967e312a1b989bbec677bc1901e958d4e547e523e158ff04f4223aeeb713f694

Sharing

Copy URL Twitter E-mail

General

Target

967e312a1b989bbec677bc1901e958d4e547e523e158ff04f4223aeeb713f694
Size

306KB
MD5

39573e2b30759fe16b0375458d39eb6b
SHA1

bfb45724f6fea87f1f5d21660420b099e59f1fb4
SHA256

967e312a1b989bbec677bc1901e958d4e547e523e158ff04f4223aeeb713f694
SHA512

4d94bbbcffa2c1d152abf9da1467f42c2c4ecd0c5e9c45ed88fda15c98d133ffc4b8b346513671416b5c95225dbb90dc584a839dd0b1673802c9e2d132827ca8
SSDEEP

6144:FJMDyXOiiKvkBs7Wl6x7RJLrZ5Rfuv8TdslI/wzRRJ:0DyYKvkIWYrJfrRGv8Tds8wtRJ

Score

N/A

Malware Config

Signatures

Files

967e312a1b989bbec677bc1901e958d4e547e523e158ff04f4223aeeb713f694
.exe windows x86

8d0691df0fb548180149dd4600b88412

Code Sign

3b:70:26:87:41:57:d2:b2:4c:d4:84:32:08:d7:d1:a9
Certificate

Issuer

CN=16655164216495844132136384688219942189867715913237314315627412144253812198557273161486527342678695929212277488185398815358985676617675838128284725174184973

Not Before

21/01/2013, 04:09

Not After

31/12/2039, 23:59

Subject

CN=16655164216495844132136384688219942189867715913237314315627412144253812198557273161486527342678695929212277488185398815358985676617675838128284725174184973

Extended Key Usages

ExtKeyUsageCodeSigning

e6:e7:40:12:32:62:b2:45:97:f8:7a:92:50:1f:f3:88:df:f6:11:a0
Signer

Actual PE Digest

e6:e7:40:12:32:62:b2:45:97:f8:7a:92:50:1f:f3:88:df:f6:11:a0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=16655164216495844132136384688219942189867715913237314315627412144253812198557273161486527342678695929212277488185398815358985676617675838128284725174184973

28/11/2022, 11:52
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
VirtualAlloc

user32

LoadIconA
ShowWindow
UpdateWindow
LoadIconW
RegisterClassExA
LoadCursorA

gdi32

GetStockObject

advapi32

OpenEncryptedFileRawW
WriteEncryptedFileRaw
StartServiceW
SetSecurityDescriptorDacl
SetFileSecurityW
SetEntriesInAclW
ReportEventW
RegisterEventSourceW
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
AddAccessAllowedAce
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
CloseEncryptedFileRaw
CloseServiceHandle
ControlService
DecryptFileW
DeleteAce
EncryptFileW
EnumDependentServicesW
EqualSid
FreeSid
GetAce
GetSecurityDescriptorDacl
GetTokenInformation
GetUserNameW
InitializeAcl
InitializeSecurityDescriptor
LookupAccountSidW
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
OpenThreadToken
QueryServiceStatus
ReadEncryptedFileRaw
RegCloseKey
RegConnectRegistryW
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegLoadKeyW
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExA
RegQueryValueExW
RegReplaceKeyW

msvcrt

_CxxThrowException
_XcptFilter
__CxxFrameHandler
__dllonexit
__p__commode
__p__fmode
__set_app_type
__setusermatherr
__wgetmainargs
_adjust_fdiv
_c_exit
_cexit
_controlfp
_errno
_except_handler3
_exit
_fdopen
_filelength
_ftol
_getpid
_initterm
_local_unwind2
_mbscpy
_mbslen
_onexit
_open_osfhandle
_purecall
_putenv
_snwprintf
_tzset
_vsnwprintf
_wcmdln
_wcsdup
_wcsicmp
_wcslwr
_wcsnicmp
_wcsrev
_wcsupr
_wfopen
_wtoi
calloc
clearerr
exit
fclose
fflush
fread
free
fseek
ftell
fwrite
isalpha
isspace
localtime
malloc
memmove
mktime
realloc
swprintf
swscanf
time
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncat
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcsstr
wcstok
wprintf

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 280KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ata4
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ata3
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ata2
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ata
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8d0691df0fb548180149dd4600b88412

Code Sign

3b:70:26:87:41:57:d2:b2:4c:d4:84:32:08:d7:d1:a9Certificate

Extended Key Usages

e6:e7:40:12:32:62:b2:45:97:f8:7a:92:50:1f:f3:88:df:f6:11:a0Signer

Signature Validations

Verification

28/11/2022, 11:52 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcrt

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 280KB - Virtual size: 279KB

.data Size: 10KB - Virtual size: 10KB

ata4 Size: 512B - Virtual size: 100B

ata3 Size: 512B - Virtual size: 100B

ata2 Size: 512B - Virtual size: 100B

ata Size: 512B - Virtual size: 100B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 1KB - Virtual size: 1KB

3b:70:26:87:41:57:d2:b2:4c:d4:84:32:08:d7:d1:a9
Certificate

e6:e7:40:12:32:62:b2:45:97:f8:7a:92:50:1f:f3:88:df:f6:11:a0
Signer

28/11/2022, 11:52
Valid: false

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 280KB - Virtual size: 279KB

.data
Size: 10KB - Virtual size: 10KB

ata4
Size: 512B - Virtual size: 100B

ata3
Size: 512B - Virtual size: 100B

ata2
Size: 512B - Virtual size: 100B

ata
Size: 512B - Virtual size: 100B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1KB - Virtual size: 1KB