b47fe9377753185759de05a033528e8e27ede4e2dc59e9a1083ad557c7fe66df

Sharing

Copy URL Twitter E-mail

General

Target

b47fe9377753185759de05a033528e8e27ede4e2dc59e9a1083ad557c7fe66df
Size

367KB
MD5

833e3799e0b9cd5ff81b222c76602620
SHA1

42688e1fd3ca447b86cf79a05fd496a4f303e91f
SHA256

b47fe9377753185759de05a033528e8e27ede4e2dc59e9a1083ad557c7fe66df
SHA512

bd764adbee616060e834aaf73dee7a08d354a0a9a436297b61efcabafa464203377424896fd2c6e9eb93fc2e1f6ace11e5a293b7d7704e34ac3c6a0128d1c34a
SSDEEP

6144:ei35i/okIEicKuuVeLqIXFqp75do9wdGLaSh222YyQpcdheu+jE29czK2V2nyMbW:ls/oBPYuVeGIXFqp75doiGLaSh222YyV

Score

N/A

Malware Config

Signatures

Files

b47fe9377753185759de05a033528e8e27ede4e2dc59e9a1083ad557c7fe66df
.exe windows x86

990b33ac2e3185bbf65cf22896ef9d03

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/03/2016, 00:00

Not After

16/03/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

30:30:23:24:82:ea:69:a8:e8:69:4b:cb
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

12/07/2019, 19:28

Not After

12/07/2022, 18:58

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

36:89:c4:13:24:8e:63:d3:a2:78:b4:ea
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

12/07/2019, 18:58

Not After

12/07/2022, 18:58

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a7:c2:86:d0:f5:9b:27:a5:e7:2e:60:5c:9f:ad:55:f5:3f:36:9b:0e:4d:58:51:b8:93:2c:ad:1f:7c:6b:e5:d0
Signer

Actual PE Digest

a7:c2:86:d0:f5:9b:27:a5:e7:2e:60:5c:9f:ad:55:f5:3f:36:9b:0e:4d:58:51:b8:93:2c:ad:1f:7c:6b:e5:d0

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

18/08/2020, 20:01
Valid: true

Chain 1

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

18:9e:1c:a5:81:5c:36:d7:b3:7f:05:d2:f5:af:a9:c3:64:13:ad:a0
Signer

Actual PE Digest

18:9e:1c:a5:81:5c:36:d7:b3:7f:05:d2:f5:af:a9:c3:64:13:ad:a0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

18/08/2020, 20:01
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
CreateFileW
CreateMutexW
QueryFullProcessImageNameW
OpenProcess
CreateDirectoryW
GetTempPathW
GetFileAttributesW
GetCurrentProcess
GlobalLock
GlobalAlloc
SetEnvironmentVariableW
GetLongPathNameW
GetTickCount
GetSystemTimeAsFileTime
Sleep
GetModuleFileNameA
FindClose
FindNextFileA
FindFirstFileA
GetLocalTime
ProcessIdToSessionId
InterlockedIncrement
GetCurrentThreadId
GetModuleHandleW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetTimeZoneInformation
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
MoveFileW
DeleteFileW
FindFirstFileExW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleHandleExW
GetProcAddress
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
LoadLibraryA
FreeLibrary
GetCurrentDirectoryW
OutputDebugStringW
GetModuleFileNameW
LoadLibraryExW
CloseHandle
GetLastError
DeviceIoControl
WriteFile
CreateEventW
InterlockedDecrement
lstrlenW
LocalAlloc
LocalFree
CompareStringW
LCMapStringW
FlushFileBuffers
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetEnvironmentVariableA
InitializeCriticalSection
GetFileType
HeapAlloc
HeapFree
ReadFile
GetConsoleCP
GetConsoleMode
SetFilePointer
RaiseException
DecodePointer
EncodePointer
RtlUnwind
ExitProcess
GetCommandLineW
HeapSetInformation
GetStartupInfoW
InterlockedExchange
LoadLibraryW
GetCurrentProcessId
SetStdHandle
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
SetEndOfFile
GetProcessHeap
HeapCreate
HeapDestroy
WriteConsoleW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
IsProcessorFeaturePresent
HeapReAlloc
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter

user32

PostThreadMessageW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW
GetProcessWindowStation
wsprintfW

advapi32

CryptAcquireContextW
TraceEvent
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
RegDeleteValueW
RegNotifyChangeKeyValue
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW

shell32

SHFileOperationW

ole32

CoRevertToSelf
CoInitializeEx
CoGetInterfaceAndReleaseStream
CreateStreamOnHGlobal
CLSIDFromString
CoImpersonateClient
CoUninitialize

oleaut32

VariantInit
VariantClear

shlwapi

PathRemoveFileSpecA
PathAppendW
PathFindFileNameW
StrStrIW
PathFileExistsW
wnsprintfW
StrCmpIW

wintrust

WinVerifyTrust

rpcrt4

UuidCreate

psapi

EnumProcesses

advpack

ExtractFilesW

Sections

.text
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

990b33ac2e3185bbf65cf22896ef9d03

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51Certificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

30:30:23:24:82:ea:69:a8:e8:69:4b:cbCertificate

Extended Key Usages

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

36:89:c4:13:24:8e:63:d3:a2:78:b4:eaCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

a7:c2:86:d0:f5:9b:27:a5:e7:2e:60:5c:9f:ad:55:f5:3f:36:9b:0e:4d:58:51:b8:93:2c:ad:1f:7c:6b:e5:d0Signer

Signature Validations

Verification

18/08/2020, 20:01 Valid: true

Chain 1

18:9e:1c:a5:81:5c:36:d7:b3:7f:05:d2:f5:af:a9:c3:64:13:ad:a0Signer

Signature Validations

Verification

18/08/2020, 20:01 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wintrust

rpcrt4

psapi

advpack

Sections

.text Size: 113KB - Virtual size: 113KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 5KB - Virtual size: 16KB

.rsrc Size: 193KB - Virtual size: 192KB

.reloc Size: 10KB - Virtual size: 9KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

30:30:23:24:82:ea:69:a8:e8:69:4b:cb
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

36:89:c4:13:24:8e:63:d3:a2:78:b4:ea
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

a7:c2:86:d0:f5:9b:27:a5:e7:2e:60:5c:9f:ad:55:f5:3f:36:9b:0e:4d:58:51:b8:93:2c:ad:1f:7c:6b:e5:d0
Signer

18/08/2020, 20:01
Valid: true

18:9e:1c:a5:81:5c:36:d7:b3:7f:05:d2:f5:af:a9:c3:64:13:ad:a0
Signer

18/08/2020, 20:01
Valid: false

.text
Size: 113KB - Virtual size: 113KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 5KB - Virtual size: 16KB

.rsrc
Size: 193KB - Virtual size: 192KB

.reloc
Size: 10KB - Virtual size: 9KB