302bb53597efe329ad604747c12416f2b47dce9f2ab745e7f06175765ffe7bbe

Sharing

Copy URL

Twitter E-mail

General

Target

302bb53597efe329ad604747c12416f2b47dce9f2ab745e7f06175765ffe7bbe
Size

701KB
MD5

9528f6fd846e4d8d2e8eb2d3098cb20d
SHA1

6f40f7364def85ee85df690ed1e4749952634bb0
SHA256

302bb53597efe329ad604747c12416f2b47dce9f2ab745e7f06175765ffe7bbe
SHA512

66c92e632fbf16b63c4b1d10722dec199b880754a4ee3d27913f9698911953c28c8c54de13fcf75e5bde791052fc0cdd8deee5d54beb1e8749807fb22ae58cc5
SSDEEP

6144:rXESEPZbTSWraS0IMoNmL7x4SVISabPTeboxqoTkEbj5MItIl7/:8rrFNmLKSVIJbPT+4BiIuh/

Score

N/A

Malware Config

Signatures

Files

302bb53597efe329ad604747c12416f2b47dce9f2ab745e7f06175765ffe7bbe
.dll windows x86

2c9e2e96a69a5aa4b1fa2fb76b6c8494

Code Sign

0c:f2:d0:b5:bf:dd:68:cf:77:7a:0c:12:f8:06:a5:69
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

27-01-2021 00:00

Not After

27-01-2022 23:59

Subject

CN=PROTIP d.o.o. - v stečaju,O=PROTIP d.o.o. - v stečaju,POSTALCODE=1230,STREET=Goričica pri Ihanu 18A,L=Domžale,C=SI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:c7:92:78:73:d5:46:1e:e8:8f:9a:63:66:ab:92:a9:bf:d6:ed:82
Signer

Actual PE Digest

59:c7:92:78:73:d5:46:1e:e8:8f:9a:63:66:ab:92:a9:bf:d6:ed:82

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=PROTIP d.o.o. - v stečaju,O=PROTIP d.o.o. - v stečaju,POSTALCODE=1230,STREET=Goričica pri Ihanu 18A,L=Domžale,C=SI

24-11-2022 14:55
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
VirtualAlloc
VirtualProtect
GetProcAddress
GetLastError
GetConsoleCP
lstrlenA
lstrcatA
GetCurrentThreadId
GetTickCount
GetVersion
GetCurrentThread
GetCurrentProcess
lstrcmpA
SetLastError
GetACP
GetProcessId

user32

SetCursor
ShowCursor
SetWindowPos
GetCaretBlinkTime
ReleaseDC
GetWindowDC
CheckMenuRadioItem
GetActiveWindow
CheckDlgButton
GetWindowThreadProcessId
GetCapture
GetAsyncKeyState
CheckRadioButton
GetGUIThreadInfo
ShowWindow
GetKeyboardType
GetCursorInfo
SetFocus
GetCursorPos
ReleaseCapture
CheckMenuItem

winmm

sndPlaySoundA

msimg32

AlphaBlend

winspool.drv

AdvancedDocumentPropertiesW

Sections

.code
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 374KB - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2c9e2e96a69a5aa4b1fa2fb76b6c8494

Code Sign

0c:f2:d0:b5:bf:dd:68:cf:77:7a:0c:12:f8:06:a5:69Certificate

Extended Key Usages

Key Usages

01Certificate

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

59:c7:92:78:73:d5:46:1e:e8:8f:9a:63:66:ab:92:a9:bf:d6:ed:82Signer

Signature Validations

Verification

24-11-2022 14:55 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

winmm

msimg32

winspool.drv

Sections

.code Size: 320KB - Virtual size: 320KB

.rdata Size: 374KB - Virtual size: 374KB

0c:f2:d0:b5:bf:dd:68:cf:77:7a:0c:12:f8:06:a5:69
Certificate

01
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

59:c7:92:78:73:d5:46:1e:e8:8f:9a:63:66:ab:92:a9:bf:d6:ed:82
Signer

24-11-2022 14:55
Valid: false

.code
Size: 320KB - Virtual size: 320KB

.rdata
Size: 374KB - Virtual size: 374KB