0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579

Resubmissions

22-11-2022 18:16

221122-wwfvvace62 10

09-01-2020 09:55

200109-9cw38n1aex 10

Sharing

Copy URL

Twitter E-mail

General

Target

0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579
Size

248KB
MD5

738314aa6e07f9a625e4774ac1243a79
SHA1

0a7ab8cc60b04e66be11eb41672991482b9c0656
SHA256

0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579
SHA512

18ea6d2398ea5b858a24f51221009622dad2770177ddbeb9ec3e3736b544e1b854f35baa19d741f76f9eb181dd426df11cc64e8f0c465cd3cf8b8d381211a581
SSDEEP

6144:1d4JCWlqIEWqfHNtqIl6lX5YlSMoNq9GnN5tyflgAB4:YdQHf6lelSMGq4NHyfeAB4

Score

N/A

Malware Config

Signatures

Files

0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579
.exe windows x86

9a64bbf7c37fef9268b76bb435b11ede

Code Sign

aa:f6:5b:8e:7a:2e:68:bc:8c:9e:8f:27:33:1b:79:5c
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

05-02-2019 00:00

Not After

03-02-2020 23:59

Subject

CN=ALISA L LIMITED,O=ALISA L LIMITED,POSTALCODE=RM6 4DE,STREET=8 Quarles Park Road,L=ROMFORD,ST=ROMFORD,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

01-02-2010 00:00

Not After

18-01-2038 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

df:c6:45:2b:5e:5a:d3:18:65:05:88:80:bf:9b:92:a9:f7:0a:51:c9
Signer

Actual PE Digest

df:c6:45:2b:5e:5a:d3:18:65:05:88:80:bf:9b:92:a9:f7:0a:51:c9

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=ALISA L LIMITED,O=ALISA L LIMITED,POSTALCODE=RM6 4DE,STREET=8 Quarles Park Road,L=ROMFORD,ST=ROMFORD,C=GB

07-02-2019 22:04
Valid: true

Chain 1

CN=ALISA L LIMITED,O=ALISA L LIMITED,POSTALCODE=RM6 4DE,STREET=8 Quarles Park Road,L=ROMFORD,ST=ROMFORD,C=GB

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

Sleep
FindClose
HeapDestroy
FormatMessageW
GetVersionExA
GetVersionExW
lstrlenW
ExitProcess
CloseHandle
CreateEventW
GetLastError
LoadLibraryA
GetProcAddress
VirtualAlloc
InterlockedDecrement
GetModuleHandleA
TerminateProcess
GetCommandLineA
GetStartupInfoA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetCurrentThread
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
OutputDebugStringA
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryExA
InitializeCriticalSection
HeapAlloc
HeapReAlloc
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
VirtualProtect
GetSystemInfo
VirtualQuery
GetLocaleInfoW
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA

advapi32

RegEnumValueA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyW

comctl32

ImageList_Add

Sections

.text
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

9a64bbf7c37fef9268b76bb435b11ede

Code Sign

aa:f6:5b:8e:7a:2e:68:bc:8c:9e:8f:27:33:1b:79:5cCertificate

Extended Key Usages

Key Usages

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2dCertificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

df:c6:45:2b:5e:5a:d3:18:65:05:88:80:bf:9b:92:a9:f7:0a:51:c9Signer

Signature Validations

Verification

07-02-2019 22:04 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

comctl32

Sections

.text Size: 228KB - Virtual size: 227KB

.data Size: 8KB - Virtual size: 10KB

.rsrc Size: 2KB - Virtual size: 2KB

aa:f6:5b:8e:7a:2e:68:bc:8c:9e:8f:27:33:1b:79:5c
Certificate

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

df:c6:45:2b:5e:5a:d3:18:65:05:88:80:bf:9b:92:a9:f7:0a:51:c9
Signer

07-02-2019 22:04
Valid: true

.text
Size: 228KB - Virtual size: 227KB

.data
Size: 8KB - Virtual size: 10KB

.rsrc
Size: 2KB - Virtual size: 2KB