yXtXu5l4g6EN[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

yXtXu5l4g6EN.bin
Size

1.5MB
MD5

1ec40db3b42c7de30b16310f1eecd7da
SHA1

ace22f600dbb45fda9b36992e02c5456cac99352
SHA256

fe23ff2804527150aecf3dfeeeeb68f3900f557f3840983fc97249301f4d1beb
SHA512

9f7132120dd2e4ee041a84e114ea336b4d6e395290b1e77e9f9b1f80dbece91184245ea79a62bad87895aec10fb42d2ce2418f7cf8f89d610188e576a034edc9
SSDEEP

24576:yAHixHnD3finVbbBl2CJXpxEpcW5J4jqCJ4j2+GsHw/pQmcCzv0Btd97YcBr6A:yAk++CJXpGp95J4OCOj/jHqT0dNYcVb

Score

N/A

Malware Config

Signatures

Files

yXtXu5l4g6EN.bin
.exe windows x86

4ffff82c880cdfd21f30e85e4f551b1d

Code Sign

03:df:e6:ec:4d:d1:fa:c2:aa:d9:ba:b9:69:03:24:4c
Certificate

Issuer

CN=Encryption Everywhere DV TLS CA - G1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

27-07-2022 00:00

Not After

28-07-2023 23:59

Subject

CN=classics.net

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c3:c5:2c:69:aa:87:a2:fb:7f:5e:30:03:a8:31:1e:00:46:23:32:54:c7:0f:78:5a:36:d3:73:41:57:75:90:4b
Signer

Actual PE Digest

c3:c5:2c:69:aa:87:a2:fb:7f:5e:30:03:a8:31:1e:00:46:23:32:54:c7:0f:78:5a:36:d3:73:41:57:75:90:4b

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=classics.net

20-10-2022 13:36
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalAlloc
GetProcAddress
lstrcpyA
GetModuleHandleW
SetInformationJobObject
CreateHardLinkA
SetConsoleCursorInfo
GetConsoleTitleW
EnterCriticalSection
HeapWalk
GetStdHandle
SetDllDirectoryW
GetCurrentDirectoryW
VerifyVersionInfoW
SetCommMask
BuildCommDCBA
ExitThread
FreeLibrary
FreeConsole
MoveFileA
LoadLibraryA
GetProcessHeap
GetProcessTimes
GlobalUnfix
SetThreadAffinityMask
GetPrivateProfileIntA
GetConsoleAliasA
GetConsoleAliasesLengthW
Sleep
EnumDateFormatsExW
SetLastError
ExitProcess
GetCurrentThread
DeleteFileA
CreateFileA
GetTempFileNameA
GetTempPathA
DeleteFileW
GetLastError
GetProcessWorkingSetSize
GetCurrentProcess
RemoveDirectoryA
GetFileAttributesA
HeapAlloc
CloseHandle
GetStartupInfoW
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LeaveCriticalSection
DeleteCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
GetExitCodeProcess
WaitForSingleObject
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetStdHandle
FlushFileBuffers
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

GetMenu
MessageBeep
GetTabbedTextExtentW
GetActiveWindow

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ffff82c880cdfd21f30e85e4f551b1d

Code Sign

03:df:e6:ec:4d:d1:fa:c2:aa:d9:ba:b9:69:03:24:4cCertificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

c3:c5:2c:69:aa:87:a2:fb:7f:5e:30:03:a8:31:1e:00:46:23:32:54:c7:0f:78:5a:36:d3:73:41:57:75:90:4bSigner

Signature Validations

Verification

20-10-2022 13:36 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 8KB - Virtual size: 7KB

03:df:e6:ec:4d:d1:fa:c2:aa:d9:ba:b9:69:03:24:4c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

c3:c5:2c:69:aa:87:a2:fb:7f:5e:30:03:a8:31:1e:00:46:23:32:54:c7:0f:78:5a:36:d3:73:41:57:75:90:4b
Signer

20-10-2022 13:36
Valid: false

.text
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 8KB - Virtual size: 7KB