a945cef3c5bf4d3d92974da6daed6e68944963a9035b438c7cd6e7e836ef783a

Sharing

Copy URL Twitter E-mail

General

Target

a945cef3c5bf4d3d92974da6daed6e68944963a9035b438c7cd6e7e836ef783a
Size

333KB
MD5

021e4250e55fd2a49f9867d2e9e0440e
SHA1

1b82c3101a8558ad47e672be5a3a86b6390ad568
SHA256

a945cef3c5bf4d3d92974da6daed6e68944963a9035b438c7cd6e7e836ef783a
SHA512

4ec475a2c0f1ecd7dfaf7a6d66efbafa8e43e7f01b5ea001a9d2070984685f621e2255343ebfbcbadfa02a3e8c94d40e7b762f6fcaaaff2eda51b999d3b24a04
SSDEEP

6144:m1divxYrQOEFR22Lz/J8qb5bPRvjRjVO2ElZI8lHfSsxnagT+FF3bKf5n4X:odipkQDR2K8wbDjVO2ElZz73TadF

Score

N/A

Malware Config

Signatures

Files

a945cef3c5bf4d3d92974da6daed6e68944963a9035b438c7cd6e7e836ef783a
.exe windows x86

5f905a2beb0cf6ed729895f3796c48e8

Code Sign

43:fc:1e:81:06:65:19:62:b6:1c:5b:0f:1d:6a:10:0b
Certificate

Issuer

CN=G74p9 6reaxrgLqd57blbJyGwpbLDl7daCJ3gdLlv9offloK9zDfavxK7e9ADf7irDgyhaDkwv 3mmr164nDKfEjvCznLuFoDdf2lzabit31pIepq45KczhcAHppi5eg4d3GkjKFus Bul5guFffGr4smzK27pC AMpxmFyiBDaGHu6onrKEjyEuxxp4KoF2c7cpDtgb4ErtqFpxgAwweJaE8jpIAxA1g23l2KB fj8C9arBKrKoIFI8ICIIhLvKqECL1AJcjrLti3b7yhA1o3CwLLdHyMwxEmykbk5i4skxlsfcqBnpj4sbzkEctMGmzn4x2Iu8Ebvk5sInBvI6C3d8K1k1AwlBgbcma2t3i786t9oaHheu2o8ft8or9h7KinDKxail7sdBG74t5wpyn 4tEckvBKCfJuECtqHxiF w5 CL36e4LJAca7c56FDau1hMu mxqvBz3vm6m3Jsal2avkb7sbtBzsE71xwH1jt6G4LCGFtrKbb2ubqjnFEIFpKBMhm9MCFtJgwfv6ga I6ubhiBICEtBt5lorIr71rqzeAD G 9x4wAglFFgy94yqMHoKk8owjF5 ttqcF88acds34DgDpnawludG1Ivj7m1sxG4qjfcizpijEJo7M2aE2xMmA8uagDF57375yf5oyEB7Erri6dddk39ukdnIK4shdpwrz57BgsepMkp58Cw1wiiAHzKxz9mEun7 a2CchgKdBxuvddnk434GlHdaocI6IaB1E9EGB6H14dmln9u9Lewzlweu ycCo2bmCBIc GlMKA5 qJyrKE35uIlopC51FoxMCsy1qleorm6EDqLdHFMmFoxH44HutbL1 bmzuxsdqkA3 Icymhc4fg6dgzucoadq3gjnpDAyyg3kAeAGy4rcponuyMMluDkwnc2mIE7yuvffM CffLFhff gpu Hgxz7GMIe61r3Ax3BgMBD4L948mfdmdahvxKrqfd1uqFKhyzGs3bj1hskAGrBaixmB4m3DvgzBdKwq6 mwy8hyc5azwgtmDg5ffIeqKzf6Kk4bLnK7k5mddxhEKJCBMgFb7lldxG153c1Mu2dB216KymJK8aup5b53ppciDhlBb2fbHkJeEIlB31F9ssx 14Gr1LkF53 799BKfhMz7KymvkzxkH EwI4xkFenw 9xyh75E4Hvi 6heu i9e6xapb44s6BFpcG5t3J2csBCaxky5tlEtq4BvyJsA12hwCaBAJDFntKvtxnxy73JL3gfk1i6KfM8zc6MjGidpcMsnCgCd AD DbwDD2H pv6gkaA5ebzz2trBj7e6b 5tfob9fJb5AlgkAKJ5dtvyqkvFiBK gfKyjKa8v1sL DiLo F2EoJiKbhjDsFjBKCoydvAJn5Hh58G6lh7fEM7eKtpHvfiCH1Gc qmGxIl6fx9CELGod4y551xDKdcldLc2b1B9eB8wEqyCvCHuj2s4jnB6II1oiqxtiGjczf8wnF4Jzzmiq5qjuAMhu84ptk24qa87Anxla346bxoI v7 xyD9yvwDy6yD939vnbda7atzxuc532L9ix2qpc7uBbmt1dKxh1m6GwhnJuuaiwfCCdxBMqbMMl2qgHwMIp47mkqDJcarBxkBiMzr9b6wyxMnBrxr8rwm1v7i4mn6 IA57vuf7BGLitEyD 5hcbLnukh32ruysJtwhL99fbsCtdja5f9ckfcj81fsMgulg5h2d39wpofsgJKs42HHECtjenfe3 bBtLoqs6wr3InpDFBIkM39g6yexmMt19E96Isu2LHbmfssvddzHow7 G74p9

Not Before

10/01/2013, 17:41

Not After

31/12/2039, 23:59

Subject

CN=G74p9 6reaxrgLqd57blbJyGwpbLDl7daCJ3gdLlv9offloK9zDfavxK7e9ADf7irDgyhaDkwv 3mmr164nDKfEjvCznLuFoDdf2lzabit31pIepq45KczhcAHppi5eg4d3GkjKFus Bul5guFffGr4smzK27pC AMpxmFyiBDaGHu6onrKEjyEuxxp4KoF2c7cpDtgb4ErtqFpxgAwweJaE8jpIAxA1g23l2KB fj8C9arBKrKoIFI8ICIIhLvKqECL1AJcjrLti3b7yhA1o3CwLLdHyMwxEmykbk5i4skxlsfcqBnpj4sbzkEctMGmzn4x2Iu8Ebvk5sInBvI6C3d8K1k1AwlBgbcma2t3i786t9oaHheu2o8ft8or9h7KinDKxail7sdBG74t5wpyn 4tEckvBKCfJuECtqHxiF w5 CL36e4LJAca7c56FDau1hMu mxqvBz3vm6m3Jsal2avkb7sbtBzsE71xwH1jt6G4LCGFtrKbb2ubqjnFEIFpKBMhm9MCFtJgwfv6ga I6ubhiBICEtBt5lorIr71rqzeAD G 9x4wAglFFgy94yqMHoKk8owjF5 ttqcF88acds34DgDpnawludG1Ivj7m1sxG4qjfcizpijEJo7M2aE2xMmA8uagDF57375yf5oyEB7Erri6dddk39ukdnIK4shdpwrz57BgsepMkp58Cw1wiiAHzKxz9mEun7 a2CchgKdBxuvddnk434GlHdaocI6IaB1E9EGB6H14dmln9u9Lewzlweu ycCo2bmCBIc GlMKA5 qJyrKE35uIlopC51FoxMCsy1qleorm6EDqLdHFMmFoxH44HutbL1 bmzuxsdqkA3 Icymhc4fg6dgzucoadq3gjnpDAyyg3kAeAGy4rcponuyMMluDkwnc2mIE7yuvffM CffLFhff gpu Hgxz7GMIe61r3Ax3BgMBD4L948mfdmdahvxKrqfd1uqFKhyzGs3bj1hskAGrBaixmB4m3DvgzBdKwq6 mwy8hyc5azwgtmDg5ffIeqKzf6Kk4bLnK7k5mddxhEKJCBMgFb7lldxG153c1Mu2dB216KymJK8aup5b53ppciDhlBb2fbHkJeEIlB31F9ssx 14Gr1LkF53 799BKfhMz7KymvkzxkH EwI4xkFenw 9xyh75E4Hvi 6heu i9e6xapb44s6BFpcG5t3J2csBCaxky5tlEtq4BvyJsA12hwCaBAJDFntKvtxnxy73JL3gfk1i6KfM8zc6MjGidpcMsnCgCd AD DbwDD2H pv6gkaA5ebzz2trBj7e6b 5tfob9fJb5AlgkAKJ5dtvyqkvFiBK gfKyjKa8v1sL DiLo F2EoJiKbhjDsFjBKCoydvAJn5Hh58G6lh7fEM7eKtpHvfiCH1Gc qmGxIl6fx9CELGod4y551xDKdcldLc2b1B9eB8wEqyCvCHuj2s4jnB6II1oiqxtiGjczf8wnF4Jzzmiq5qjuAMhu84ptk24qa87Anxla346bxoI v7 xyD9yvwDy6yD939vnbda7atzxuc532L9ix2qpc7uBbmt1dKxh1m6GwhnJuuaiwfCCdxBMqbMMl2qgHwMIp47mkqDJcarBxkBiMzr9b6wyxMnBrxr8rwm1v7i4mn6 IA57vuf7BGLitEyD 5hcbLnukh32ruysJtwhL99fbsCtdja5f9ckfcj81fsMgulg5h2d39wpofsgJKs42HHECtjenfe3 bBtLoqs6wr3InpDFBIkM39g6yexmMt19E96Isu2LHbmfssvddzHow7 G74p9

Extended Key Usages

ExtKeyUsageCodeSigning

f1:ee:49:83:fc:4f:38:be:ad:5e:82:04:64:2f:3f:57:65:3c:40:3a
Signer

Actual PE Digest

f1:ee:49:83:fc:4f:38:be:ad:5e:82:04:64:2f:3f:57:65:3c:40:3a

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=G74p9 6reaxrgLqd57blbJyGwpbLDl7daCJ3gdLlv9offloK9zDfavxK7e9ADf7irDgyhaDkwv 3mmr164nDKfEjvCznLuFoDdf2lzabit31pIepq45KczhcAHppi5eg4d3GkjKFus Bul5guFffGr4smzK27pC AMpxmFyiBDaGHu6onrKEjyEuxxp4KoF2c7cpDtgb4ErtqFpxgAwweJaE8jpIAxA1g23l2KB fj8C9arBKrKoIFI8ICIIhLvKqECL1AJcjrLti3b7yhA1o3CwLLdHyMwxEmykbk5i4skxlsfcqBnpj4sbzkEctMGmzn4x2Iu8Ebvk5sInBvI6C3d8K1k1AwlBgbcma2t3i786t9oaHheu2o8ft8or9h7KinDKxail7sdBG74t5wpyn 4tEckvBKCfJuECtqHxiF w5 CL36e4LJAca7c56FDau1hMu mxqvBz3vm6m3Jsal2avkb7sbtBzsE71xwH1jt6G4LCGFtrKbb2ubqjnFEIFpKBMhm9MCFtJgwfv6ga I6ubhiBICEtBt5lorIr71rqzeAD G 9x4wAglFFgy94yqMHoKk8owjF5 ttqcF88acds34DgDpnawludG1Ivj7m1sxG4qjfcizpijEJo7M2aE2xMmA8uagDF57375yf5oyEB7Erri6dddk39ukdnIK4shdpwrz57BgsepMkp58Cw1wiiAHzKxz9mEun7 a2CchgKdBxuvddnk434GlHdaocI6IaB1E9EGB6H14dmln9u9Lewzlweu ycCo2bmCBIc GlMKA5 qJyrKE35uIlopC51FoxMCsy1qleorm6EDqLdHFMmFoxH44HutbL1 bmzuxsdqkA3 Icymhc4fg6dgzucoadq3gjnpDAyyg3kAeAGy4rcponuyMMluDkwnc2mIE7yuvffM CffLFhff gpu Hgxz7GMIe61r3Ax3BgMBD4L948mfdmdahvxKrqfd1uqFKhyzGs3bj1hskAGrBaixmB4m3DvgzBdKwq6 mwy8hyc5azwgtmDg5ffIeqKzf6Kk4bLnK7k5mddxhEKJCBMgFb7lldxG153c1Mu2dB216KymJK8aup5b53ppciDhlBb2fbHkJeEIlB31F9ssx 14Gr1LkF53 799BKfhMz7KymvkzxkH EwI4xkFenw 9xyh75E4Hvi 6heu i9e6xapb44s6BFpcG5t3J2csBCaxky5tlEtq4BvyJsA12hwCaBAJDFntKvtxnxy73JL3gfk1i6KfM8zc6MjGidpcMsnCgCd AD DbwDD2H pv6gkaA5ebzz2trBj7e6b 5tfob9fJb5AlgkAKJ5dtvyqkvFiBK gfKyjKa8v1sL DiLo F2EoJiKbhjDsFjBKCoydvAJn5Hh58G6lh7fEM7eKtpHvfiCH1Gc qmGxIl6fx9CELGod4y551xDKdcldLc2b1B9eB8wEqyCvCHuj2s4jnB6II1oiqxtiGjczf8wnF4Jzzmiq5qjuAMhu84ptk24qa87Anxla346bxoI v7 xyD9yvwDy6yD939vnbda7atzxuc532L9ix2qpc7uBbmt1dKxh1m6GwhnJuuaiwfCCdxBMqbMMl2qgHwMIp47mkqDJcarBxkBiMzr9b6wyxMnBrxr8rwm1v7i4mn6 IA57vuf7BGLitEyD 5hcbLnukh32ruysJtwhL99fbsCtdja5f9ckfcj81fsMgulg5h2d39wpofsgJKs42HHECtjenfe3 bBtLoqs6wr3InpDFBIkM39g6yexmMt19E96Isu2LHbmfssvddzHow7 G74p9

01/12/2022, 14:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryExA
ReadFile
VirtualAllocEx
CloseHandle
CopyFileW
CreateFileW
CreateProcessW
CreateThread
DeleteFileW
ExitProcess
ExpandEnvironmentStringsW
FileTimeToDosDateTime
FileTimeToLocalFileTime
FormatMessageA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
LocalAlloc
LocalFree
QueryPerformanceCounter
SetCurrentDirectoryA
SetErrorMode
SetFilePointer
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
UnhandledExceptionFilter
lstrcmpW
lstrcmpiW
lstrcpyW
lstrcpynW
lstrlenW

user32

LoadIconA
GetSysColor
LoadCursorA

msvcrt

memset
_XcptFilter
__p__commode
__p__fmode
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_adjust_fdiv
_c_exit
_cexit
_controlfp
_except_handler3
_exit
_ftol
_initterm
_ltow
_wcslwr
_wfopen
_wfullpath
_wsplitpath
exit
fclose
floor
fwprintf
swprintf
wcsncpy
wcsstr

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text2
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata3
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata2
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f905a2beb0cf6ed729895f3796c48e8

Code Sign

43:fc:1e:81:06:65:19:62:b6:1c:5b:0f:1d:6a:10:0bCertificate

Extended Key Usages

f1:ee:49:83:fc:4f:38:be:ad:5e:82:04:64:2f:3f:57:65:3c:40:3aSigner

Signature Validations

Verification

01/12/2022, 14:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcrt

Sections

.text Size: 5KB - Virtual size: 4KB

.text2 Size: 512B - Virtual size: 100B

.data Size: 273KB - Virtual size: 272KB

.rdata3 Size: 512B - Virtual size: 100B

.rdata2 Size: 512B - Virtual size: 100B

.rsrc Size: 41KB - Virtual size: 40KB

43:fc:1e:81:06:65:19:62:b6:1c:5b:0f:1d:6a:10:0b
Certificate

f1:ee:49:83:fc:4f:38:be:ad:5e:82:04:64:2f:3f:57:65:3c:40:3a
Signer

01/12/2022, 14:34
Valid: false

.text
Size: 5KB - Virtual size: 4KB

.text2
Size: 512B - Virtual size: 100B

.data
Size: 273KB - Virtual size: 272KB

.rdata3
Size: 512B - Virtual size: 100B

.rdata2
Size: 512B - Virtual size: 100B

.rsrc
Size: 41KB - Virtual size: 40KB