dd449e8ffbfa6e8911ba64f2e4625fdb3f12f17b7933845f39985a49ca514b42

Sharing

Copy URL Twitter E-mail

General

Target

dd449e8ffbfa6e8911ba64f2e4625fdb3f12f17b7933845f39985a49ca514b42
Size

26KB
MD5

eb98e14d0f82d3ddbbe861cae83e5629
SHA1

3b7c07251a4d2d3960f572119aad95a1901a8a0e
SHA256

dd449e8ffbfa6e8911ba64f2e4625fdb3f12f17b7933845f39985a49ca514b42
SHA512

397bba54ee8c80751cb7d9c22634602f8abfb93efe7a7f02806955852086a91c0d33cf8ca8331833d357e5bfb91f2facad618372b0d5e66fcb414d49949f38e3
SSDEEP

768:1IS0PLISmFHsPwjPkDa37tw8xpua473mlhhde:1I7DIddpjPYa24ua23mlhhde

Score

N/A

Malware Config

Signatures

Files

dd449e8ffbfa6e8911ba64f2e4625fdb3f12f17b7933845f39985a49ca514b42
.exe windows x86

7872a014f4677ed9d938c113aecb4111

Code Sign

1f:94:ed:d6:61:61:a7:bb:49:21:58:0f:bc:15:8f:59
Certificate

Issuer

CN=235235623562

Not Before

23/02/2012, 07:47

Not After

31/12/2039, 23:59

Subject

CN=235235623562

Extended Key Usages

ExtKeyUsageCodeSigning

3b:0a:3a:33:83:45:60:bf:19:6f:15:1a:33:47:93:78:cd:f4:43:67
Signer

Actual PE Digest

3b:0a:3a:33:83:45:60:bf:19:6f:15:1a:33:47:93:78:cd:f4:43:67

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=235235623562

01/12/2022, 14:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalUnlock
LockFile
LockFileEx
LockResource
MapUserPhysicalPagesScatter
MapViewOfFileEx
Module32NextW
MoveFileW
MoveFileWithProgressA
OpenFileMappingA
OpenSemaphoreW
OpenWaitableTimerA
PostQueuedCompletionStatus
Process32Next
PurgeComm
QueryPerformanceCounter
RaiseException
ReadConsoleInputA
ReadConsoleOutputA
ReadDirectoryChangesW
ReadFileScatter
RemoveDirectoryA
ReplaceFileA
RequestWakeupLatency
ResumeThread
SetComputerNameA
SetConsoleCP
SetConsoleCursorInfo
SetConsoleDisplayMode
SetConsoleTitleW
LocalCompact
SetFileAttributesA
SetFilePointer
SetInformationJobObject
SetLocaleInfoW
SetPriorityClass
SetTapeParameters
SetThreadExecutionState
SetVolumeMountPointA
SwitchToThread
SystemTimeToTzSpecificLocalTime
TlsAlloc
TlsFree
TlsSetValue
TransactNamedPipe
UnregisterWait
UnregisterWaitEx
VerifyVersionInfoW
VirtualProtect
WaitForDebugEvent
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObjectEx
WriteConsoleInputW
WriteFileEx
_lclose
_lwrite
lstrcmpW
lstrcmpi
lstrcpyW
LeaveCriticalSection
IsProcessorFeaturePresent
IsBadStringPtrW
HeapCreate
Heap32ListFirst
Heap32First
GlobalUnlock
GlobalUnfix
GlobalGetAtomNameW
GlobalDeleteAtom
GlobalCompact
GetWindowsDirectoryW
GetVolumePathNameA
GetVolumeInformationW
GetThreadSelectorEntry
GetTapeStatus
GetSystemDirectoryA
GetStringTypeW
GetProfileStringA
GetProfileIntA
GetProcessShutdownParameters
GetProcessPriorityBoost
GetProcessIoCounters
GetPrivateProfileStructA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesW
GetNamedPipeHandleStateW
GetModuleFileNameW
GetMailslotInfo
GetModuleHandleA
GetLocalTime
GetFullPathNameW
GetFullPathNameA
GetFileTime
GetFileAttributesW
GetExitCodeThread
GetDiskFreeSpaceExW
GetDateFormatA
GetCurrentDirectoryA
GetCurrencyFormatW
GetConsoleTitleA
GetConsoleAliasW
GetCommandLineA
GetCommConfig
GetCalendarInfoW
GetAtomNameA
FreeResource
FreeLibrary
FreeEnvironmentStringsA
FormatMessageA
FoldStringW
FindCloseChangeNotification
FillConsoleOutputCharacterA
EscapeCommFunction
EnumResourceNamesA
EnumResourceLanguagesA
DosDateTimeToFileTime
DeleteVolumeMountPointA
DeleteFileW
CreateToolhelp32Snapshot
CreateThread
CreateMutexW
CreateJobObjectA
CreateHardLinkA
CreateFileA
CreateEventA
CopyFileW
CompareStringA
CloseHandle
CancelWaitableTimer
CancelDeviceWakeupRequest
BuildCommDCBAndTimeoutsA
BuildCommDCBA
AreFileApisANSI
GetProcAddress
SetEvent

msvcrt

memset

advapi32

RegOpenKeyExW

oleaut32

VarI2FromI1
VarI2FromI4
VarI2FromR4
VarI2FromR8
VarI2FromStr
VarI2FromUI4
VarI4FromDate
VarI4FromI2
VarIdiv
VarMod
VarMonthName
VarNumFromParseNum
VarParseNumFromStr
VarR4FromDec
VarR4FromR8
VarR4FromStr
VarR4FromUI1
VarR4FromUI4
VarR8FromCy
VarR8FromDate
VarR8FromDec
VarR8FromI1
VarR8FromI2
VarR8FromR4
VarR8Round
VarRound
VarTokenizeFormatString
VarUI1FromBool
VarUI1FromDate
VarUI1FromR4
VarUI1FromR8
VarUI1FromUI4
VarUI2FromDate
VarUI2FromDec
VarUI2FromI1
VarUI2FromR8
VarUI2FromUI4
VarUI4FromBool
VarUI4FromDec
VarUI4FromR8
VarUI4FromUI1
VarUdateFromDate
VarWeekdayName
VariantChangeType
VarI2FromDisp
VarI2FromBool
VarI1FromStr
VarI1FromR4
VarI1FromI4
VarI1FromI2
VarI1FromCy
VarI1FromBool
VarFormatCurrency
VarEqv
VarDecNeg
VarDecFromUI2
VarDecFromUI1
VarDecFromI2
VarDecFromI1
VarDecCmpR8
VarDecAdd
VarDateFromUdateEx
VarDateFromUI4
VarDateFromUI2
VarDateFromR4
VarDateFromI4
VarDateFromI1
VarDateFromDisp
VarDateFromDec
VarDateFromBool
VarCyNeg
VarCyFromUI4
VarCyFromI4
VarCyFromDate
VarCyFix
VarCat
VarBstrFromDec
VarBstrFromDate
VarBstrFromBool
VarBoolFromR8
VarBoolFromR4
VarBoolFromI2
VarBoolFromI1
VARIANT_UserUnmarshal
SystemTimeToVariantTime
SysReAllocString
SysAllocStringByteLen
SysAllocString
SafeArrayUnlock
SafeArrayUnaccessData
SafeArrayPutElement
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetElement
SafeArrayGetDim
SafeArrayDestroy
SafeArrayCreateVector
SafeArrayCreate
SafeArrayCopy
SafeArrayAccessData
RevokeActiveObject
RegisterActiveObject
QueryPathOfRegTypeLi
OleTranslateColor
OleLoadPictureFileEx
OleLoadPicture
OleIconToCursor
OleCreatePropertyFrameIndirect
OaBuildVersion
GetRecordInfoFromGuids
GetAltMonthNames
DispGetIDsOfNames
DispCallFunc
BSTR_UserUnmarshal
BSTR_UserMarshal
SafeArraySetRecordInfo

imm32

ImmConfigureIMEA
ImmConfigureIMEW
ImmCreateContext
ImmCreateIMCC
ImmCreateSoftKeyboard
ImmDestroyContext
ImmDestroyIMCC
ImmDestroySoftKeyboard
ImmEnumInputContext
ImmEscapeA
ImmEscapeW
ImmGetCandidateListA
ImmGetCandidateListCountA
ImmGetCandidateListW
ImmGetCandidateWindow
ImmGetCompositionFontA
ImmGetCompositionFontW
ImmGetCompositionStringA
ImmGetCompositionStringW
ImmGetCompositionWindow
ImmGetContext
ImmGetConversionListA
ImmGetConversionListW
ImmGetConversionStatus
ImmGetDefaultIMEWnd
ImmGetDescriptionA
ImmGetDescriptionW
ImmGetGuideLineA
ImmGetGuideLineW
ImmGetHotKey
ImmGetIMCCLockCount
ImmGetIMCCSize
ImmGetIMCLockCount
ImmGetIMEFileNameA
ImmAssociateContextEx
ImmGetImeMenuItemsA
ImmGetImeMenuItemsW
ImmGetOpenStatus
ImmGetProperty
ImmGetRegisterWordStyleA
ImmGetRegisterWordStyleW
ImmGetStatusWindowPos
ImmGetVirtualKey
ImmInstallIMEA
ImmInstallIMEW
ImmIsIME
ImmIsUIMessageA
ImmLockIMC
ImmLockIMCC
ImmNotifyIME
ImmReSizeIMCC
ImmRegisterWordA
ImmRegisterWordW
ImmReleaseContext
ImmRequestMessageA
ImmRequestMessageW
ImmSetCandidateWindow
ImmSetCompositionFontA
ImmSetCompositionStringA
ImmSetCompositionStringW
ImmSetCompositionWindow
ImmSetConversionStatus
ImmSetHotKey
ImmSetOpenStatus
ImmSetStatusWindowPos
ImmShowSoftKeyboard
ImmSimulateHotKey
ImmUnlockIMC
ImmUnlockIMCC
ImmGetIMEFileNameW
ImmUnregisterWordA
ImmUnregisterWordW
ImmAssociateContext

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text1
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text2
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text4
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text3
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7872a014f4677ed9d938c113aecb4111

Code Sign

1f:94:ed:d6:61:61:a7:bb:49:21:58:0f:bc:15:8f:59Certificate

Extended Key Usages

3b:0a:3a:33:83:45:60:bf:19:6f:15:1a:33:47:93:78:cd:f4:43:67Signer

Signature Validations

Verification

01/12/2022, 14:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

oleaut32

imm32

Sections

.text Size: 8KB - Virtual size: 8KB

.text1 Size: 2KB - Virtual size: 1KB

.text2 Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 152B

.text4 Size: 1024B - Virtual size: 1000B

.text3 Size: 1024B - Virtual size: 1000B

.rsrc Size: 3KB - Virtual size: 2KB

1f:94:ed:d6:61:61:a7:bb:49:21:58:0f:bc:15:8f:59
Certificate

3b:0a:3a:33:83:45:60:bf:19:6f:15:1a:33:47:93:78:cd:f4:43:67
Signer

01/12/2022, 14:34
Valid: false

.text
Size: 8KB - Virtual size: 8KB

.text1
Size: 2KB - Virtual size: 1KB

.text2
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 152B

.text4
Size: 1024B - Virtual size: 1000B

.text3
Size: 1024B - Virtual size: 1000B

.rsrc
Size: 3KB - Virtual size: 2KB