ac0ac2ad3cd4b10d223f4151e1651f71f5808c90c9596873b4b6a5de91ba05cb

Sharing

Copy URL Twitter E-mail

General

Target

ac0ac2ad3cd4b10d223f4151e1651f71f5808c90c9596873b4b6a5de91ba05cb
Size

150KB
MD5

b2117a0ca453c2c975cd29d580eafcda
SHA1

9474696bfa3dea98545743c96951b7b6c33ff30d
SHA256

ac0ac2ad3cd4b10d223f4151e1651f71f5808c90c9596873b4b6a5de91ba05cb
SHA512

f228ad4d15a8995a8f9a746063d2caa9fc01340c9c173abefff9befab5a0ca6848cb4c869adfe862fa08eebc986fbd6a7c199931bcea4939afd2c80ed398c817
SSDEEP

3072:7HQKnoQeb3Zl6b1b2nyqXOl8Q4dSPQks/SY+XmGd9hamZgfY:8KnoGb12nLOlx4LD/OTd9hamCQ

Score

N/A

Malware Config

Signatures

Files

ac0ac2ad3cd4b10d223f4151e1651f71f5808c90c9596873b4b6a5de91ba05cb
.dll windows x86

76188ab6d5b0cf9bf52ea84953555833

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:34:99:e1:10:4f:5e:75:e7:21:a7:f1:54:73:bb:1f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

16/10/2019, 00:00

Not After

20/10/2022, 12:00

Subject

CN=AVG Technologies USA\, LLC,OU=RE 999,O=AVG Technologies USA\, LLC,L=Newton,ST=North Carolina,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

de:86:c2:8c:42:cd:9c:af:cc:40:c0:4f:68:c0:77:19:e5:e7:8b:80:b2:06:e8:4e:09:02:7b:6f:3b:b9:cc:57
Signer

Actual PE Digest

de:86:c2:8c:42:cd:9c:af:cc:40:c0:4f:68:c0:77:19:e5:e7:8b:80:b2:06:e8:4e:09:02:7b:6f:3b:b9:cc:57

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=AVG Technologies USA\, LLC,OU=RE 999,O=AVG Technologies USA\, LLC,L=Newton,ST=North Carolina,C=US

08/10/2020, 09:22
Valid: true

Chain 1

CN=AVG Technologies USA\, LLC,OU=RE 999,O=AVG Technologies USA\, LLC,L=Newton,ST=North Carolina,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVolumeInformationW
DeviceIoControl
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
DuplicateHandle
OpenFileMappingW
GetTempFileNameW
GetFileAttributesExW
FindFirstFileW
FindClose
GetFileInformationByHandle
SetFileTime
GetFileAttributesW
GetFullPathNameW
CreateDirectoryW
RemoveDirectoryW
GetCurrentDirectoryW
FindFirstFileExW
FindNextFileW
QueryDosDeviceW
GetLogicalDrives
GetFinalPathNameByHandleW
CreateHardLinkW
GetModuleFileNameW
VirtualAlloc
VirtualFree
VirtualProtect
ReadProcessMemory
VirtualQueryEx
OpenProcess
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapSummary
GlobalMemoryStatusEx
LocalFree
GetProcessTimes
GetCurrentThread
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentVariableW
FormatMessageW
GetDateFormatW
UnlockFile
SetLastError
WaitForSingleObject
CreateEventW
OpenEventW
PulseEvent
SetEvent
ResetEvent
CreateMutexW
OpenMutexW
ReleaseMutex
CreateSemaphoreW
OpenSemaphoreW
ReleaseSemaphore
TryEnterCriticalSection
GetSystemInfo
GetVersionExW
GetCurrentProcessId
IsBadReadPtr
IsBadWritePtr
GetTickCount
QueryPerformanceFrequency
QueryPerformanceCounter
GetThreadTimes
ExpandEnvironmentStringsW
LoadLibraryExW
GetSystemDirectoryW
SetErrorMode
GetCurrentThreadId
SetThreadPriority
SuspendThread
ResumeThread
WaitForMultipleObjects
TerminateThread
GetExitCodeThread
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
GetSystemTimeAsFileTime
SystemTimeToFileTime
FileTimeToSystemTime
RaiseException
VirtualQuery
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
LockFileEx
GetShortPathNameW
GetWindowsDirectoryW
MoveFileExW
SetEndOfFile
GetFileSize
SetFileAttributesW
DeleteFileW
WriteFile
ReadFile
SetFilePointer
CreateFileW
CloseHandle
GetDriveTypeW
GetProcessAffinityMask
GetLastError
GetLongPathNameW
FreeLibrary
GetProcAddress
GetCurrentProcess
GetModuleHandleW
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
LeaveCriticalSection
GetTimeFormatW
EnterCriticalSection

user32

CharToOemBuffA
OemToCharBuffA
wsprintfW
OemToCharW
CharToOemW

advapi32

CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
GetUserNameW
RevertToSelf
AdjustTokenPrivileges
ImpersonateSelf
OpenThreadToken
AddAce
InitializeAcl
GetLengthSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
EqualSid
AllocateAndInitializeSid
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
RegCloseKey
RegEnumValueW
RegOpenKeyExW

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

strchr
_except_handler4_common
wcschr
__std_type_info_destroy_list
memset
memcpy
wcsstr
wcsrchr
__std_exception_destroy
__std_exception_copy
__CxxFrameHandler3
_CxxThrowException
memmove

api-ms-win-crt-heap-l1-1-0

realloc
malloc
_callnewh
free

api-ms-win-crt-locale-l1-1-0

setlocale

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_invalid_parameter_noinfo_noreturn
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_endthreadex
_cexit
_execute_onexit_table

api-ms-win-crt-string-l1-1-0

strncpy
_stricmp
wcsncmp
wcsncpy
_wcsnicmp
_wcsdup
_wcsicmp
_wcsupr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-convert-l1-1-0

wcstoul
_ultow

api-ms-win-crt-utility-l1-1-0

rand

Exports

Exports

aswcmnosDllMain
cmnosFree
cmnosInit
cmnosMiniInit
cpuProcessUnexpected
dep_brandApplyPrefix
dep_brandFindRegistryKey
dep_brandGetIniFileName
dep_brandGetName
dep_brandGetProductId
dep_brandGetRegistryKey
dep_brandIsAvast
dep_brandSetIniFileName
dep_brandSetRegistryKey
dep_csCreate
dep_csDelete
dep_csRelease
dep_csTryWait
dep_csWait
dep_eventCreate
dep_eventDelete
dep_eventOpen
dep_eventPulse
dep_eventRelease
dep_eventReset
dep_eventWait
dep_fsCaseSensitiveSupported
dep_fsCloseFile
dep_fsCloseMap
dep_fsCopyFile
dep_fsCopyFileX
dep_fsCreateFileArgToOpenFile
dep_fsCreateFileArgToOpenFileX
dep_fsCreateFolder
dep_fsCreateFolderX
dep_fsCreateFromHandle
dep_fsCreateHardlink
dep_fsCreateMapFromHandle
dep_fsDeleteFile
dep_fsDeleteFileByHandle
dep_fsDeleteFileLater
dep_fsDeleteFileLaterX
dep_fsDeleteFileX
dep_fsDuplicateFile
dep_fsEnableWow64FsRedirection
dep_fsExistFile
dep_fsExistFileX
dep_fsExtractDriveRoot
dep_fsFileTimeToTime
dep_fsFindClose
dep_fsFindFirstFile
dep_fsFindFirstFileX
dep_fsFindNextFile
dep_fsGetAPIHandle
dep_fsGetCurFol
dep_fsGetDriveType
dep_fsGetExtAttr
dep_fsGetFileAttributes
dep_fsGetFileAttributesX
dep_fsGetFileId
dep_fsGetFileIdByHandle
dep_fsGetFileInfoHandle
dep_fsGetFileNameFlags
dep_fsGetFilePointer
dep_fsGetFileSize
dep_fsGetFileSizeHandle
dep_fsGetFileSizeX
dep_fsGetFinalFileName
dep_fsGetFindHandleFlags
dep_fsGetFolderHandle
dep_fsGetFullPathName
dep_fsGetHandleFlags
dep_fsGetLinkTarget
dep_fsGetLogicalDrives
dep_fsGetLongPathName
dep_fsGetLongPathNameX
dep_fsGetNTLongPath
dep_fsGetObjectNameByHandle
dep_fsGetProcessFileMap
dep_fsGetReparseInfo
dep_fsGetStreamInfos
dep_fsGetUsnInfo
dep_fsGetVolumeInfoByHandle
dep_fsGetVolumeName
dep_fsGetVolumeNameByHandle
dep_fsGetVolumeNames
dep_fsIsFolderCaseSensitive
dep_fsIsVolumeMounted
dep_fsLockFile
dep_fsMapFile
dep_fsMoveFile
dep_fsMoveFileByHandle
dep_fsMoveFileX
dep_fsOpenFile
dep_fsOpenFileById
dep_fsOpenFileX
dep_fsOpenMapFile
dep_fsPossibleStreams
dep_fsPrefetchMapped
dep_fsQueryDosDevice
dep_fsReadBR
dep_fsReadFile
dep_fsReadMBR
dep_fsRemapFile
dep_fsRemoveFolder
dep_fsRemoveFolderRecursive
dep_fsRemoveFolderRecursiveX
dep_fsRemoveFolderX
dep_fsSeekReadFile
dep_fsSeekWriteFile
dep_fsSetEndOfFile
dep_fsSetFileAttributes
dep_fsSetFileAttributesX
dep_fsSetFilePointer
dep_fsSetFileTime
dep_fsSetHandleFlags
dep_fsSetRawAccess
dep_fsSetSparseFile
dep_fsUnlockFile
dep_fsUseNTLongPath
dep_fsWriteDefMBR
dep_fsWriteFile
dep_fsZeroData
dep_memCloseProcess
dep_memCloseSharedMemory
dep_memCreateSharedMemory
dep_memGetMemoryInfo
dep_memGetProcessHeap
dep_memHeapAlloc
dep_memHeapCreate
dep_memHeapDestroy
dep_memHeapFree
dep_memHeapReAlloc
dep_memHeapSummary
dep_memOpenProcess
dep_memOpenSharedMemory
dep_memPrefetch
dep_memProtect
dep_memQueryProcessMemory
dep_memReadProcessMemory
dep_memVirtualAlloc
dep_memVirtualFree
dep_mutexCreate
dep_mutexDelete
dep_mutexOpen
dep_mutexRelease
dep_mutexWait
dep_osBeginThread
dep_osCallOpenedDriver
dep_osCloseDrvDevice
dep_osCloseThread
dep_osEndThread
dep_osExpandEnvironment
dep_osFreeModule
dep_osGetCPUSignature
dep_osGetCpuCount
dep_osGetCpuFeatures
dep_osGetCurrentProcess
dep_osGetCurrentProcessID
dep_osGetCurrentThread
dep_osGetCurrentThreadId
dep_osGetCurrentThreadTimes
dep_osGetExitCodeThread
dep_osGetGranularity
dep_osGetID
dep_osGetLastError
dep_osGetMemPrefetchSize
dep_osGetModName
dep_osGetModPath
dep_osGetModuleFromAddress
dep_osGetModuleProc
dep_osGetPagingSize
dep_osGetPerformanceCounter
dep_osGetSystemDir
dep_osGetSystemDirT
dep_osGetTickCount
dep_osGetTickCount64
dep_osGetUserAddressSpaceLimit
dep_osGetUserFullName
dep_osGetUserHomeDir
dep_osGetWinVer
dep_osIsValidAddress
dep_osIsWin10OrBetter
dep_osIsWin64
dep_osIsWin8OrBetter
dep_osIsWow64
dep_osLdrLock
dep_osOpenDrvDevice
dep_osRand
dep_osRegistryClose
dep_osRegistryDeleteKey
dep_osRegistryDeleteValue
dep_osRegistryEnumKey
dep_osRegistryEnumVal
dep_osRegistryOpen
dep_osRegistryReadBinary
dep_osRegistryReadString
dep_osRegistryWriteBinary
dep_osRegistryWriteString
dep_osSetErrorMode
dep_osSetLastError
dep_osSetThreadPriority
dep_osSleep
dep_osSuspendThread
dep_osTerminateThread
dep_osTlsAlloc
dep_osTlsFree
dep_osTlsGetValue
dep_osTlsSetValue
dep_osWaitForThread
dep_osWaitForThreads
dep_procGetCommandLine
dep_procGetEnvironment
dep_procGetFileName
dep_procGetParent
dep_procGetSID
dep_procGetTimes
dep_procOpenToRead
dep_secGetPrivileges
dep_secGetPublicDirSecurity
dep_secGetPublicSecurity
dep_secGetRandomBuffer
dep_secGetRandomSeed
dep_secIsAdministrator
dep_secRestorePrivilege
dep_secSetPrivilege
dep_semaphoreCreate
dep_semaphoreDelete
dep_semaphoreOpen
dep_semaphoreRelease
dep_semaphoreWait
dep_strAnsiToOem
dep_strAnsiToUtf8
dep_strConvert
dep_strConvertErrorToString
dep_strCurrToNewUtf8
dep_strCurrToOem
dep_strDupAnsi
dep_strDupUnicode
dep_strFreeString
dep_strGetDate
dep_strGetEnvVar
dep_strGetEnvVarT
dep_strGetTime
dep_strHasAnsiForm
dep_strNormalToNewUnicode
dep_strNormalToUnicode
dep_strOemToAnsi
dep_strOemToCurr
dep_strUnicodeToNewNormal
dep_strUnicodeToNormal
dep_strUnicodeToNormalFlags
dep_strUnicodeToUtf8
dep_strUtf8ToAnsi
dep_strUtf8ToNewCurr
dep_strUtf8ToUnicode
dep_timeCompareFile
dep_timeFileToSystem
dep_timeGetSystemTime
dep_timeSystemToFile
dep_trcTrace1
dep_trcTraceFileClose
dep_trcTraceFileOpen
rawfsGetStreamInfo
rawfsProcessStream
secCreatePublicDirSA
secCreatePublicSA

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

76188ab6d5b0cf9bf52ea84953555833

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

07:34:99:e1:10:4f:5e:75:e7:21:a7:f1:54:73:bb:1fCertificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

de:86:c2:8c:42:cd:9c:af:cc:40:c0:4f:68:c0:77:19:e5:e7:8b:80:b2:06:e8:4e:09:02:7b:6f:3b:b9:cc:57Signer

Signature Validations

Verification

08/10/2020, 09:22 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 108KB - Virtual size: 107KB

.rdata Size: 25KB - Virtual size: 25KB

.data Size: 512B - Virtual size: 6KB

.didat Size: 512B - Virtual size: 28B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

07:34:99:e1:10:4f:5e:75:e7:21:a7:f1:54:73:bb:1f
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

de:86:c2:8c:42:cd:9c:af:cc:40:c0:4f:68:c0:77:19:e5:e7:8b:80:b2:06:e8:4e:09:02:7b:6f:3b:b9:cc:57
Signer

08/10/2020, 09:22
Valid: true

.text
Size: 108KB - Virtual size: 107KB

.rdata
Size: 25KB - Virtual size: 25KB

.data
Size: 512B - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 28B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB