79d834bd54c1c3b21af0eb3f020ad27353404cc6c5700a95bf3a7471865ae51a

Sharing

Copy URL Twitter E-mail

General

Target

79d834bd54c1c3b21af0eb3f020ad27353404cc6c5700a95bf3a7471865ae51a
Size

22KB
MD5

2a4b0b9a614d6877f60bfa029b33c801
SHA1

1e0fc843c38f4274fc66cde24456151517b8f197
SHA256

79d834bd54c1c3b21af0eb3f020ad27353404cc6c5700a95bf3a7471865ae51a
SHA512

c3843d534484f606e57d1a7b00adf452202bb8f0d399ae5d5fc3920b60c5a42144ad2ffcefb9a0cd14a43ffe3122a62a80398056e37ee81beb5296a0f3c007e6
SSDEEP

384:ot0JrSevfFbQLBQ/UEOSOK7Skd1X69cqlEnERJK+Agxb2F2cqTA+9hoE+29cXcGh:ot2RkLBQ/UFShd1s7EnERxMFzqTt4I9u

Score

N/A

Malware Config

Signatures

Files

79d834bd54c1c3b21af0eb3f020ad27353404cc6c5700a95bf3a7471865ae51a
.rar
api-ms-win-service-private-l1-1-1.dll
.dll windows x86

Code Sign

33:00:00:03:3b:65:5f:ae:fa:db:75:e9:d6:00:00:00:00:03:3b
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9d:6d:5a:13:2d:69:ad:14:20:f9:4d:82:bf:66:08:e6:62:bc:6d:e4:57:f4:3b:bd:87:8e:69:16:c7:81:f3:01
Signer

Actual PE Digest

9d:6d:5a:13:2d:69:ad:14:20:f9:4d:82:bf:66:08:e6:62:bc:6d:e4:57:f4:3b:bd:87:8e:69:16:c7:81:f3:01

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

22/09/2022, 18:56
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

I_QueryTagInformation
I_ScBroadcastServiceControlMessage
I_ScIsSecurityProcess
I_ScPnPGetServiceName
I_ScQueryServiceConfig
I_ScRegisterDeviceNotification
I_ScRegisterPreshutdownRestart
I_ScRpcBindA
I_ScRpcBindW
I_ScSendPnPMessage
I_ScSendTSMessage
I_ScSetServiceBitsA
I_ScSetServiceBitsW
I_ScUnregisterDeviceNotification
I_ScValidatePnPService
SubscribeServiceChangeNotifications
UnsubscribeServiceChangeNotifications
WaitServiceState

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
api-ms-win-service-winsvc-l1-1-0.dll
.dll windows x86

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:a8:d7:f2:49:88:d7:9b:00:0f:d7:2d:d7:bf:14:18:e9:25:2d:33:26:e1:69:cf:7a:63:b9:b2:46:4a:85:cc
Signer

Actual PE Digest

a7:a8:d7:f2:49:88:d7:9b:00:0f:d7:2d:d7:bf:14:18:e9:25:2d:33:26:e1:69:cf:7a:63:b9:b2:46:4a:85:cc

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

22/09/2022, 18:56
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

ChangeServiceConfig2A
ChangeServiceConfigA
ControlService
ControlServiceExA
CreateServiceA
I_QueryTagInformation
I_ScBroadcastServiceControlMessage
I_ScIsSecurityProcess
I_ScPnPGetServiceName
I_ScQueryServiceConfig
I_ScRpcBindA
I_ScRpcBindW
I_ScSendPnPMessage
I_ScSendTSMessage
I_ScValidatePnPService
NotifyServiceStatusChangeA
OpenSCManagerA
OpenServiceA
QueryServiceConfig2A
QueryServiceConfigA
QueryServiceStatus
RegisterServiceCtrlHandlerA
RegisterServiceCtrlHandlerExA
RegisterServiceCtrlHandlerW
StartServiceA
StartServiceCtrlDispatcherA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
api-ms-win-shcore-stream-l1-1-0.dll
.dll windows x86

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8a:db:a7:fc:30:34:05:04:3b:98:3f:73:ef:cd:6c:bd:37:a8:92:ed:23:44:86:bd:1e:93:a2:c5:d2:11:9f:6d
Signer

Actual PE Digest

8a:db:a7:fc:30:34:05:04:3b:98:3f:73:ef:cd:6c:bd:37:a8:92:ed:23:44:86:bd:1e:93:a2:c5:d2:11:9f:6d

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

22/09/2022, 18:56
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

IStream_Copy
IStream_Read
IStream_ReadStr
IStream_Reset
IStream_Size
IStream_Write
IStream_WriteStr
SHCreateMemStream
SHCreateStreamOnFileA
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
SHOpenRegStream2A
SHOpenRegStream2W
SHOpenRegStreamA
SHOpenRegStreamW

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:03:3b:65:5f:ae:fa:db:75:e9:d6:00:00:00:00:03:3bCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

9d:6d:5a:13:2d:69:ad:14:20:f9:4d:82:bf:66:08:e6:62:bc:6d:e4:57:f4:3b:bd:87:8e:69:16:c7:81:f3:01Signer

Signature Validations

Verification

22/09/2022, 18:56 Valid: false

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.data Size: - Virtual size: 64B

.rsrc Size: 1024B - Virtual size: 1008B

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

a7:a8:d7:f2:49:88:d7:9b:00:0f:d7:2d:d7:bf:14:18:e9:25:2d:33:26:e1:69:cf:7a:63:b9:b2:46:4a:85:ccSigner

Signature Validations

Verification

22/09/2022, 18:56 Valid: false

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.data Size: - Virtual size: 64B

.rsrc Size: 1024B - Virtual size: 1008B

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

8a:db:a7:fc:30:34:05:04:3b:98:3f:73:ef:cd:6c:bd:37:a8:92:ed:23:44:86:bd:1e:93:a2:c5:d2:11:9f:6dSigner

Signature Validations

Verification

22/09/2022, 18:56 Valid: false

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.data Size: - Virtual size: 64B

.rsrc Size: 1024B - Virtual size: 1008B

33:00:00:03:3b:65:5f:ae:fa:db:75:e9:d6:00:00:00:00:03:3b
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

9d:6d:5a:13:2d:69:ad:14:20:f9:4d:82:bf:66:08:e6:62:bc:6d:e4:57:f4:3b:bd:87:8e:69:16:c7:81:f3:01
Signer

22/09/2022, 18:56
Valid: false

.text
Size: 2KB - Virtual size: 1KB

.data
Size: - Virtual size: 64B

.rsrc
Size: 1024B - Virtual size: 1008B

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

a7:a8:d7:f2:49:88:d7:9b:00:0f:d7:2d:d7:bf:14:18:e9:25:2d:33:26:e1:69:cf:7a:63:b9:b2:46:4a:85:cc
Signer

22/09/2022, 18:56
Valid: false

.text
Size: 2KB - Virtual size: 1KB

.data
Size: - Virtual size: 64B

.rsrc
Size: 1024B - Virtual size: 1008B

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

8a:db:a7:fc:30:34:05:04:3b:98:3f:73:ef:cd:6c:bd:37:a8:92:ed:23:44:86:bd:1e:93:a2:c5:d2:11:9f:6d
Signer

22/09/2022, 18:56
Valid: false

.text
Size: 1KB - Virtual size: 1KB

.data
Size: - Virtual size: 64B

.rsrc
Size: 1024B - Virtual size: 1008B