c0036195bb7a23e6800420c46fad86725bf7a1a4da24c688dde304f8e42674d1

Resubmissions

23-10-2023 12:19

231023-phhnysae25 7

12-01-2023 07:49

230112-jnz8asfe24 7

Sharing

Copy URL

Twitter E-mail

General

Target

c0036195bb7a23e6800420c46fad86725bf7a1a4da24c688dde304f8e42674d1
Size

2.2MB
MD5

edcd5ff1c2af9451405d430052c60660
SHA1

a55ac633303713c61b0dd475bba409e00640d739
SHA256

c0036195bb7a23e6800420c46fad86725bf7a1a4da24c688dde304f8e42674d1
SHA512

1e85cf10e05cce9744e3861787102e40abbbe593e507365e980db04abd1cbbebe3d3feb26da22221f6c1987cc0665f66328c4d09e2229bf7cf28d95697c78f46
SSDEEP

6144:uImoAFu+OykdGpxysrz5Tjuf9/ddlZi3F23FukA1kAb0rEbrESZU8wFjNHN:FGONdGpxyoljc/d9EM3E790rEbrEz

Score

N/A

Malware Config

Signatures

Files

c0036195bb7a23e6800420c46fad86725bf7a1a4da24c688dde304f8e42674d1
.iso
MSVCR100.dll
.dll windows x86

9662607dfb16be6cfdcd51e7eb1e9cbb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
CreateFileA
GetProcAddress
LoadLibraryA
GetModuleFileNameA
CloseHandle
GetCurrentThread
WaitForSingleObject
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

msvcr90

_encoded_null
_decode_pointer
_initterm
_malloc_crt
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_encode_pointer
fclose
fseek
ftell
fread
fopen
strtok
strncpy
rewind
malloc
calloc
free
_initterm_e
_stricmp
_XcptFilter
__getmainargs
__set_app_type
__setusermatherr
_cexit
_configthreadlocale
_controlfp_s
_exit
_invoke_watson
_ismbblead
exit
wcsncat_s
memcpy

Exports

Exports

?terminate@@YAXXZ
_XcptFilter
__dllonexit
__getmainargs
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_configthreadlocale
_controlfp_s
_crt_debugger_hook
_except_handler4_common
_exit
_fmode
_initterm
_initterm_e
_invoke_watson
_ismbblead
_lock
_onexit
_unlock
exit
wcsncat_s

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 538B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Updates on AJEX DAGITPA 2022 on 200900 Oct 22.pdf
.pdf
Updates on AJEX DAGITPA 2022 on 200900 Oct 22.pdf.exe
.exe windows x86

476969f0db7933adc8a837a099dcb8ae

Code Sign

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26-07-2012 20:50

Not After

26-10-2013 20:50

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09-01-2012 22:25

Not After

09-04-2013 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:65:8a:97:14:c0:64:cb:13:32:88:33:a1:b3:1d:6c:35:5f:96:ef
Signer

Actual PE Digest

0b:65:8a:97:14:c0:64:cb:13:32:88:33:a1:b3:1d:6c:35:5f:96:ef

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

01-10-2012 10:19
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetSystemDirectoryW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
WerRegisterMemoryBlock
VirtualProtect
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
HeapSetInformation
GetProcessHeap
QueryPerformanceCounter

msvcr100

_invoke_watson
_controlfp_s
_except_handler4_common
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
wcsncat_s
_onexit

Exports

Exports

DllGetLCID
wdCommandDispatch
wdGetApplicationObject

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

9662607dfb16be6cfdcd51e7eb1e9cbb

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr90

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 1024B - Virtual size: 538B

476969f0db7933adc8a837a099dcb8ae

Code Sign

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88Certificate

Extended Key Usages

Key Usages

61:02:8e:42:00:00:00:00:00:1fCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

0b:65:8a:97:14:c0:64:cb:13:32:88:33:a1:b3:1d:6c:35:5f:96:efSigner

Signature Validations

Verification

01-10-2012 10:19 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr100

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 900B

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.reloc Size: 512B - Virtual size: 396B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 1024B - Virtual size: 538B

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Certificate

61:02:8e:42:00:00:00:00:00:1f
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

0b:65:8a:97:14:c0:64:cb:13:32:88:33:a1:b3:1d:6c:35:5f:96:ef
Signer

01-10-2012 10:19
Valid: false

.text
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 900B

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 512B - Virtual size: 396B