ed3fdf0a8f3b85bd7d23df3d11c95eac24a3f5fb4a9d1f09a0432928a3d8a0d6

Sharing

Copy URL Twitter E-mail

General

Target

ed3fdf0a8f3b85bd7d23df3d11c95eac24a3f5fb4a9d1f09a0432928a3d8a0d6
Size

317KB
MD5

4b08bb5e9003c070c067cffd61a827d9
SHA1

8d9c18284f0622dfdd0b0f06e753c4a7bccff0a5
SHA256

ed3fdf0a8f3b85bd7d23df3d11c95eac24a3f5fb4a9d1f09a0432928a3d8a0d6
SHA512

68a0b01ca46ad8fbd40f5d3604639ed46537661907463710afe7c9c8136db61d563d51be081a893deb371f212d2eec244f28c3fdf3a8298975e56da8e3f0360a
SSDEEP

6144:5bryNIVkA/L9uQSLnHs1X6YGWO9uRiqUIhQhc81J0VA0aDOUoixAJK:9ryNKbSHsGhIDfA0aKUbxqK

Score

N/A

Malware Config

Signatures

Files

ed3fdf0a8f3b85bd7d23df3d11c95eac24a3f5fb4a9d1f09a0432928a3d8a0d6
.zip
Anyrecover-序號.zip
.zip
Anyrecover-序號.exe
.exe windows x86

7975754c8b06e624fba5c584d5a27b05

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29/10/2015, 11:30

Not After

09/06/2027, 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:94:71:bb:c0:a1:54:f9:50:fb:b9:7c:88:67:d0:43
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

05/10/2020, 22:00

Not After

05/10/2022, 22:00

Subject

CN=Vyacheslav Burlakov,O=Vyacheslav Burlakov,L=Togliatti,C=RU,1.2.840.113549.1.9.1=#0c19737570706f72744067726170686963726567696f6e2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

19/05/2021, 05:42

Not After

18/05/2032, 05:42

Subject

CN=Certum Timestamp 2021,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29/10/2015, 11:30

Not After

09/06/2027, 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:94:71:bb:c0:a1:54:f9:50:fb:b9:7c:88:67:d0:43
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

05/10/2020, 22:00

Not After

05/10/2022, 22:00

Subject

CN=Vyacheslav Burlakov,O=Vyacheslav Burlakov,L=Togliatti,C=RU,1.2.840.113549.1.9.1=#0c19737570706f72744067726170686963726567696f6e2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

19/05/2021, 05:42

Not After

18/05/2032, 05:42

Subject

CN=Certum Timestamp 2021,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:b4:8c:76:78:a9:1e:99:3c:95:45:31:72:fe:cb:4f:f3:ea:6b:a0:28:f8:0e:01:71:24:6b:0e:f3:3e:71:fa
Signer

Actual PE Digest

6d:b4:8c:76:78:a9:1e:99:3c:95:45:31:72:fe:cb:4f:f3:ea:6b:a0:28:f8:0e:01:71:24:6b:0e:f3:3e:71:fa

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Vyacheslav Burlakov,O=Vyacheslav Burlakov,L=Togliatti,C=RU,1.2.840.113549.1.9.1=#0c19737570706f72744067726170686963726567696f6e2e636f6d

06/10/2022, 18:35
Valid: false

27:de:68:0f:5f:0b:75:c8:3c:a7:45:11:e8:42:95:09:96:1d:cb:bb
Signer

Actual PE Digest

27:de:68:0f:5f:0b:75:c8:3c:a7:45:11:e8:42:95:09:96:1d:cb:bb

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Vyacheslav Burlakov,O=Vyacheslav Burlakov,L=Togliatti,C=RU,1.2.840.113549.1.9.1=#0c19737570706f72744067726170686963726567696f6e2e636f6d

06/10/2022, 18:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MoveFileExA
IsBadHugeReadPtr
SetEndOfFile
FindResourceExW
GetConsoleAliasExesLengthA
GetConsoleAliasA
InterlockedDecrement
HeapFree
SetComputerNameW
SetThreadExecutionState
GetSystemDefaultLCID
GetTickCount
EnumCalendarInfoExW
ConvertFiberToThread
WaitNamedPipeW
SetCommTimeouts
EnumResourceTypesA
GlobalAlloc
LoadLibraryW
ReadConsoleInputA
SetVolumeMountPointA
GetFileAttributesA
SetTimeZoneInformation
WriteConsoleW
GetGeoInfoA
GetBinaryTypeW
WritePrivateProfileStringW
GetCPInfoExW
TlsGetValue
GetLastError
GetProcAddress
VirtualAlloc
GlobalGetAtomNameA
SetFileAttributesA
LoadLibraryA
WriteConsoleA
LocalAlloc
DnsHostnameToComputerNameA
GetFileType
CreateEventW
AddAtomA
FoldStringA
FindNextFileA
SetConsoleCursorInfo
GetModuleHandleA
FindFirstChangeNotificationA
CreateMutexA
FindNextFileW
VirtualProtect
GetFileAttributesExW
SetFileShortNameA
GetVersion
SetFileValidData
LCMapStringW
IsBadStringPtrW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
HeapAlloc
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
DeleteCriticalSection
SetFilePointer
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc
ReadFile
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CloseHandle
CreateFileA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
GetProcessHeap
GetConsoleOutputCP

advapi32

DeregisterEventSource

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 212KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7975754c8b06e624fba5c584d5a27b05

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

0e:94:71:bb:c0:a1:54:f9:50:fb:b9:7c:88:67:d0:43Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

0e:94:71:bb:c0:a1:54:f9:50:fb:b9:7c:88:67:d0:43Certificate

Extended Key Usages

Key Usages

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

6d:b4:8c:76:78:a9:1e:99:3c:95:45:31:72:fe:cb:4f:f3:ea:6b:a0:28:f8:0e:01:71:24:6b:0e:f3:3e:71:faSigner

Signature Validations

Verification

06/10/2022, 18:35 Valid: false

27:de:68:0f:5f:0b:75:c8:3c:a7:45:11:e8:42:95:09:96:1d:cb:bbSigner

Signature Validations

Verification

06/10/2022, 18:35 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Sections

.text Size: 96KB - Virtual size: 96KB

.data Size: 212KB - Virtual size: 222KB

.rsrc Size: 88KB - Virtual size: 88KB

.reloc Size: 8KB - Virtual size: 7KB

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

0e:94:71:bb:c0:a1:54:f9:50:fb:b9:7c:88:67:d0:43
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

0e:94:71:bb:c0:a1:54:f9:50:fb:b9:7c:88:67:d0:43
Certificate

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

6d:b4:8c:76:78:a9:1e:99:3c:95:45:31:72:fe:cb:4f:f3:ea:6b:a0:28:f8:0e:01:71:24:6b:0e:f3:3e:71:fa
Signer

06/10/2022, 18:35
Valid: false

27:de:68:0f:5f:0b:75:c8:3c:a7:45:11:e8:42:95:09:96:1d:cb:bb
Signer

06/10/2022, 18:35
Valid: false

.text
Size: 96KB - Virtual size: 96KB

.data
Size: 212KB - Virtual size: 222KB

.rsrc
Size: 88KB - Virtual size: 88KB

.reloc
Size: 8KB - Virtual size: 7KB