ebdf930473c6b0bf4097726d24b948c3bdf46a8088639af243fd8160d37ff862

Sharing

Copy URL Twitter E-mail

General

Target

ebdf930473c6b0bf4097726d24b948c3bdf46a8088639af243fd8160d37ff862
Size

5.3MB
MD5

e24fb5671eb196a920f66c7883391215
SHA1

399b87f2c7ffe83eec882baf7390aee19d4da3a9
SHA256

ebdf930473c6b0bf4097726d24b948c3bdf46a8088639af243fd8160d37ff862
SHA512

a67f58265dc49fd999cfe6c865b2fbb7f24470b6cade8bde68cc30a388c5e30e0a486bdb7f49ac7f49763e6ecd8e033087cd8a05c9bced559ae4cfed8e16bbc0
SSDEEP

98304:3d2FYVwQT6kUTXIJUfHCgiB8Y2HQZxvIB55BDJMdTAhX3zVsJeOb:t2FYyye3HCzB85QU5vDJMVuDVEPb

Score

1^/10

Malware Config

Signatures

Files

ebdf930473c6b0bf4097726d24b948c3bdf46a8088639af243fd8160d37ff862
.exe windows x64

f2840be3e67e34224f9222b9bf5c6ad8

Code Sign

39:9e:bc:7e:f1:92:7c:88:43:5f:bd:52:98:a1:ba:a0
Certificate

Issuer

CN=Dounick,ST=Hubei,C=China,1.2.840.113549.1.9.1=#1305456d61696c

Not Before

16/01/2023, 02:59

Not After

31/12/2039, 23:59

Subject

CN=Dounick,ST=Hubei,C=China,1.2.840.113549.1.9.1=#1305456d61696c

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

aa:c3:5a:e1:b4:f9:f5:62:a0:e5:3c:26:1a:70:22:bf:95:0c:90:b7
Signer

Actual PE Digest

aa:c3:5a:e1:b4:f9:f5:62:a0:e5:3c:26:1a:70:22:bf:95:0c:90:b7

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Dounick,ST=Hubei,C=China,1.2.840.113549.1.9.1=#1305456d61696c

02/02/2023, 17:54
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcrt

__C_specific_handler

wtsapi32

WTSSendMessageW

user32

GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2840be3e67e34224f9222b9bf5c6ad8

Code Sign

39:9e:bc:7e:f1:92:7c:88:43:5f:bd:52:98:a1:ba:a0Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

aa:c3:5a:e1:b4:f9:f5:62:a0:e5:3c:26:1a:70:22:bf:95:0c:90:b7Signer

Signature Validations

Verification

02/02/2023, 17:54 Valid: false

Headers

File Characteristics

Imports

kernel32

msvcrt

wtsapi32

user32

Sections

.text Size: - Virtual size: 8KB

.data Size: - Virtual size: 1KB

.rdata Size: - Virtual size: 720B

.pdata Size: - Virtual size: 636B

.xdata Size: - Virtual size: 568B

.bss Size: - Virtual size: 2KB

.idata Size: - Virtual size: 2KB

.CRT Size: - Virtual size: 104B

.tls Size: - Virtual size: 72B

.vmp0 Size: - Virtual size: 3.6MB

.vmp1 Size: 5.3MB - Virtual size: 5.3MB

.rsrc Size: 1KB - Virtual size: 1KB

39:9e:bc:7e:f1:92:7c:88:43:5f:bd:52:98:a1:ba:a0
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

aa:c3:5a:e1:b4:f9:f5:62:a0:e5:3c:26:1a:70:22:bf:95:0c:90:b7
Signer

02/02/2023, 17:54
Valid: false

.text
Size: - Virtual size: 8KB

.data
Size: - Virtual size: 1KB

.rdata
Size: - Virtual size: 720B

.pdata
Size: - Virtual size: 636B

.xdata
Size: - Virtual size: 568B

.bss
Size: - Virtual size: 2KB

.idata
Size: - Virtual size: 2KB

.CRT
Size: - Virtual size: 104B

.tls
Size: - Virtual size: 72B

.vmp0
Size: - Virtual size: 3.6MB

.vmp1
Size: 5.3MB - Virtual size: 5.3MB

.rsrc
Size: 1KB - Virtual size: 1KB