a65d6ab65ca16500bc4757a2ee122d3864f7c6ed

Sharing

Copy URL

Twitter E-mail

General

Target

a65d6ab65ca16500bc4757a2ee122d3864f7c6ed
Size

13.3MB
MD5

9ef1215e4adb8b59cceff6eb0c1114e8
SHA1

a65d6ab65ca16500bc4757a2ee122d3864f7c6ed
SHA256

1f320d440c6ac0917e3d6ef9301c5946c26b75b1db2f848f30ec1cf27ff866a2
SHA512

56f3dc5c5b406846e6cbdb89ecb1cd716800fa4a79c6f997615155a6aee6f959493aa1b64f42ed619cdea13cc30e02d2ba1379719a8de6b34a56fbb5eea3f1b7
SSDEEP

98304:yq4jMT5dqxQ7uO5DZSv0KsFKN2GQRPQXP3KJ2grs8GPxTrlWheJDHKYEJwcdoI:Z4jsMv0KsQPrdPxTIUmn

Score

1^/10

Malware Config

Signatures

Files

a65d6ab65ca16500bc4757a2ee122d3864f7c6ed
.exe windows x64

d23077f7c0f33c283be753954c058d94

Code Sign

af:f3:c7:7f:8c:1d:78:ad:35:94:c4:57:7d:a9:2b:a8
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19-02-2021 00:00

Not After

19-02-2024 23:59

Subject

CN=PUYBARET EMMANUEL,OU=IT,O=PUYBARET EMMANUEL,POSTALCODE=75015,STREET=35 rue de Chambery,L=Paris,ST=Ile de France,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31-05-2021 06:43

Not After

17-09-2029 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

19-05-2021 05:42

Not After

18-05-2032 05:42

Subject

CN=Certum Timestamp 2021,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19-05-2021 05:32

Not After

18-05-2036 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:f3:31:9a:31:11:a1:e7:2b:f4:2d:a4:b0:17:46:d2:7a:04:46:8c
Signer

Actual PE Digest

38:f3:31:9a:31:11:a1:e7:2b:f4:2d:a4:b0:17:46:d2:7a:04:46:8c

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=PUYBARET EMMANUEL,OU=IT,O=PUYBARET EMMANUEL,POSTALCODE=75015,STREET=35 rue de Chambery,L=Paris,ST=Ile de France,C=FR

02-02-2023 17:53
Valid: true

Chain 1

CN=PUYBARET EMMANUEL,OU=IT,O=PUYBARET EMMANUEL,POSTALCODE=75015,STREET=35 rue de Chambery,L=Paris,ST=Ile de France,C=FR

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Chain 2

CN=PUYBARET EMMANUEL,OU=IT,O=PUYBARET EMMANUEL,POSTALCODE=75015,STREET=35 rue de Chambery,L=Paris,ST=Ile de France,C=FR

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

__WSAFDIsSet
WSASetLastError
socket
ntohs
htons
WSACreateEvent
select
send
getsockname
getpeername
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
getsockopt
connect
shutdown
WSAIoctl
recv
WSASend
WSAGetOverlappedResult
WSARecv
WSASocketW
closesocket
accept
bind
WSAGetLastError
ioctlsocket
setsockopt
htonl
listen
WSACloseEvent

crypt32

CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFindCertificateInStore
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertDuplicateStore
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertOpenStore

ntdll

RtlNtStatusToDosError
NtQueryInformationProcess
RtlVirtualUnwind
NtQuerySystemInformation
RtlUnwindEx
RtlPcToFileHeader
NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlGetVersion
VerSetConditionMask
RtlGetNtVersionNumbers

secur32

DecryptMessage
QueryContextAttributesW
FreeContextBuffer
FreeCredentialsHandle
AcceptSecurityContext
ApplyControlToken
DeleteSecurityContext
AcquireCredentialsHandleA
EncryptMessage
InitializeSecurityContextW

kernel32

TzSpecificLocalTimeToSystemTime
GetProcessIoCounters
GetSystemTimes
VirtualQueryEx
ReadProcessMemory
GetProcessTimes
ExitProcess
SetConsoleTextAttribute
CreateEventW
GetOverlappedResult
WaitForMultipleObjects
CreateThread
GetFileAttributesW
CreateProcessW
GetWindowsDirectoryW
LoadLibraryExW
GetHandleInformation
InitializeSRWLock
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitOnceExecuteOnce
InitializeCriticalSectionEx
GetSystemDirectoryA
GetTickCount
MultiByteToWideChar
MoveFileExA
GetEnvironmentVariableA
VerifyVersionInfoW
CreateFileA
GetCurrentThreadId
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CancelIo
GetFileSizeEx
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
IsDebuggerPresent
InitializeSListHead
GetSystemDirectoryW
CompareStringOrdinal
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileW
GetFinalPathNameByHandleW
GetFullPathNameW
GetFileInformationByHandle
GetCommandLineW
GetModuleFileNameW
GetTempPathW
GetProcessHeap
HeapAlloc
HeapFree
CloseHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetSystemInfo
GetStdHandle
HeapReAlloc
FindNextFileW
GetLastError
DeleteFileW
FindClose
GetCurrentProcess
GetComputerNameExW
GetTickCount64
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
Sleep
CreateDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
CreateFileW
GetConsoleMode
SetConsoleMode
SleepConditionVariableSRW
GetConsoleScreenBufferInfo
AddVectoredExceptionHandler
SetThreadStackGuarantee
ReleaseMutex
GetCurrentThread
WaitForSingleObjectEx
LoadLibraryA
GetProcAddress
CreateMutexA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
GetSystemTimeAsFileTime
WakeAllConditionVariable
GetModuleHandleW
GetCurrentProcessId
LocalAlloc
CreateNamedPipeW
LocalFree
WaitForSingleObject
GetExitCodeProcess
SwitchToThread
ReadFile
WriteConsoleW
ReadConsoleW
CancelIoEx
OpenProcess
lstrlenW
WakeConditionVariable
UnmapViewOfFile
GetFileInformationByHandleEx
TryAcquireSRWLockExclusive
CreateFileMappingW
MapViewOfFile
DuplicateHandle
VirtualProtect
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
PostQueuedCompletionStatus
SetHandleInformation
FreeLibrary
GetModuleHandleA
SleepEx
ReadFileEx
ReleaseSRWLockShared
AcquireSRWLockShared
TerminateProcess
CreateJobObjectW
SetInformationJobObject
AssignProcessToJobObject
DeviceIoControl
SetLastError
WriteFileEx
GetNativeSystemInfo
SetFilePointerEx
GetCurrentDirectoryW
GetEnvironmentVariableW
FormatMessageW

oleaut32

SafeArrayDestroy
SysFreeString
SysAllocString
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
GetErrorInfo
SysStringLen
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringLen

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemFree

pdh

PdhCollectQueryData
PdhGetFormattedCounterValue
PdhCloseQuery
PdhOpenQueryA
PdhRemoveCounter
PdhAddEnglishCounterW

bcrypt

BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW
SHGetKnownFolderPath

advapi32

CryptAcquireContextA
CryptGetHashParam
GetUserNameW
GetTokenInformation
OpenProcessToken
CryptCreateHash
CryptHashData
IsWellKnownSid
DuplicateTokenEx
CheckTokenMembership
CreateWellKnownSid
CryptDestroyHash
LookupAccountSidW
SystemFunction036
AccessCheck
MapGenericMask
RegOpenKeyExW
RegQueryValueExW
DuplicateToken
RegCloseKey
GetFileSecurityW
EqualSid
CryptReleaseContext
OpenThreadToken
GetNamedSecurityInfoW

user32

MessageBoxW
GetSystemMetrics

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

shlwapi

PathIsNetworkPathW

iphlpapi

GetIfEntry2

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW
GetPerformanceInfo

api-ms-win-crt-string-l1-1-0

strspn
strpbrk
strcmp
strlen
wcsncmp
_strdup
strncmp
strncpy
strcspn
strcpy_s
wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr
round
roundf
fmod
_fdopen
log

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_beginthreadex
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
__sys_nerr
__sys_errlist
_register_thread_local_exe_atexit_callback
abort
_errno
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_seh_filter_exe
_c_exit
_wassert

api-ms-win-crt-heap-l1-1-0

realloc
malloc
calloc
_set_new_mode
_aligned_free
_aligned_malloc
free

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
wcstombs
strtoll
atoi

api-ms-win-crt-stdio-l1-1-0

_read
_write
_set_fmode
__p__commode
_close
_lseeki64
fgets
__acrt_iob_func
fread
fseek
fwrite
_open
fopen
fclose
fputs
__stdio_common_vsscanf
fflush
__stdio_common_vsprintf
feof
ftell
fputc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_gmtime64
strftime
_time64

api-ms-win-crt-filesystem-l1-1-0

_stat64
_fstat64
_unlink
_access

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 9.8MB - Virtual size: 9.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 367KB - Virtual size: 367KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d23077f7c0f33c283be753954c058d94

Code Sign

af:f3:c7:7f:8c:1d:78:ad:35:94:c4:57:7d:a9:2b:a8Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

38:f3:31:9a:31:11:a1:e7:2b:f4:2d:a4:b0:17:46:d2:7a:04:46:8cSigner

Signature Validations

Verification

02-02-2023 17:53 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

ntdll

secur32

kernel32

oleaut32

ole32

pdh

bcrypt

shell32

advapi32

user32

setupapi

shlwapi

iphlpapi

powrprof

psapi

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 9.8MB - Virtual size: 9.8MB

.rdata Size: 3.0MB - Virtual size: 3.0MB

.data Size: 13KB - Virtual size: 17KB

.pdata Size: 367KB - Virtual size: 367KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 39KB - Virtual size: 39KB

.reloc Size: 52KB - Virtual size: 51KB

af:f3:c7:7f:8c:1d:78:ad:35:94:c4:57:7d:a9:2b:a8
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

38:f3:31:9a:31:11:a1:e7:2b:f4:2d:a4:b0:17:46:d2:7a:04:46:8c
Signer

02-02-2023 17:53
Valid: true

.text
Size: 9.8MB - Virtual size: 9.8MB

.rdata
Size: 3.0MB - Virtual size: 3.0MB

.data
Size: 13KB - Virtual size: 17KB

.pdata
Size: 367KB - Virtual size: 367KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 39KB - Virtual size: 39KB

.reloc
Size: 52KB - Virtual size: 51KB