a759a0ce34f5e18db5cfc3a67bf99eb9689f79fed9f9e64dea3bac072251e256

Sharing

Copy URL Twitter E-mail

General

Target

a759a0ce34f5e18db5cfc3a67bf99eb9689f79fed9f9e64dea3bac072251e256
Size

148KB
MD5

a2c6a9bc0b41136dc4d3cf482dbb1cf0
SHA1

2324d8ee6d1e74ad671263dda17431f9467a7385
SHA256

a759a0ce34f5e18db5cfc3a67bf99eb9689f79fed9f9e64dea3bac072251e256
SHA512

8f8a439501ee3c3e03fe50085c8628c5bd843714f2ba71a96ff22e92061e39b0322252151078945a7889594cdf55c669de9bf75a061f3d791e1a80496fbaada1
SSDEEP

1536:AlHhaW4vyIALBzL+W1tOKKDdne16+pkyhGRwHITtdKCpu81zy/1ejnyjtBwR3JQN:cB4vyzL+WvARne4J7t8CrHjnatE8jmj+

Score

N/A

Malware Config

Signatures

Files

a759a0ce34f5e18db5cfc3a67bf99eb9689f79fed9f9e64dea3bac072251e256
.dll regsvr32 windows x86

559781cb12d72f23396d3cf3ee9f6e6c

Code Sign

61:0b:bb:d8:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/04/2012, 20:55

Not After

09/07/2013, 20:55

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

18:b8:af:3e:58:97:b8:57:0d:fd:c9:b6:a3:12:1e:74:44:ec:be:6a:64:83:34:71:25:6d:ed:ac:a0:db:8d:51
Signer

Actual PE Digest

18:b8:af:3e:58:97:b8:57:0d:fd:c9:b6:a3:12:1e:74:44:ec:be:6a:64:83:34:71:25:6d:ed:ac:a0:db:8d:51

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

28/10/2022, 15:08
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_callnewh
wcschr
__CxxFrameHandler3
_ftol2
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnwprintf
wcsncmp
??1type_info@@UAE@XZ
time
_vsnprintf
wcsnlen
memcpy_s
memcpy
memset
_purecall
??3@YAXPAX@Z
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_CxxThrowException
memcmp

ntdll

RtlFreeAnsiString
RtlFreeHeap
RtlAllocateHeap
RtlImageNtHeader
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlUnicodeStringToAnsiString
RtlInitAnsiString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwTraceMessage

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-interlocked-l1-2-0

InterlockedExchange
InterlockedCompareExchange

api-ms-win-core-libraryloader-l1-1-1

DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
LoadStringW

api-ms-win-core-registry-l1-1-0

RegSetValueExA
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcess
OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
OpenThreadToken
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimeAsFileTime
GetTickCount

rpcrt4

NdrClientCall2
UuidCreate
RpcStringFreeW
UuidToStringW
I_RpcExceptionFilter

kernel32

IsThreadpoolTimerSet
RaiseFailFastException
RaiseException
LoadLibraryExA
LocaleNameToLCID
GetThreadLocale
GetSystemDefaultLCID
GetUserDefaultLCID
ResolveDelayLoadedAPI
DelayLoadFailureHook
RegOpenKeyExW
HeapReAlloc
CreateThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
SetThreadpoolTimer
CloseThreadpoolCleanupGroup
WaitForThreadpoolTimerCallbacks
CloseHandle
RegGetValueW
GetProcAddress
GetCurrentThread
TryEnterCriticalSection
LoadLibraryW
MultiByteToWideChar
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrlenW
lstrlenA

api-ms-win-security-base-l1-2-0

GetTokenInformation

Exports

Exports

CPAcquireContext
CPAcquireContextW
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

559781cb12d72f23396d3cf3ee9f6e6c

Code Sign

61:0b:bb:d8:00:00:00:00:00:05Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

18:b8:af:3e:58:97:b8:57:0d:fd:c9:b6:a3:12:1e:74:44:ec:be:6a:64:83:34:71:25:6d:ed:ac:a0:db:8d:51Signer

Signature Validations

Verification

28/10/2022, 15:08 Valid: false

Headers

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-libraryloader-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-0

rpcrt4

kernel32

api-ms-win-security-base-l1-2-0

Exports

Exports

Sections

.text Size: 105KB - Virtual size: 105KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 22KB - Virtual size: 21KB

.reloc Size: 6KB - Virtual size: 5KB

61:0b:bb:d8:00:00:00:00:00:05
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

18:b8:af:3e:58:97:b8:57:0d:fd:c9:b6:a3:12:1e:74:44:ec:be:6a:64:83:34:71:25:6d:ed:ac:a0:db:8d:51
Signer

28/10/2022, 15:08
Valid: false

.text
Size: 105KB - Virtual size: 105KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 22KB - Virtual size: 21KB

.reloc
Size: 6KB - Virtual size: 5KB