022 16:55 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

wininet

shlwapi

ws2_32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

version

Sections

.text Size: 518KB - Virtual size: 518KB

.rdata Size: 198KB - Virtual size: 197KB

.data Size: 34KB - Virtual size: 45KB

.pdata Size: 14KB - Virtual size: 13KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 2KB - Virtual size: 2KB

97:31:78:60:37:43:69:27:7f:93:ca:4a:d5:05:e4:48
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

f2:db:70:a4:5a:1b:ef:16:ef:be:4d:58:24:39:aa:6c:a8:e2:ab:db:1e:e1:e0:50:7b:8d:c4:d7:03:7c:57:47
Signer

13-07-2022 16:55
Valid: true

.text
Size: 518KB - Virtual size: 518KB

.rdata
Size: 198KB - Virtual size: 197KB

.data
Size: 34KB - Virtual size: 45KB

.pdata
Size: 14KB - Virtual size: 13KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 2KB - Virtual size: 2KB