Shellans[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Shellans.exe
Size

1.5MB
MD5

8d42417ef02e50249fb7f97fcbfbbb8b
SHA1

c27e85de8db2f634db44baee4273bbeeb152435c
SHA256

9103194d32a15ea9e8ede1c81960a5ba5d21213de55df52a6dac409f2e58bcfe
SHA512

a46fdc22d581f0241ff0dc058f16d54786e35f95fcb37b7efcb18b488cc5769956d94e35f1ac914cf17b11b7cb89b9c6ea583099acfbf42e5533d36a8aeb811f
SSDEEP

24576:j9D08Q8CltXYwQt+YNnCEfvxdqqlUNgOZ7zGYtDkW75S7qz6dva/k5RATa:B08ZatXxQt+4Zvx3lUNgO1zGYtglqedb

Score

N/A

Malware Config

Signatures

Files

Shellans.exe
.exe windows x64

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

60:56:27:08:9c:e6:58:cf:82:e4:8d:04
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

14/04/2021, 21:51

Not After

28/10/2023, 16:27

Subject

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:f6:ca:b6:4a:2e:2e:93:41:fe:20:2f:3f:70:9d:5a:c8:d5:da:c0:66:92:eb:54:23:96:08:f2:ee:a5:d6:d6
Signer

Actual PE Digest

e0:f6:ca:b6:4a:2e:2e:93:41:fe:20:2f:3f:70:9d:5a:c8:d5:da:c0:66:92:eb:54:23:96:08:f2:ee:a5:d6:d6

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=475036h,CN=Tonalio GmbH,O=Tonalio GmbH,STREET=Badner Strasse 8,L=Bad Voeslau,ST=Niederoesterreich,C=AT,1.2.840.113549.1.9.1=#0c106365727440746f6e616c696f2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130f5769656e6572204e65757374616474,1.3.6.1.4.1.311.60.2.1.2=#13114e69656465726f65737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

08/08/2021, 18:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

BB0
Size: - Virtual size: 4.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BB1
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 123KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

60:56:27:08:9c:e6:58:cf:82:e4:8d:04Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

e0:f6:ca:b6:4a:2e:2e:93:41:fe:20:2f:3f:70:9d:5a:c8:d5:da:c0:66:92:eb:54:23:96:08:f2:ee:a5:d6:d6Signer

Signature Validations

Verification

08/08/2021, 18:38 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

BB0 Size: - Virtual size: 4.0MB

BB1 Size: 1.4MB - Virtual size: 1.4MB

.rsrc Size: 123KB - Virtual size: 124KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

60:56:27:08:9c:e6:58:cf:82:e4:8d:04
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

e0:f6:ca:b6:4a:2e:2e:93:41:fe:20:2f:3f:70:9d:5a:c8:d5:da:c0:66:92:eb:54:23:96:08:f2:ee:a5:d6:d6
Signer

08/08/2021, 18:38
Valid: false

BB0
Size: - Virtual size: 4.0MB

BB1
Size: 1.4MB - Virtual size: 1.4MB

.rsrc
Size: 123KB - Virtual size: 124KB