d6688c773390903c9224e69dcdf9a54487b5c7fba31ad04fe18a7ecf2ccb3864

Sharing

Copy URL

Twitter E-mail

General

Target

d6688c773390903c9224e69dcdf9a54487b5c7fba31ad04fe18a7ecf2ccb3864
Size

701KB
MD5

6a7b2fa9de5a35f64d24a249ee7ae963
SHA1

313c10bab22e56bebbfb7f43f545ee093e4d5fc0
SHA256

d6688c773390903c9224e69dcdf9a54487b5c7fba31ad04fe18a7ecf2ccb3864
SHA512

0e740acbd81b77c59de2736b345ae8d2c0e7e21bf69341288cfaa947f080a6c4f8b7794e83b3cb961c85825a9ff6efa40e70edbea2764ed8c1e6c31985dd6863
SSDEEP

6144:WXESEPZbTSWraS0IMoNmL7x4SVISabPTeboxqoTkEbj5MItIl7p:3rrFNmLKSVIJbPT+4BiIuhp

Score

N/A

Malware Config

Signatures

Files

d6688c773390903c9224e69dcdf9a54487b5c7fba31ad04fe18a7ecf2ccb3864
.dll windows x86

2c9e2e96a69a5aa4b1fa2fb76b6c8494

Code Sign

0c:f2:d0:b5:bf:dd:68:cf:77:7a:0c:12:f8:06:a5:69
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

27-01-2021 00:00

Not After

27-01-2022 23:59

Subject

CN=PROTIP d.o.o. - v stečaju,O=PROTIP d.o.o. - v stečaju,POSTALCODE=1230,STREET=Goričica pri Ihanu 18A,L=Domžale,C=SI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:a0:90:e0:ad:b4:51:62:5e:07:e5:98:1a:3a:9b:3c:8a:74:0a:04
Signer

Actual PE Digest

b3:a0:90:e0:ad:b4:51:62:5e:07:e5:98:1a:3a:9b:3c:8a:74:0a:04

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=PROTIP d.o.o. - v stečaju,O=PROTIP d.o.o. - v stečaju,POSTALCODE=1230,STREET=Goričica pri Ihanu 18A,L=Domžale,C=SI

24-11-2022 14:54
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
VirtualAlloc
VirtualProtect
GetProcAddress
GetLastError
GetConsoleCP
lstrlenA
lstrcatA
GetCurrentThreadId
GetTickCount
GetVersion
GetCurrentThread
GetCurrentProcess
lstrcmpA
SetLastError
GetACP
GetProcessId

user32

SetCursor
ShowCursor
SetWindowPos
GetCaretBlinkTime
ReleaseDC
GetWindowDC
CheckMenuRadioItem
GetActiveWindow
CheckDlgButton
GetWindowThreadProcessId
GetCapture
GetAsyncKeyState
CheckRadioButton
GetGUIThreadInfo
ShowWindow
GetKeyboardType
GetCursorInfo
SetFocus
GetCursorPos
ReleaseCapture
CheckMenuItem

winmm

sndPlaySoundA

msimg32

AlphaBlend

winspool.drv

AdvancedDocumentPropertiesW

Sections

.code
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 374KB - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2c9e2e96a69a5aa4b1fa2fb76b6c8494

Code Sign

0c:f2:d0:b5:bf:dd:68:cf:77:7a:0c:12:f8:06:a5:69Certificate

Extended Key Usages

Key Usages

01Certificate

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

b3:a0:90:e0:ad:b4:51:62:5e:07:e5:98:1a:3a:9b:3c:8a:74:0a:04Signer

Signature Validations

Verification

24-11-2022 14:54 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

winmm

msimg32

winspool.drv

Sections

.code Size: 320KB - Virtual size: 320KB

.rdata Size: 374KB - Virtual size: 374KB

0c:f2:d0:b5:bf:dd:68:cf:77:7a:0c:12:f8:06:a5:69
Certificate

01
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

b3:a0:90:e0:ad:b4:51:62:5e:07:e5:98:1a:3a:9b:3c:8a:74:0a:04
Signer

24-11-2022 14:54
Valid: false

.code
Size: 320KB - Virtual size: 320KB

.rdata
Size: 374KB - Virtual size: 374KB