f3f5ae787b645769869ad60164bce86dcbd609d3b8ce8585e1b9e8a27b3a76bd

Sharing

Copy URL Twitter E-mail

General

Target

f3f5ae787b645769869ad60164bce86dcbd609d3b8ce8585e1b9e8a27b3a76bd
Size

1.7MB
MD5

6a43144739156b1edb6fb29a53b97aa7
SHA1

1fac7481ed34707184926b4c49aff050a154cc26
SHA256

f3f5ae787b645769869ad60164bce86dcbd609d3b8ce8585e1b9e8a27b3a76bd
SHA512

a310b35788f7ec3fff7ee2e7c2db3b9dead1e780b4e4ce62d4f0ce03ab4e8c4981828fca156d107f45f59b48d4865c319659357f07eda83b71cbf64ddb3a4ef0
SSDEEP

24576:02eJ419CoCAjP9+MRUOj7AilkD3alSlpawSntZORol9POBLwbKcqc5RV7Xcog3Vj:2YdPgecilkD7ywSnWRovIiJPMVNPGmv

Score

N/A

Malware Config

Signatures

Files

f3f5ae787b645769869ad60164bce86dcbd609d3b8ce8585e1b9e8a27b3a76bd
.exe windows x86

1b7388d593285d5b049b57d84dc41b81

Code Sign

31:09:a6:4f:d7:e1:75:b9:45:c2:70:8d:a7:e7:27:58
Certificate

Issuer

CN=www.well-off.com

Not Before

07/10/2022, 23:39

Not After

07/10/2023, 23:59

Subject

CN=www.well-off.com

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9e:43:51:7d:48:74:d4:77:26:ec:3d:f7:3b:d2:12:d5:7b:e1:fd:5f:ce:2e:45:f9:a8:d6:d5:d1:f1:ea:3c:db
Signer

Actual PE Digest

9e:43:51:7d:48:74:d4:77:26:ec:3d:f7:3b:d2:12:d5:7b:e1:fd:5f:ce:2e:45:f9:a8:d6:d5:d1:f1:ea:3c:db

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=www.well-off.com

06/10/2022, 18:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetProcessHeaps
Sleep
SwitchToThread
CreateThread
GetCurrentThreadId
SuspendThread
GetStartupInfoW
VirtualQuery
GetModuleHandleW
GetProcAddress
GlobalAlloc
LocalFree
CloseHandle
_lopen
LoadLibraryA
MoveFileA
SetFileApisToOEM
AreFileApisANSI
BuildCommDCBW
GetMaximumProcessorCount
DisableThreadProfiling
GetSystemDefaultLocaleName
GetConsoleOriginalTitleW
ReadConsoleInputW
K32GetPerformanceInfo
ReadFile
SetEndOfFile
CreateFileW
GetFileSizeEx
GetFileAttributesExW
FormatMessageW
DeleteFileW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
RtlUnwind
GetCommandLineA
EncodePointer
DecodePointer
InterlockedDecrement
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
IsDebuggerPresent
InterlockedIncrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStdHandle
WriteFile
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
FlushFileBuffers
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetFileType
InitOnceExecuteOnce
GetModuleFileNameA
QueryPerformanceCounter
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
LoadLibraryExW
GetStringTypeW
OutputDebugStringW
LoadLibraryW
SetStdHandle
SetFilePointerEx
WriteConsoleW
RaiseException
HeapSize
HeapReAlloc
LCMapStringEx
ReadConsoleW

user32

ReleaseDC
GetPointerPenInfo
GetSysColorBrush

gdi32

DeleteDC
CreateDCW
GetFontUnicodeRanges

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.chap0
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b7388d593285d5b049b57d84dc41b81

Code Sign

31:09:a6:4f:d7:e1:75:b9:45:c2:70:8d:a7:e7:27:58Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

9e:43:51:7d:48:74:d4:77:26:ec:3d:f7:3b:d2:12:d5:7b:e1:fd:5f:ce:2e:45:f9:a8:d6:d5:d1:f1:ea:3c:dbSigner

Signature Validations

Verification

06/10/2022, 18:41 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.data Size: 4KB - Virtual size: 13KB

.chap0 Size: 3KB - Virtual size: 3KB

.rsrc Size: 15KB - Virtual size: 14KB

31:09:a6:4f:d7:e1:75:b9:45:c2:70:8d:a7:e7:27:58
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

9e:43:51:7d:48:74:d4:77:26:ec:3d:f7:3b:d2:12:d5:7b:e1:fd:5f:ce:2e:45:f9:a8:d6:d5:d1:f1:ea:3c:db
Signer

06/10/2022, 18:41
Valid: false

.text
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 4KB - Virtual size: 13KB

.chap0
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 15KB - Virtual size: 14KB