2d68755335776e3de28fcd1757b7dcc07688b31c37205ce2324d92c2f419c6f0[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

2d68755335776e3de28fcd1757b7dcc07688b31c37205ce2324d92c2f419c6f0.bin
Size

414KB
MD5

2b55988c0d236edd5ea1a631ccd37b76
SHA1

033a22c3bb2b0dd1677973e1ae6280e5466e771c
SHA256

2d68755335776e3de28fcd1757b7dcc07688b31c37205ce2324d92c2f419c6f0
SHA512

de2c34008ce298b43fd0327c0493b3c50fe3c4842f53c15b9cf8b4d895a0cdd3814b7f192910d24d798c3796af29b5283197b454ce2e0cad6dd9a4daa3c8f5ff
SSDEEP

6144:UUpGOKUXcSjtM0vsW2g2uJ8yBW8RCtswtoMfLYzY8EI4zADpxhKY:IODMSjtHX2VyWkUtoeLYk8EHMjh1

Score

1^/10

Malware Config

Signatures

Files

2d68755335776e3de28fcd1757b7dcc07688b31c37205ce2324d92c2f419c6f0.bin
.dll regsvr32 windows x86

f141a6deaab9652cc7e298abde5708ad

Code Sign

24:e4:a2:b3:db:6b:e1:00:7b:9d:dc:91:99:5b:c0:c8
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

18-02-2022 00:00

Not After

18-02-2023 23:59

Subject

CN=FLY BETTER s.r.o.,O=FLY BETTER s.r.o.,ST=Bratislavský kraj,C=SK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:52:e6:33:db:57:55:3a:51:1b:50:45:e9:71:e9:91:17:dc:58:fb
Signer

Actual PE Digest

eb:52:e6:33:db:57:55:3a:51:1b:50:45:e9:71:e9:91:17:dc:58:fb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=FLY BETTER s.r.o.,O=FLY BETTER s.r.o.,ST=Bratislavský kraj,C=SK

07-02-2023 20:40
Valid: true

Chain 1

CN=FLY BETTER s.r.o.,O=FLY BETTER s.r.o.,ST=Bratislavský kraj,C=SK

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryA
CreateFileA
DeleteFileA
FindFirstFileA
FindNextFileA
ReadFile
SetFileTime
CloseHandle
GetLastError
ConnectNamedPipe
DisconnectNamedPipe
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcessId
ExitProcess
CreateThread
GetCurrentThread
GetCurrentThreadId
SuspendThread
VirtualAlloc
MapViewOfFile
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
WaitForMultipleObjects
CreateFileMappingA
LoadLibraryA
CreateNamedPipeA
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
FindClose
FindFirstFileExA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
CreateFileW
RaiseException

Exports

Exports

DllInstall
DllRegisterServer
LAzXEg
NPKJBv9lq
TOdQ7602

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 98KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f141a6deaab9652cc7e298abde5708ad

Code Sign

24:e4:a2:b3:db:6b:e1:00:7b:9d:dc:91:99:5b:c0:c8Certificate

Extended Key Usages

Key Usages

01Certificate

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

eb:52:e6:33:db:57:55:3a:51:1b:50:45:e9:71:e9:91:17:dc:58:fbSigner

Signature Validations

Verification

07-02-2023 20:40 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 110KB - Virtual size: 110KB

.rdata Size: 190KB - Virtual size: 190KB

.data Size: 98KB - Virtual size: 100KB

.gfids Size: 512B - Virtual size: 160B

.reloc Size: 7KB - Virtual size: 7KB

24:e4:a2:b3:db:6b:e1:00:7b:9d:dc:91:99:5b:c0:c8
Certificate

01
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

eb:52:e6:33:db:57:55:3a:51:1b:50:45:e9:71:e9:91:17:dc:58:fb
Signer

07-02-2023 20:40
Valid: true

.text
Size: 110KB - Virtual size: 110KB

.rdata
Size: 190KB - Virtual size: 190KB

.data
Size: 98KB - Virtual size: 100KB

.gfids
Size: 512B - Virtual size: 160B

.reloc
Size: 7KB - Virtual size: 7KB