2a911a7b1a51a9add23a714c83f90a1014daeea27782576bf5361c9245a9aaf0

Sharing

Copy URL Twitter E-mail

General

Target

2a911a7b1a51a9add23a714c83f90a1014daeea27782576bf5361c9245a9aaf0
Size

26KB
MD5

9e2398e11b7d3c7277b4f65f07e09c03
SHA1

66013b991f978d4cb66c64cd9aa4497efd9d026d
SHA256

2a911a7b1a51a9add23a714c83f90a1014daeea27782576bf5361c9245a9aaf0
SHA512

89893165b02859ba5f70ca779c9e3d2582599abd45c1f65c4406897103c550bec39bbb316fd6351b5ea852b2edfafa5b9740d47f74a7f60f8a9d713519583a68
SSDEEP

384:5VPyleU3qcODiArh7KMbxN7uabnU737alhh4WWieZW3:5VPS136Rw8xpua473mlhhde

Score

N/A

Malware Config

Signatures

Files

2a911a7b1a51a9add23a714c83f90a1014daeea27782576bf5361c9245a9aaf0
.exe windows x86

8cc50a1693ffccf18b13e917790438b5

Code Sign

1f:94:ed:d6:61:61:a7:bb:49:21:58:0f:bc:15:8f:59
Certificate

Issuer

CN=235235623562

Not Before

23/02/2012, 07:47

Not After

31/12/2039, 23:59

Subject

CN=235235623562

Extended Key Usages

ExtKeyUsageCodeSigning

8d:d2:0b:7e:23:9f:2b:7e:11:95:65:3f:eb:a5:6c:93:12:02:d8:81
Signer

Actual PE Digest

8d:d2:0b:7e:23:9f:2b:7e:11:95:65:3f:eb:a5:6c:93:12:02:d8:81

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=235235623562

15/09/2022, 14:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapLock
HeapWalk
InterlockedIncrement
IsBadCodePtr
IsBadStringPtrW
IsDBCSLeadByteEx
LoadLibraryExA
LocalAlloc
LocalHandle
LocalUnlock
Module32FirstW
MoveFileW
MoveFileWithProgressW
OpenJobObjectW
PeekNamedPipe
PrepareTape
Process32Next
Process32NextW
PulseEvent
QueryDosDeviceA
QueryInformationJobObject
QueryPerformanceFrequency
QueueUserAPC
ReadConsoleInputW
ReadConsoleOutputAttribute
ReadConsoleOutputCharacterW
ReplaceFileA
ReplaceFileW
RequestWakeupLatency
ResetWriteWatch
RtlFillMemory
SetConsoleActiveScreenBuffer
HeapCreate
SetConsoleCtrlHandler
SetConsoleCursor
SetConsoleScreenBufferSize
SetConsoleTitleW
SetCurrentDirectoryW
SetDefaultCommConfigA
SetEnvironmentVariableA
SetEnvironmentVariableW
SetFilePointerEx
SetHandleInformation
SetInformationJobObject
SetLastError
SetLocaleInfoA
SetSystemTime
SleepEx
SuspendThread
Thread32First
Thread32Next
UnregisterWait
VirtualAlloc
VirtualFreeEx
WaitCommEvent
WriteConsoleInputA
WriteConsoleOutputAttribute
WriteConsoleOutputW
WriteFileGather
WritePrivateProfileSectionA
WritePrivateProfileSectionW
WriteProfileSectionW
_lcreat
_lread
Heap32ListNext
Heap32First
GlobalWire
GlobalMemoryStatusEx
GlobalFindAtomW
GetVolumeInformationW
GetVolumeInformationA
GetVersionExW
GetTimeFormatA
GetThreadTimes
GetSystemTime
GetSystemDirectoryA
GetSystemDefaultLangID
GetProcessVersion
GetPrivateProfileSectionNamesW
GetNamedPipeHandleStateA
GetModuleHandleW
GetLongPathNameW
GetFileType
GetFileSize
GetDiskFreeSpaceExA
GetDateFormatW
GetCurrentThread
GetCurrentProcess
GetConsoleTitleA
GetConsoleScreenBufferInfo
GetConsoleFontSize
GetModuleHandleA
GetComputerNameExA
GetCommandLineW
GetCommMask
GetCommConfig
FreeUserPhysicalPages
FreeLibraryAndExitThread
FreeEnvironmentStringsA
FormatMessageW
FoldStringW
FindVolumeMountPointClose
FindResourceA
FindNextVolumeA
FindFirstVolumeA
FindFirstFileW
FindCloseChangeNotification
FindClose
FindAtomA
FillConsoleOutputCharacterA
EnumTimeFormatsW
EnumTimeFormatsA
EnumSystemLocalesA
EnumResourceNamesW
EnumLanguageGroupLocalesW
EnumCalendarInfoExA
EnterCriticalSection
DuplicateHandle
DnsHostnameToComputerNameA
DeleteTimerQueueTimer
DeleteFiber
CreateProcessW
CreateMutexW
CreateJobObjectW
CopyFileExA
ConvertThreadToFiber
ConvertDefaultLocale
CancelDeviceWakeupRequest
BackupSeek
AddAtomW
GetProcAddress
SetConsoleCP

msvcrt

memset

advapi32

RegOpenKeyExW

oleaut32

VarDecFromUI1
VarDecFromUI4
VarDecInt
VarDecSu
VarDiv
VarFix
VarI1FromDec
VarI1FromDisp
VarI1FromI4
VarI1FromR8
VarI1FromStr
VarI2FromBool
VarI2FromCy
VarI2FromDate
VarI2FromDec
VarI2FromI4
VarI2FromR4
VarI4FromBool
VarI4FromDec
VarMul
VarNot
VarR4CmpR8
VarR4FromDec
VarR4FromDisp
VarR4FromI1
VarR4FromI4
VarR8FromDate
VarR8FromDisp
VarR8FromUI2
VarTokenizeFormatString
VarUI1FromBool
VarUI1FromDec
VarUI1FromI1
VarUI1FromI2
VarUI1FromStr
VarUI1FromUI2
VarUI2FromBool
VarUI2FromDisp
VarUI2FromR4
VarUI2FromUI4
VarUI4FromCy
VarUI4FromI4
VarUI4FromR8
VarUI4FromUI1
VarUI4FromUI2
VarUdateFromDate
VariantClear
VariantCopy
VariantCopyInd
VariantInit
VariantTimeToDosDateTime
VariantTimeToSystemTime
VarDecFromR8
VarDecFromI4
VarDecFromDate
VarDecDiv
VarDecCmpR8
VarDateFromUdate
VarDateFromI2
VarDateFromI1
VarDateFromDec
VarCyMulI4
VarCyFromUI2
VarCyFromR4
VarCyFromI1
VarCyFromDisp
VarCyFromDate
VarCyFromBool
VarBstrFromR8
VarBstrFromR4
VarBstrFromI1
VarBstrFromDec
VarBstrFromBool
VarBstrCat
VarBoolFromUI2
VarBoolFromR8
VarBoolFromR4
VarBoolFromI2
VarBoolFromDec
VarBoolFromCy
VarAnd
VarAdd
VarAbs
VARIANT_UserFree
SysStringByteLen
SafeArraySetRecordInfo
SafeArraySetIID
SafeArrayPutElement
SafeArrayLock
SafeArrayGetUBound
SafeArrayGetRecordInfo
SafeArrayGetElemsize
SafeArrayDestroy
SafeArrayCreateVector
SafeArrayCopy
SafeArrayAccessData
RegisterTypeLi
OleTranslateColor
OleSavePictureFile
OleLoadPictureEx
OleCreatePropertyFrameIndirect
LoadTypeLi
LoadRegTypeLi
LPSAFEARRAY_UserSize
LHashValOfNameSysA
GetRecordInfoFromTypeInfo
GetErrorInfo
GetActiveObject
DosDateTimeToVariantTime
DispInvoke
DispGetParam
DispGetIDsOfNames
CreateDispTypeInfo
BSTR_UserUnmarshal
BSTR_UserSize
SafeArrayDestroyData

imm32

ImmConfigureIMEA
ImmConfigureIMEW
ImmCreateContext
ImmCreateIMCC
ImmDestroyContext
ImmDestroyIMCC
ImmDestroySoftKeyboard
ImmDisableIME
ImmEnumRegisterWordA
ImmEnumRegisterWordW
ImmEscapeA
ImmEscapeW
ImmGenerateMessage
ImmGetCandidateListA
ImmGetCandidateListCountA
ImmGetCandidateListW
ImmGetCandidateWindow
ImmGetCompositionFontW
ImmGetCompositionStringA
ImmGetCompositionWindow
ImmGetConversionStatus
ImmGetDefaultIMEWnd
ImmGetDescriptionA
ImmGetDescriptionW
ImmGetGuideLineA
ImmGetGuideLineW
ImmGetHotKey
ImmGetIMCCSize
ImmGetIMEFileNameA
ImmGetIMEFileNameW
ImmAssociateContextEx
ImmGetImeMenuItemsW
ImmGetOpenStatus
ImmGetProperty
ImmGetRegisterWordStyleW
ImmGetStatusWindowPos
ImmGetVirtualKey
ImmInstallIMEA
ImmInstallIMEW
ImmIsIME
ImmIsUIMessageW
ImmLockIMC
ImmLockIMCC
ImmNotifyIME
ImmRegisterWordA
ImmReleaseContext
ImmRequestMessageA
ImmRequestMessageW
ImmSetCandidateWindow
ImmSetCompositionFontA
ImmSetCompositionFontW
ImmSetCompositionStringA
ImmSetCompositionStringW
ImmSetConversionStatus
ImmSetHotKey
ImmSetOpenStatus
ImmSetStatusWindowPos
ImmShowSoftKeyboard
ImmSimulateHotKey
ImmUnlockIMC
ImmUnlockIMCC
ImmGetImeMenuItemsA
ImmUnregisterWordA
ImmUnregisterWordW
ImmAssociateContext

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text1
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text2
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text4
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text3
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8cc50a1693ffccf18b13e917790438b5

Code Sign

1f:94:ed:d6:61:61:a7:bb:49:21:58:0f:bc:15:8f:59Certificate

Extended Key Usages

8d:d2:0b:7e:23:9f:2b:7e:11:95:65:3f:eb:a5:6c:93:12:02:d8:81Signer

Signature Validations

Verification

15/09/2022, 14:59 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

oleaut32

imm32

Sections

.text Size: 8KB - Virtual size: 8KB

.text1 Size: 2KB - Virtual size: 1KB

.text2 Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 152B

.text4 Size: 1024B - Virtual size: 1000B

.text3 Size: 1024B - Virtual size: 1000B

.rsrc Size: 3KB - Virtual size: 2KB

1f:94:ed:d6:61:61:a7:bb:49:21:58:0f:bc:15:8f:59
Certificate

8d:d2:0b:7e:23:9f:2b:7e:11:95:65:3f:eb:a5:6c:93:12:02:d8:81
Signer

15/09/2022, 14:59
Valid: false

.text
Size: 8KB - Virtual size: 8KB

.text1
Size: 2KB - Virtual size: 1KB

.text2
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 152B

.text4
Size: 1024B - Virtual size: 1000B

.text3
Size: 1024B - Virtual size: 1000B

.rsrc
Size: 3KB - Virtual size: 2KB