f8a134b7e92ca4a5990c3b5df43261a78f73f7bd41df2532fcb134e16de450c6

Sharing

Copy URL Twitter E-mail

General

Target

f8a134b7e92ca4a5990c3b5df43261a78f73f7bd41df2532fcb134e16de450c6
Size

23KB
MD5

692fe5f18429a1b1c3489941785b382a
SHA1

da746ffe074866d15595aa09b82f4317f3764419
SHA256

f8a134b7e92ca4a5990c3b5df43261a78f73f7bd41df2532fcb134e16de450c6
SHA512

e98b8f0864fd9fc87a169198e69a78bb6d90252dc647bbf646f25b6980d896bd826a67e8bbf7f85111d0f2b6a4628bd2103f60fe0c2ec756be9771fe92d177bd
SSDEEP

384:mOJW/T2bktu0qiXDO1zLDh2UTBN7FPkDvjaKhh4WWieZWR7:mem2beu0wdLokBpCDvuKhhdeW

Score

N/A

Malware Config

Signatures

Files

f8a134b7e92ca4a5990c3b5df43261a78f73f7bd41df2532fcb134e16de450c6
.exe windows x86

79b36616405c011a0a0e2f0125e62613

Code Sign

69:75:f2:4e:2a:ca:f4:7f:b6:45:60:ad:50:b3:14:2b
Certificate

Issuer

CN=eryf2w4v6y2w

Not Before

25/02/2012, 10:44

Not After

31/12/2039, 23:59

Subject

CN=eryf2w4v6y2w

Extended Key Usages

ExtKeyUsageCodeSigning

ac:a7:ca:99:87:26:58:8e:94:b5:36:0e:74:1a:c3:8c:d2:86:b1:99
Signer

Actual PE Digest

ac:a7:ca:99:87:26:58:8e:94:b5:36:0e:74:1a:c3:8c:d2:86:b1:99

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=eryf2w4v6y2w

01/12/2022, 14:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalMemoryStatus
Heap32ListNext
InitAtomTable
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LocalHandle
LocalShrink
LocalUnlock
Module32Next
OpenEventW
OpenSemaphoreA
OutputDebugStringA
PeekConsoleInputA
Process32FirstW
ReadConsoleInputA
ReadConsoleOutputAttribute
RemoveDirectoryW
RtlUnwind
GlobalCompact
SetCommState
SetComputerNameA
SetConsoleCursorInfo
SetConsoleMode
SetConsoleScreenBufferSize
SetConsoleTitleA
SetEnvironmentVariableW
SetFileAttributesW
SetFileTime
SetProcessWorkingSetSize
SetThreadExecutionState
TerminateJobObject
Thread32First
WaitForMultipleObjectsEx
WaitNamedPipeW
WriteConsoleOutputW
_llseek
lstrcpynW
lstrlenA
GetWindowsDirectoryW
GetVolumeInformationW
GetVolumeInformationA
GetTimeFormatA
GetThreadLocale
GetTempFileNameW
GetStringTypeExA
GetStartupInfoW
GetProcessWorkingSetSize
GetProcessPriorityBoost
GetProcessIoCounters
GetProcessHeap
GetModuleHandleW
GetLocalTime
GetHandleInformation
GetFileAttributesExA
GetEnvironmentVariableA
GetEnvironmentStrings
GetDefaultCommConfigW
GetCurrencyFormatW
GetConsoleOutputCP
GetConsoleAliasesLengthA
GetConsoleAliasesA
GetCommProperties
GetModuleHandleA
GetCalendarInfoA
GetACP
FreeUserPhysicalPages
FreeEnvironmentStringsW
FindVolumeMountPointClose
FindResourceA
FindNextVolumeW
FindNextChangeNotification
ExitThread
EraseTape
EnumUILanguagesA
EnumTimeFormatsA
EnumSystemLanguageGroupsW
EnumResourceLanguagesA
EnumDateFormatsA
EnumCalendarInfoA
CreateWaitableTimerA
CreateSemaphoreA
CreateMutexA
CreateMailslotW
CreateJobObjectW
CreateHardLinkW
CreateEventW
CreateDirectoryExA
CopyFileW
CopyFileExW
ConvertThreadToFiber
CancelDeviceWakeupRequest
CallNamedPipeW
BuildCommDCBW
BuildCommDCBAndTimeoutsW
BindIoCompletionCallback
BeginUpdateResourceW
GetProcAddress
SearchPathW

msvcrt

memset

advapi32

RegOpenKeyExA

oleaut32

VarI2FromDec
VarI4FromBool
VarI4FromDec
VarI4FromDisp
VarI4FromR4
VarI4FromR8
VarI4FromUI1
VarMonthName
VarNumFromParseNum
VarR4FromCy
VarR4FromDate
VarR4FromR8
VarR4FromUI4
VarR8FromI1
VarR8FromUI2
VarR8FromUI4
VarUI1FromBool
VarUI1FromCy
VarUI2FromBool
VarUI2FromDisp
VarUI2FromR4
VarUI2FromStr
VarUI4FromCy
VarUI4FromI1
VarUI4FromStr
VarWeekdayName
VarXor
VariantChangeType
VariantCopy
VariantInit
VectorFromBstr
VarI1FromUI4
VarFix
VarDecMul
VarDecFromUI2
VarDecFromStr
VarDecFromR8
VarDecFromI4
VarDecFromCy
VarDecFromBool
VarDecCmp
VarDecAdd
VarDateFromUI1
VarDateFromStr
VarDateFromR4
VarDateFromI2
VarDateFromDec
VarDateFromCy
VarCyRound
VarCyNeg
VarCyMulI4
VarCyFromR8
VarCyFromI2
VarBstrFromUI4
VarBstrFromUI2
VarBstrFromUI1
VarBstrFromI4
VarBstrFromI1
VarBstrFromCy
VarBoolFromR8
VarAnd
SysAllocStringLen
SysAllocString
SetErrorInfo
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayCreateVectorEx
SafeArrayCreateVector
SafeArrayCopyData
SafeArrayAllocData
QueryPathOfRegTypeLi
OleTranslateColor
OleIconToCursor
LoadRegTypeLi
LPSAFEARRAY_UserUnmarshal
LHashValOfNameSysA
LHashValOfNameSys
GetRecordInfoFromGuids
GetAltMonthNames
DosDateTimeToVariantTime
DispInvoke
DispGetIDsOfNames
CreateDispTypeInfo
BstrFromVector
BSTR_UserSize
BSTR_UserMarshal
SafeArrayGetElement

imm32

ImmDestroyContext
ImmDestroyIMCC
ImmDestroySoftKeyboard
ImmEnumInputContext
ImmEnumRegisterWordA
ImmEnumRegisterWordW
ImmEscapeW
ImmGetCandidateListA
ImmGetCandidateListCountA
ImmGetCandidateListCountW
ImmGetCandidateListW
ImmGetCompositionFontW
ImmGetCompositionStringA
ImmGetCompositionStringW
ImmGetContext
ImmGetConversionListA
ImmGetConversionListW
ImmGetConversionStatus
ImmGetDescriptionA
ImmGetDescriptionW
ImmGetGuideLineA
ImmGetGuideLineW
ImmGetHotKey
ImmGetIMCCLockCount
ImmGetIMCCSize
ImmGetIMEFileNameA
ImmCreateIMCC
ImmGetImeMenuItemsA
ImmGetProperty
ImmGetRegisterWordStyleA
ImmGetStatusWindowPos
ImmGetVirtualKey
ImmInstallIMEW
ImmIsIME
ImmIsUIMessageA
ImmIsUIMessageW
ImmLockIMC
ImmNotifyIME
ImmRegisterWordA
ImmRegisterWordW
ImmReleaseContext
ImmRequestMessageA
ImmSetCandidateWindow
ImmSetCompositionFontA
ImmSetCompositionFontW
ImmSetCompositionStringA
ImmSetCompositionStringW
ImmSetCompositionWindow
ImmSetConversionStatus
ImmSetHotKey
ImmSetOpenStatus
ImmShowSoftKeyboard
ImmSimulateHotKey
ImmGetIMEFileNameW
ImmUnlockIMCC
ImmUnregisterWordA
ImmConfigureIMEW

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text2
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text4
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text3
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79b36616405c011a0a0e2f0125e62613

Code Sign

69:75:f2:4e:2a:ca:f4:7f:b6:45:60:ad:50:b3:14:2bCertificate

Extended Key Usages

ac:a7:ca:99:87:26:58:8e:94:b5:36:0e:74:1a:c3:8c:d2:86:b1:99Signer

Signature Validations

Verification

01/12/2022, 14:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

oleaut32

imm32

Sections

.text Size: 7KB - Virtual size: 6KB

.text1 Size: 1KB - Virtual size: 1KB

.text2 Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 108B

.text4 Size: 1024B - Virtual size: 1000B

.text3 Size: 1024B - Virtual size: 1000B

.rsrc Size: 3KB - Virtual size: 2KB

69:75:f2:4e:2a:ca:f4:7f:b6:45:60:ad:50:b3:14:2b
Certificate

ac:a7:ca:99:87:26:58:8e:94:b5:36:0e:74:1a:c3:8c:d2:86:b1:99
Signer

01/12/2022, 14:34
Valid: false

.text
Size: 7KB - Virtual size: 6KB

.text1
Size: 1KB - Virtual size: 1KB

.text2
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 108B

.text4
Size: 1024B - Virtual size: 1000B

.text3
Size: 1024B - Virtual size: 1000B

.rsrc
Size: 3KB - Virtual size: 2KB