aefbc626406f1182bd43da922dcdde35f3b7a6b50f58ed91769011554bc6b8e5

Sharing

Copy URL

Twitter E-mail

General

Target

aefbc626406f1182bd43da922dcdde35f3b7a6b50f58ed91769011554bc6b8e5
Size

9.4MB
MD5

3b19fddd1290671713227ebc60e63760
SHA1

bcd4c9760ab88885f5cf7463a5a7382a82f490a7
SHA256

aefbc626406f1182bd43da922dcdde35f3b7a6b50f58ed91769011554bc6b8e5
SHA512

de2ee8d156cfd1bb1101a7a0aa78c5b45260acd9fba3bc3765d770c8a97aca8bd728b0f1798f9b037d70a57396a0be9fb7fa2d7eeea1a65e4472c238306881fa
SSDEEP

98304:pqHotO9qD3pRYjFaIyQa3kzCuNAzwh89VjTzAt4Q:pqHotqK/IyHwVNA0MVrAKQ

Score

N/A

Malware Config

Signatures

Files

aefbc626406f1182bd43da922dcdde35f3b7a6b50f58ed91769011554bc6b8e5
.exe windows x64

d9db81f4a57a9bc4994da022484db849

Code Sign

06:c6:86:16:20:60:23:12:ea:3d:cd:52:26:5e:56:c2
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/01/2021, 00:00

Not After

26/04/2023, 23:59

Subject

CN=Codota dot com ltd,O=Codota dot com ltd,L=Tel Aviv-Yafo,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6f:a2:ea:fe:15:69:7e:fb:a7:97:1a:12:e0:cf:09:4b:27:13:68:5c
Signer

Actual PE Digest

6f:a2:ea:fe:15:69:7e:fb:a7:97:1a:12:e0:cf:09:4b:27:13:68:5c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Codota dot com ltd,O=Codota dot com ltd,L=Tel Aviv-Yafo,C=IL

01/12/2022, 14:34
Valid: true

Chain 1

CN=Codota dot com ltd,O=Codota dot com ltd,L=Tel Aviv-Yafo,C=IL

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntdll

NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
NtQueryInformationProcess
NtQuerySystemInformation
RtlGetVersion
RtlNtStatusToDosError

pdh

PdhAddCounterW
PdhCloseQuery
PdhLookupPerfNameByIndexW
PdhOpenQueryA
PdhRemoveCounter

secur32

AcceptSecurityContext
AcquireCredentialsHandleA
ApplyControlToken
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextW
QueryContextAttributesW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
SystemFunction036

bcrypt

BCryptGenRandom

crypt32

CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateContext
CertDuplicateCertificateChain
CertDuplicateCertificateContext
CertDuplicateStore
CertEnumCertificatesInStore
CertFreeCertificateChain
CertFreeCertificateContext
CertGetCertificateChain
CertOpenStore
CertVerifyCertificateChainPolicy
CryptStringToBinaryA

iphlpapi

GetAdaptersAddresses

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
CancelIo
CancelIoEx
CloseHandle
CompareStringOrdinal
CopyFileExW
CreateDirectoryW
CreateFileMappingA
CreateFileW
CreateIoCompletionPort
CreateMutexA
CreateNamedPipeW
CreateProcessW
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
GetCommandLineW
GetComputerNameExW
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceA
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetProcessTimes
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemTimes
GetTickCount
GetTickCount64
GetTimeZoneInformation
GetVersionExA
GetWindowsDirectoryW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalFree
LockFileEx
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
OpenProcess
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadDirectoryChangesW
ReadFile
ReadProcessMemory
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleMode
SetFileAttributesW
SetFileCompletionNotificationModes
SetFileInformationByHandle
SetFilePointerEx
SetHandleInformation
SetLastError
SetThreadStackGuarantee
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SwitchToThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFile
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WriteConsoleW
WriteFile
__C_specific_handler
lstrlenW

msvcrt

__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_errno
_fmode
_fpreset
_initterm
_lock
_onexit
_unlock
_vsnprintf
abort
atexit
calloc
exit
exp
fprintf
free
fwrite
malloc
memcmp
memcpy
memmove
memset
signal
strlen
strncmp
vfprintf
wcslen

ole32

CoInitializeEx
CoTaskMemFree
CoUninitialize

powrprof

CallNtPowerInformation

psapi

EnumProcessModulesEx
EnumProcesses
GetModuleBaseNameW
GetModuleFileNameExW
GetProcessMemoryInfo

shell32

CommandLineToArgvW
SHGetKnownFolderPath
ShellExecuteW

ws2_32

WSACleanup
WSAGetLastError
WSAGetOverlappedResult
WSAIoctl
WSARecv
WSASend
WSASocketW
WSAStartup
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockopt
ioctlsocket
recv
send
setsockopt
shutdown
socket

Sections

.text
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d9db81f4a57a9bc4994da022484db849

Code Sign

06:c6:86:16:20:60:23:12:ea:3d:cd:52:26:5e:56:c2Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

6f:a2:ea:fe:15:69:7e:fb:a7:97:1a:12:e0:cf:09:4b:27:13:68:5cSigner

Signature Validations

Verification

01/12/2022, 14:34 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

pdh

secur32

advapi32

bcrypt

crypt32

iphlpapi

kernel32

msvcrt

ole32

powrprof

psapi

shell32

ws2_32

Sections

.text Size: 6.9MB - Virtual size: 6.9MB

.data Size: 22KB - Virtual size: 22KB

.rdata Size: 2.0MB - Virtual size: 2.0MB

.pdata Size: 89KB - Virtual size: 88KB

.xdata Size: 412KB - Virtual size: 411KB

.bss Size: - Virtual size: 6KB

.idata Size: 10KB - Virtual size: 9KB

.CRT Size: 512B - Virtual size: 184B

.tls Size: 512B - Virtual size: 104B

06:c6:86:16:20:60:23:12:ea:3d:cd:52:26:5e:56:c2
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

6f:a2:ea:fe:15:69:7e:fb:a7:97:1a:12:e0:cf:09:4b:27:13:68:5c
Signer

01/12/2022, 14:34
Valid: true

.text
Size: 6.9MB - Virtual size: 6.9MB

.data
Size: 22KB - Virtual size: 22KB

.rdata
Size: 2.0MB - Virtual size: 2.0MB

.pdata
Size: 89KB - Virtual size: 88KB

.xdata
Size: 412KB - Virtual size: 411KB

.bss
Size: - Virtual size: 6KB

.idata
Size: 10KB - Virtual size: 9KB

.CRT
Size: 512B - Virtual size: 184B

.tls
Size: 512B - Virtual size: 104B