392d74f5a99301c537b4e843e8c9d66e[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

392d74f5a99301c537b4e843e8c9d66e.exe
Size

1.7MB
MD5

392d74f5a99301c537b4e843e8c9d66e
SHA1

5dd51ccefc6f45fe3fc5e26b4986227a70749e1e
SHA256

006c93dbcc3938755328928bf3d8e94684de290fe3bf0cbfacdf0448ed0b96ed
SHA512

d46e68007fd624624e1b8b8540d5d1f071e29100a7b2bd872f76d4979b5003eee92f0543ee86e2145ce6d5208e22f73cf47e1b6659d1818a6690bc773112556e
SSDEEP

24576:YFzZUezXpkyKbO1zcrSGv/fSx/w9R5JiaUsuwfArXCsqm7q5y03+clm1SaCanwm5:6ZUmpIypcOGXfS6NwpSArhuaAhanwf

Score

N/A

Malware Config

Signatures

Files

392d74f5a99301c537b4e843e8c9d66e.exe
.exe windows x86

69e030207ea80bf8d3d586a5d49aecc2

Code Sign

05:bf:a8:d4:92:ee:ef:a8:05:1c:29:94:5a:12:d7:12
Certificate

Issuer

CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US

Not Before

02-05-2022 00:00

Not After

31-01-2023 23:59

Subject

CN=*.global.com,O=GLOBAL MEDIA GROUP SERVICES LIMITED,L=London,C=GB

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:5e:3e:5c:97:17:ca:c1:81:e3:1e:cf:f9:39:da:41:99:8c:18:e2:c1:15:39:3c:f2:5d:ab:c4:3c:c8:d1:5c
Signer

Actual PE Digest

18:5e:3e:5c:97:17:ca:c1:81:e3:1e:cf:f9:39:da:41:99:8c:18:e2:c1:15:39:3c:f2:5d:ab:c4:3c:c8:d1:5c

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=*.global.com,O=GLOBAL MEDIA GROUP SERVICES LIMITED,L=London,C=GB

14-09-2022 09:15
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalAlloc
GetProcAddress
lstrcpyA
GetModuleHandleW
LoadLibraryW
GlobalFree
GetErrorMode
SetVolumeLabelW
GetSystemDirectoryA
GetPrivateProfileSectionW
LoadLibraryA
CreateDirectoryW
VerifyVersionInfoW
InterlockedDecrement
ZombifyActCtx
DeactivateActCtx
GetConsoleAliasesW
GetLargestConsoleWindowSize
GetFileAttributesA
GetDllDirectoryW
GetTickCount
GetFileSizeEx
GetVolumeInformationW
SetProcessWorkingSetSize
GetProfileStringW
WaitNamedPipeW
GetFileBandwidthReservation
InterlockedIncrement
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
ExitProcess
GetLastError
WriteFile
GetStdHandle
GetModuleFileNameA
HeapFree
CloseHandle
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
MultiByteToWideChar
ReadFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
RtlUnwind
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile
GetProcessHeap

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bobr
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lbobr
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mbobr
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69e030207ea80bf8d3d586a5d49aecc2

Code Sign

05:bf:a8:d4:92:ee:ef:a8:05:1c:29:94:5a:12:d7:12Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

18:5e:3e:5c:97:17:ca:c1:81:e3:1e:cf:f9:39:da:41:99:8c:18:e2:c1:15:39:3c:f2:5d:ab:c4:3c:c8:d1:5cSigner

Signature Validations

Verification

14-09-2022 09:15 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.data Size: 4KB - Virtual size: 12KB

.bobr Size: 512B - Virtual size: 4B

.lbobr Size: 512B - Virtual size: 4B

.mbobr Size: 512B - Virtual size: 4B

.rsrc Size: 195KB - Virtual size: 195KB

.reloc Size: 8KB - Virtual size: 8KB

05:bf:a8:d4:92:ee:ef:a8:05:1c:29:94:5a:12:d7:12
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

18:5e:3e:5c:97:17:ca:c1:81:e3:1e:cf:f9:39:da:41:99:8c:18:e2:c1:15:39:3c:f2:5d:ab:c4:3c:c8:d1:5c
Signer

14-09-2022 09:15
Valid: false

.text
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 4KB - Virtual size: 12KB

.bobr
Size: 512B - Virtual size: 4B

.lbobr
Size: 512B - Virtual size: 4B

.mbobr
Size: 512B - Virtual size: 4B

.rsrc
Size: 195KB - Virtual size: 195KB

.reloc
Size: 8KB - Virtual size: 8KB