FeatureLicence[.]exe[.]7z

Sharing

Copy URL

Twitter E-mail

General

Target

FeatureLicence.exe.7z
Size

66KB
MD5

77a487381745213cc72c04510146fe6d
SHA1

af356b404fdfdfaab6bcabafc27d788a525b078b
SHA256

36fe4ed0dddffd95358fc4090b5b9fbd5e860c106f44e0e00655a35052837ac3
SHA512

6b8b88f9ee7d3a6561a372a72e7910bfbf3179ccd9bf0b376a34b0f973910ca5244ac46ace01afb5e6e4a2519497aecf46a62f99b8f0076e8f4936a1fcfce772
SSDEEP

1536:N5LfXk2e9Q+VOzE19czwRKHtaJpgZKeOBHv2IwmpQe7FKU0:N5LfXkN9TVmE19c8RKH0mOkI9r0

Score

N/A

Malware Config

Signatures

Files

FeatureLicence.exe.7z
.7z

Password: infected
FeatureLicence.exe
.exe windows x86

Password: infected

168cb26e07678b00baec4e65c76e00db

Code Sign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:43:41:04:ac:ec:02:95:3d:31:f5:3a:a2:62:f5:e4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

24/12/2021, 00:00

Not After

02/01/2025, 23:59

Subject

CN=ASM Assembly Systems Weymouth Ltd,O=ASM Assembly Systems Weymouth Ltd,L=Weymouth,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:43:41:04:ac:ec:02:95:3d:31:f5:3a:a2:62:f5:e4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

24/12/2021, 00:00

Not After

02/01/2025, 23:59

Subject

CN=ASM Assembly Systems Weymouth Ltd,O=ASM Assembly Systems Weymouth Ltd,L=Weymouth,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

db:40:6d:46:51:19:89:65:af:2b:f7:a4:ca:52:7c:df:b6:7c:8b:21:2d:1a:2b:a7:87:85:b7:1f:6c:b1:d4:f1
Signer

Actual PE Digest

db:40:6d:46:51:19:89:65:af:2b:f7:a4:ca:52:7c:df:b6:7c:8b:21:2d:1a:2b:a7:87:85:b7:1f:6c:b1:d4:f1

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=ASM Assembly Systems Weymouth Ltd,O=ASM Assembly Systems Weymouth Ltd,L=Weymouth,C=GB

15/12/2022, 14:00
Valid: true

Chain 1

CN=ASM Assembly Systems Weymouth Ltd,O=ASM Assembly Systems Weymouth Ltd,L=Weymouth,C=GB

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

49:80:30:0f:5d:c2:61:8f:2a:bf:6d:f6:85:55:59:41:ff:44:a6:4c
Signer

Actual PE Digest

49:80:30:0f:5d:c2:61:8f:2a:bf:6d:f6:85:55:59:41:ff:44:a6:4c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=ASM Assembly Systems Weymouth Ltd,O=ASM Assembly Systems Weymouth Ltd,L=Weymouth,C=GB

06/04/2022, 09:59
Valid: true

Chain 1

CN=ASM Assembly Systems Weymouth Ltd,O=ASM Assembly Systems Weymouth Ltd,L=Weymouth,C=GB

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

zlib

ord22
ord19
ord20

mfc80

ord2020
ord4890
ord4212
ord5182
ord3641
ord4541
ord3683
ord3333
ord4261
ord4481
ord2838
ord5566
ord5213
ord5230
ord4568
ord3948
ord2248
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord1655
ord3163
ord3204
ord3161
ord4735
ord1671
ord764
ord1185
ord1187
ord1191
ord266
ord265
ord3255
ord1181
ord5320
ord2346
ord6286
ord1580
ord5331
ord6297
ord1599
ord5200
ord2537
ord2731
ord2835
ord4307
ord2714
ord2862
ord2540
ord2646
ord1670
ord1551
ord6724
ord5912
ord1620
ord1617
ord3946
ord1401
ord4244
ord5152
ord1908
ord5073
ord6275
ord4185
ord5203
ord3403
ord4722
ord4282
ord1600
ord5960
ord5235
ord3394
ord2471
ord1448
ord2312
ord918
ord6213
ord4058
ord6293
ord5233
ord923
ord928
ord932
ord930
ord934
ord2390
ord2410
ord2394
ord2400
ord2398
ord2396
ord2413
ord2408
ord2392
ord2415
ord2403
ord2385
ord2387
ord2405
ord2178
ord2172
ord1522
ord6279
ord3802
ord6277
ord3345
ord4967
ord1362
ord5327
ord2908
ord5880
ord5628
ord2123
ord5089
ord2750
ord2753
ord5175
ord1964
ord4580
ord1656
ord1207
ord1084
ord2533
ord3718
ord3719
ord3709
ord2644
ord3949
ord4486
ord4262
ord3182
ord310
ord3210
ord2746
ord3096
ord3282
ord489
ord707
ord1975
ord1288
ord605
ord578
ord784
ord354
ord1892
ord6236
ord1123
ord876
ord757
ord566
ord297
ord781
ord2322
ord304
ord1054
ord5716
ord1934
ord1280
ord1063
ord1279
ord5637
ord2902
ord4749
ord709
ord501
ord602
ord1929
ord347
ord5731
ord3406
ord2657
ord2367
ord745
ord557
ord1482
ord3022
ord907
ord911
ord2034
ord508
ord630
ord3088
ord2021
ord385
ord2168
ord6067
ord4035
ord1873
ord1774
ord2451
ord1489
ord6118
ord299
ord6703
ord2176
ord1122
ord1308
ord3934
ord762
ord5563
ord2131
ord744
ord1452
ord5097
ord556
ord1486
ord3997
ord5346
ord869
ord3395
ord3850
ord4108
ord5529
ord865
ord5430
ord3818
ord2271
ord4109
ord5403
ord2468
ord663
ord426
ord3236
ord4066

msvcr80

_itoa
_strnicmp
_stricmp
_setmbcp
malloc
free
_purecall
memset
_crt_debugger_hook
_controlfp_s
_invoke_watson
_decode_pointer
_onexit
_lock
__dllonexit
strcpy_s
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
_access
strlen
fclose
fgets
fopen
isalpha
__FrameUnwindFilter
atoi
strncpy
fwrite
atol
wcstombs
mbstowcs
atof
feof
fread
ferror
strtol
strtoul
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memmove_s
strchr
fprintf
clearerr
strncat
sscanf
strtok
fscanf
ftell
fseek
strstr
_mktime64
_time64
rand
srand
strncmp
_unlock
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
__CxxFrameHandler3
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale

kernel32

GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
GetLastError
GetCurrentThreadId
InterlockedExchange
GetDriveTypeA
GetModuleFileNameA
SetFileAttributesA
GetFileAttributesA
GetComputerNameA
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetLocaleInfoA
GetVersionExA
GetThreadLocale

user32

LoadIconA
InvalidateRect
GetClientRect
IsIconic
DrawIcon
FrameRect
FillRect
GetSystemMetrics
SendMessageA
EnableWindow
OffsetRect
InflateRect
GetSysColor
LoadBitmapA
MessageBeep

dk2win32

ord13
ord18
ord17
ord20
ord4
ord19
ord9
ord2
ord36
ord57
ord56
ord10
ord7

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

dk2ru32

ord5

gdi32

EndPage
StartPage
StartDocA
TextOutA
BitBlt
CreateCompatibleDC
CreateFontA
CreateSolidBrush
GetObjectA
EndDoc

advapi32

CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDecrypt

ole32

CreateStreamOnHGlobal
CoInitialize
CoCreateInstance
CoUninitialize

msvcm80

?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

mscoree

_CorExeMain

Sections

.text
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

168cb26e07678b00baec4e65c76e00db

Code Sign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

03:43:41:04:ac:ec:02:95:3d:31:f5:3a:a2:62:f5:e4Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:43:41:04:ac:ec:02:95:3d:31:f5:3a:a2:62:f5:e4Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

db:40:6d:46:51:19:89:65:af:2b:f7:a4:ca:52:7c:df:b6:7c:8b:21:2d:1a:2b:a7:87:85:b7:1f:6c:b1:d4:f1Signer

Signature Validations

Verification

15/12/2022, 14:00 Valid: true

Chain 1

49:80:30:0f:5d:c2:61:8f:2a:bf:6d:f6:85:55:59:41:ff:44:a6:4cSigner

Signature Validations

Verification

06/04/2022, 09:59 Valid: true

Chain 1

Headers

File Characteristics

Imports

zlib

mfc80

msvcr80

kernel32

user32

dk2win32

version

dk2ru32

gdi32

advapi32

ole32

msvcm80

msvcp80

mscoree

Sections

.text Size: 72KB - Virtual size: 70KB

.rdata Size: 96KB - Virtual size: 93KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 12KB - Virtual size: 9KB

.reloc Size: 12KB - Virtual size: 10KB

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

03:43:41:04:ac:ec:02:95:3d:31:f5:3a:a2:62:f5:e4
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:43:41:04:ac:ec:02:95:3d:31:f5:3a:a2:62:f5:e4
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

db:40:6d:46:51:19:89:65:af:2b:f7:a4:ca:52:7c:df:b6:7c:8b:21:2d:1a:2b:a7:87:85:b7:1f:6c:b1:d4:f1
Signer

15/12/2022, 14:00
Valid: true

49:80:30:0f:5d:c2:61:8f:2a:bf:6d:f6:85:55:59:41:ff:44:a6:4c
Signer

06/04/2022, 09:59
Valid: true

.text
Size: 72KB - Virtual size: 70KB

.rdata
Size: 96KB - Virtual size: 93KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 12KB - Virtual size: 9KB

.reloc
Size: 12KB - Virtual size: 10KB