ab97477e0fae2f227295318253efbe6115c01cb1c8130dfb4de239768ed9952b

Sharing

Copy URL Twitter E-mail

General

Target

ab97477e0fae2f227295318253efbe6115c01cb1c8130dfb4de239768ed9952b
Size

2.4MB
MD5

f4eb30ab6ebb7699b1df5676646ce888
SHA1

ba03d71876016990014da0034e6e94955be95339
SHA256

ab97477e0fae2f227295318253efbe6115c01cb1c8130dfb4de239768ed9952b
SHA512

ac00ac3cea3aa1466bf4f5fa6edf02e9c2d3115714708932178d4eabfeadc23c52ea420a4c691f4472bea4d9295cfc60887613db1f4891183e117800334ffc23
SSDEEP

49152:tjyPQJcNaXQflYHKFB59qAMrABkl/gTScpvOTfX:ECcnbFb9qAbYX

Score

N/A

Malware Config

Signatures

Files

ab97477e0fae2f227295318253efbe6115c01cb1c8130dfb4de239768ed9952b
.exe windows x64

cead9f8c3cbf5a4e6e09bcbc6704f8a8

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3b:e5:45:18:04:5f:ef:7a:19:54:ac:67:5c:e0:1e:d5
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/10/2020, 00:00

Not After

13/10/2022, 23:59

Subject

CN=Hola VPN Ltd,O=Hola VPN Ltd,POSTALCODE=4250713,STREET=3 Hamachshev,L=Netanya,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:fc:c7:c8:5d:83:47:14:db:4d:88:28:74:b2:38:91:c9:c5:ba:99
Signer

Actual PE Digest

67:fc:c7:c8:5d:83:47:14:db:4d:88:28:74:b2:38:91:c9:c5:ba:99

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Hola VPN Ltd,O=Hola VPN Ltd,POSTALCODE=4250713,STREET=3 Hamachshev,L=Netanya,C=IL

18/02/2022, 14:25
Valid: true

Chain 1

CN=Hola VPN Ltd,O=Hola VPN Ltd,POSTALCODE=4250713,STREET=3 Hamachshev,L=Netanya,C=IL

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wininet

InternetSetOptionW
InternetQueryOptionW

advapi32

SetEntriesInAclW
RegNotifyChangeKeyValue
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetKeySecurity
RegSetValueExW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
StartServiceW
CreateProcessAsUserW
OpenProcessToken
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
ReportEventA
RegisterEventSourceA
SetNamedSecurityInfoW

winhttp

WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpSetStatusCallback
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpOpenRequest

ws2_32

gethostbyname
inet_addr
getsockopt
__WSAFDIsSet
accept
bind
WSASetLastError
WSAGetLastError
WSAIoctl
WSAEventSelect
WSACleanup
WSAStartup
socket
shutdown
setsockopt
sendto
send
select
recvfrom
recv
listen
closesocket
getsockname
getpeername
ioctlsocket
connect

kernel32

FindFirstFileExW
HeapSize
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
FlushFileBuffers
FreeEnvironmentStringsW
GetModuleFileNameA
GetProcessHeap
GetStartupInfoW
RemoveDirectoryW
CreateDirectoryW
GetCurrentDirectoryW
SetEnvironmentVariableW
DeleteFileW
WaitForSingleObjectEx
OpenProcess
FatalAppExitW
GetModuleHandleW
ReleaseMutex
WaitForSingleObject
CreateMutexW
ProcessIdToSessionId
GlobalFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
Thread32First
Thread32Next
Module32FirstW
Module32NextW
IsDebuggerPresent
CheckRemoteDebuggerPresent
CloseHandle
RaiseException
SetUnhandledExceptionFilter
GetLastError
Sleep
TerminateProcess
GetExitCodeProcess
DuplicateHandle
QueueUserAPC
SetConsoleCtrlHandler
CreateProcessW
WTSGetActiveConsoleSessionId
GetModuleFileNameW
LocalFree
CreateFileW
FindClose
FindFirstFileW
FindNextFileW
CreateNamedPipeW
CancelIo
GetDriveTypeW
GetProcAddress
LoadLibraryW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateEventW
TerminateThread
GetTempPathW
ReadFile
ReadFileEx
WriteFile
WriteFileEx
SetHandleInformation
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
SleepEx
GetTickCount
GetComputerNameExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
UnregisterWaitEx
RegisterWaitForSingleObject
GetModuleHandleA
GetVersion
GetFileType
GetStdHandle
RtlVirtualUnwind
SetLastError
MultiByteToWideChar
FlushConsoleInputBuffer
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
FreeLibrary
LoadLibraryA
SystemTimeToFileTime
GetSystemTime
SetFilePointerEx
GetConsoleCP
GetStringTypeW
ReadConsoleW
WriteConsoleW
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
IsProcessorFeaturePresent
LoadLibraryExW
ExitThread
CreateThread
SetStdHandle
HeapReAlloc
HeapAlloc
HeapFree
WideCharToMultiByte
AreFileApisANSI
GetModuleHandleExW
ExitProcess
DecodePointer
EncodePointer
GetCommandLineA
GetFileAttributesW
SetFileTime
GetFullPathNameW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetEnvironmentVariableA
CompareStringW
LCMapStringW
OutputDebugStringW
MoveFileExW
GetTimeZoneInformation
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetFileAttributesExW
FormatMessageW
FileTimeToLocalFileTime
GetEnvironmentStringsW
SetEndOfFile

userenv

CreateEnvironmentBlock

shell32

ShellExecuteW
SHGetFolderPathW
Shell_NotifyIconW

ntdll

NtQuerySystemInformation
NtMapViewOfSection
NtUnmapViewOfSection
NtDeviceIoControlFile
RtlCaptureContext
NtCreateSection
NtFsControlFile
NtTestAlert
RtlInitUnicodeString
NtCreateFile
RtlLookupFunctionEntry
RtlUnwindEx

iphlpapi

GetAdaptersInfo

psapi

EnumProcessModules
GetModuleFileNameExW
GetModuleInformation

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod

user32

AppendMenuW
RemoveMenu
TrackPopupMenu
InsertMenuItemW
SetMenuItemInfoW
UpdateWindow
SetForegroundWindow
GetClientRect
GetCursorPos
FindWindowExW
LoadCursorW
LoadIconW
LoadImageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetQueueStatus
AttachThreadInput
DestroyWindow
GetMenuItemCount
GetForegroundWindow
GetWindowTextW
GetWindowTextLengthW
GetWindowLongW
SystemParametersInfoW
MsgWaitForMultipleObjectsEx
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
CreateWindowExW
RegisterClassExW
DestroyMenu
BringWindowToTop
CreatePopupMenu
DefWindowProcW
PostMessageW
SendMessageW
GetWindowThreadProcessId
EnumWindows
ShowWindow
MessageBoxW

wtsapi32

WTSQueryUserToken

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 514KB - Virtual size: 513KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 155KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 340KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cead9f8c3cbf5a4e6e09bcbc6704f8a8

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

3b:e5:45:18:04:5f:ef:7a:19:54:ac:67:5c:e0:1e:d5Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44Certificate

Extended Key Usages

Key Usages

67:fc:c7:c8:5d:83:47:14:db:4d:88:28:74:b2:38:91:c9:c5:ba:99Signer

Signature Validations

Verification

18/02/2022, 14:25 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

wininet

advapi32

winhttp

ws2_32

kernel32

userenv

shell32

ntdll

iphlpapi

psapi

winmm

user32

wtsapi32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 514KB - Virtual size: 513KB

.data Size: 155KB - Virtual size: 182KB

.pdata Size: 77KB - Virtual size: 76KB

.tls Size: 13KB - Virtual size: 13KB

.rsrc Size: 340KB - Virtual size: 340KB

.reloc Size: 28KB - Virtual size: 28KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

3b:e5:45:18:04:5f:ef:7a:19:54:ac:67:5c:e0:1e:d5
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

67:fc:c7:c8:5d:83:47:14:db:4d:88:28:74:b2:38:91:c9:c5:ba:99
Signer

18/02/2022, 14:25
Valid: true

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 514KB - Virtual size: 513KB

.data
Size: 155KB - Virtual size: 182KB

.pdata
Size: 77KB - Virtual size: 76KB

.tls
Size: 13KB - Virtual size: 13KB

.rsrc
Size: 340KB - Virtual size: 340KB

.reloc
Size: 28KB - Virtual size: 28KB