ceefd2f4cee9eca7730ab4509cc86040bc71837eedf9d73bf1a19b1cfbcbc5e8

Sharing

Copy URL Twitter E-mail

General

Target

ceefd2f4cee9eca7730ab4509cc86040bc71837eedf9d73bf1a19b1cfbcbc5e8
Size

383KB
MD5

aa881835e5e41b4ffadaa52b19bab926
SHA1

0bbc9ad89afc743eabb379cd4029a50f7d386c0a
SHA256

ceefd2f4cee9eca7730ab4509cc86040bc71837eedf9d73bf1a19b1cfbcbc5e8
SHA512

a6e7dc46d4442a1d4645d74421e2bba7a83dc5a8ef0f37cf0414f43cddd03070f086c75384da1e68fa5bcabf398af80fd22ec2cb42b0bdbd9de0bc464ab00ec4
SSDEEP

6144:6m5v5CRPVBanJWZbFTDxPZiaX6wNcfCijed9IzogtjmviobHXrZK3:6m5BMzanJWZZ2abNcfCije/IPRmvJb7U

Score

N/A

Malware Config

Signatures

Files

ceefd2f4cee9eca7730ab4509cc86040bc71837eedf9d73bf1a19b1cfbcbc5e8
.exe windows x86

92a4ae9feae97aa83dba7c3d3958c47a

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:32

Not After

01/09/2022, 18:32

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f7:b9:da:d2:0a:7b:26:36:a8:81:00:60:19:12:ff:9e:8c:cc:36:2a:9e:f7:0d:2f:d2:b5:5c:25:80:04:9a:a2
Signer

Actual PE Digest

f7:b9:da:d2:0a:7b:26:36:a8:81:00:60:19:12:ff:9e:8c:cc:36:2a:9e:f7:0d:2f:d2:b5:5c:25:80:04:9a:a2

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

03/10/2022, 12:43
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MsgWaitForMultipleObjects
PeekMessageA
TranslateMessage
IsWindowVisible
GetWindowTextW
GetWindowThreadProcessId
SendMessageA
EnumWindows
GetDesktopWindow
wsprintfA
GetSystemMetrics
GetDC
ReleaseDC
CallNextHookEx
CloseClipboard
GetForegroundWindow
GetWindowTextLengthW
GetKeyState
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
wsprintfW
DefWindowProcA
GetWindowTextLengthA
GetWindowTextA
RegisterClassExA
CreateWindowExA
DispatchMessageA
GetMessageA
GetClipboardData

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

kernel32

FlushFileBuffers
UnhandledExceptionFilter
VirtualQuery
GetSystemInfo
VirtualProtect
GetTimeZoneInformation
GetOEMCP
GetFullPathNameW
TlsGetValue
TlsSetValue
TlsFree
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
GetLocaleInfoA
GetACP
GetVersionExA
MultiByteToWideChar
RaiseException
GetLastError
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
CloseHandle
CreateThread
GetModuleFileNameA
LoadLibraryExA
FreeLibrary
CreateFileA
GetFileSize
ReadFile
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
FindFirstFileW
FindClose
GetLocalTime
Sleep
OpenProcess
GetCurrentProcessId
FreeEnvironmentStringsA
Process32FirstW
Module32FirstW
Process32NextW
FileTimeToSystemTime
GetFileInformationByHandle
SetFilePointer
CreateFileMappingA
MapViewOfFile
WriteFile
UnmapViewOfFile
SystemTimeToFileTime
GetTickCount
GetCurrentDirectoryA
LocalFileTimeToFileTime
GetFileAttributesA
CreateDirectoryA
SetFileTime
SetCurrentDirectoryA
DeleteFileA
SetFileAttributesA
GetCompressedFileSizeA
MoveFileA
GlobalLock
GlobalUnlock
FindNextFileW
GetDriveTypeA
GetVolumeInformationA
CreatePipe
CreateProcessA
CreateProcessW
CopyFileA
SetFileAttributesW
WinExec
DeleteFileW
MoveFileW
CopyFileExW
TerminateThread
ExpandEnvironmentStringsA
GetComputerNameA
CreateEventA
LocalFree
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetUnhandledExceptionFilter
EnumSystemLocalesA
GetUserDefaultLCID
IsValidLocale
IsValidCodePage
QueryPerformanceCounter
IsBadReadPtr
IsBadCodePtr
GetLocaleInfoW
SetStdHandle
GetCurrentDirectoryW
CreateFileW
SetEnvironmentVariableA
SetEndOfFile
GetFullPathNameA
CreateToolhelp32Snapshot
FindFirstFileA
HeapAlloc
HeapFree
GetCPInfo
GetCurrentThreadId
SetLastError
TlsAlloc
HeapSize
ExitProcess
TerminateProcess
GetCurrentProcess
FileTimeToLocalFileTime
GetDriveTypeW
GetTimeFormatA
GetDateFormatA
ExitThread
ResumeThread
CreateDirectoryW
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
CompareStringW
CompareStringA
HeapReAlloc
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
GetCommandLineA
GetStartupInfoA
GetSystemTimeAsFileTime
RemoveDirectoryW
InterlockedIncrement

gdi32

BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject

advapi32

DeleteService
CloseServiceHandle
StartServiceA
OpenServiceA
CreateServiceA
OpenSCManagerA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegQueryInfoKeyA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
StartServiceCtrlDispatcherA

shell32

ShellExecuteA
ShellExecuteW

ole32

CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

VariantChangeType
VariantClear
VariantInit
SysStringLen
SysAllocString
SysFreeString

shlwapi

StrCpyW
StrCmpW

wininet

DeleteUrlCacheEntry

ws2_32

inet_addr
gethostbyname
WSAGetLastError
WSAStartup
closesocket
send
recv
htons
getservbyname
htonl
inet_ntoa
ntohs
getservbyport
gethostbyaddr
socket
setsockopt
WSACleanup

gdiplus

GdipCloneImage
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipFree
GdipAlloc
GdipDisposeImage
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageRectI
GdiplusStartup
GdipSaveImageToFile
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0

Sections

.text
Size: 312KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92a4ae9feae97aa83dba7c3d3958c47a

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

f7:b9:da:d2:0a:7b:26:36:a8:81:00:60:19:12:ff:9e:8c:cc:36:2a:9e:f7:0d:2f:d2:b5:5c:25:80:04:9a:a2Signer

Signature Validations

Verification

03/10/2022, 12:43 Valid: false

Headers

File Characteristics

Imports

user32

psapi

kernel32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

ws2_32

gdiplus

Sections

.text Size: 312KB - Virtual size: 312KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 8KB - Virtual size: 46KB

.rsrc Size: 1KB - Virtual size: 1KB

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

f7:b9:da:d2:0a:7b:26:36:a8:81:00:60:19:12:ff:9e:8c:cc:36:2a:9e:f7:0d:2f:d2:b5:5c:25:80:04:9a:a2
Signer

03/10/2022, 12:43
Valid: false

.text
Size: 312KB - Virtual size: 312KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 8KB - Virtual size: 46KB

.rsrc
Size: 1KB - Virtual size: 1KB