win64_zy25ngizqk[.]exe

Resubmissions

14-02-2023 18:16

230214-wwhdnsee9w 10

14-02-2023 15:21

230214-srkfpadg5z 8

Sharing

Copy URL

Twitter E-mail

General

Target

win64_zy25ngizqk.exe
Size

9.8MB
MD5

5ed7e787972ec4ae1e74973729a842b7
SHA1

80ee1846c735ab1202e1aa2b606c448afb300d86
SHA256

e1a8097eae84c79f6d2cf985d5f0d563ac14e425891d2ce47d95172891f3bb47
SHA512

757144ff7f8836a10e07ff229f79a71a0b0a2372a0e890c11377dfa45ab46f82abf07a42b79856f39a2c0d9d1dec74a11e818aac7973e6f931573a038a0b9bbd
SSDEEP

98304:fFnrjaNk/PfMSEi7OunBuYEXyVRt8UtxCXBMxQ6tslChnRnvG2:t/aeMzi9k6EHCsAtvG2

Score

1^/10

Malware Config

Signatures

Files

win64_zy25ngizqk.exe
.exe windows x64

a70a8f2e8bf25d6e2b17d997982aa3ec

Code Sign

af:f3:c7:7f:8c:1d:78:ad:35:94:c4:57:7d:a9:2b:a8
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19-02-2021 00:00

Not After

19-02-2024 23:59

Subject

CN=PUYBARET EMMANUEL,OU=IT,O=PUYBARET EMMANUEL,POSTALCODE=75015,STREET=35 rue de Chambery,L=Paris,ST=Ile de France,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31-05-2021 06:43

Not After

17-09-2029 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

19-05-2021 05:42

Not After

18-05-2032 05:42

Subject

CN=Certum Timestamp 2021,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19-05-2021 05:32

Not After

18-05-2036 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d6:c8:2d:4a:48:8d:2a:7c:3c:f6:61:46:f1:33:66:48:18:21:d2:10
Signer

Actual PE Digest

d6:c8:2d:4a:48:8d:2a:7c:3c:f6:61:46:f1:33:66:48:18:21:d2:10

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=PUYBARET EMMANUEL,OU=IT,O=PUYBARET EMMANUEL,POSTALCODE=75015,STREET=35 rue de Chambery,L=Paris,ST=Ile de France,C=FR

07-02-2023 20:39
Valid: true

Chain 1

CN=PUYBARET EMMANUEL,OU=IT,O=PUYBARET EMMANUEL,POSTALCODE=75015,STREET=35 rue de Chambery,L=Paris,ST=Ile de France,C=FR

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Chain 2

CN=PUYBARET EMMANUEL,OU=IT,O=PUYBARET EMMANUEL,POSTALCODE=75015,STREET=35 rue de Chambery,L=Paris,ST=Ile de France,C=FR

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
NtCancelIoFileEx
NtCreateFile
RtlNtStatusToDosError
NtDeviceIoControlFile
RtlGetNtVersionNumbers
RtlVirtualUnwind

kernel32

GetConsoleMode
GetModuleHandleA
SleepEx
ReadFileEx
WakeConditionVariable
WakeAllConditionVariable
Sleep
FreeLibrary
SetFileCompletionNotificationModes
CreateFileW
CreateIoCompletionPort
QueryPerformanceFrequency
UnhandledExceptionFilter
CreateDirectoryW
lstrlenW
GetCurrentThreadId
SleepConditionVariableSRW
LoadLibraryA
GetProcAddress
VirtualProtect
GetCurrentProcess
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
DuplicateHandle
MapViewOfFile
FindClose
GetLastError
WriteProcessMemory
GetConsoleScreenBufferInfo
AddVectoredExceptionHandler
SetThreadStackGuarantee
ReadConsoleW
CreateFileMappingW
GetTimeZoneInformation
WriteConsoleW
TerminateProcess
CreateJobObjectW
SetInformationJobObject
AssignProcessToJobObject
ReadFile
GetProcessHeap
DeviceIoControl
GetExitCodeProcess
ReleaseSRWLockShared
GetCurrentThread
AcquireSRWLockShared
WriteFileEx
GetComputerNameExW
GlobalMemoryStatusEx
FindNextFileW
GetNativeSystemInfo
SetFilePointerEx
WaitForSingleObject
FillConsoleOutputAttribute
SwitchToThread
GetStdHandle
GetSystemInfo
SetLastError
GetCurrentDirectoryW
WaitForSingleObjectEx
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetCommandLineW
GetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
FindFirstFileW
LocalFree
CreateNamedPipeW
HeapReAlloc
FileTimeToSystemTime
LocalAlloc
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
CreateThread
FillConsoleOutputCharacterA
IsDebuggerPresent
WaitForMultipleObjects
GetOverlappedResult
CreateEventW
CancelIo
ExitProcess
GetSystemTimeAsFileTime
SetHandleInformation
SystemTimeToTzSpecificLocalTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
PostQueuedCompletionStatus
SetConsoleTextAttribute
SystemTimeToFileTime
GetCurrentProcessId
SetUnhandledExceptionFilter
HeapAlloc
SetConsoleMode
UnmapViewOfFile
IsProcessorFeaturePresent
SetConsoleCursorPosition
CloseHandle
GetFileInformationByHandleEx
InitializeSListHead
QueryPerformanceCounter
HeapFree

crypt32

CertCloseStore
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertGetCertificateChain
CertEnumCertificatesInStore
CertDuplicateStore
CertAddCertificateContextToStore
CertOpenStore
CertDuplicateCertificateContext
CertFreeCertificateChain

bcrypt

BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider

shell32

ShellExecuteW
SHGetKnownFolderPath
SHGetFolderPathW

ole32

CoTaskMemFree

advapi32

AccessCheck
MapGenericMask
DuplicateToken
GetFileSecurityW
EqualSid
OpenThreadToken
GetNamedSecurityInfoW
GetTokenInformation
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
OpenProcessToken
CreateWellKnownSid
CheckTokenMembership
DuplicateTokenEx
IsWellKnownSid

user32

GetSystemMetrics

ws2_32

WSASend
setsockopt
connect
send
recv
shutdown
getsockname
WSASocketW
closesocket
WSAGetLastError
getpeername
getsockopt
ioctlsocket
WSAIoctl
bind
WSACleanup
freeaddrinfo
getaddrinfo
WSAStartup

secur32

EncryptMessage
FreeCredentialsHandle
DeleteSecurityContext
FreeContextBuffer
DecryptMessage
ApplyControlToken
AcceptSecurityContext
InitializeSecurityContextW
QueryContextAttributesW
AcquireCredentialsHandleA

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList

shlwapi

PathIsNetworkPathW

oleaut32

SysStringLen
GetErrorInfo
SysFreeString

vcruntime140

__current_exception
__C_specific_handler
_CxxThrowException
memcmp
memset
memmove
__CxxFrameHandler3
memcpy
__current_exception_context

api-ms-win-crt-math-l1-1-0

round
fmod
truncf
log
roundf
trunc
__setusermatherr

api-ms-win-crt-string-l1-1-0

strlen
wcslen

api-ms-win-crt-heap-l1-1-0

_aligned_free
_aligned_malloc
_set_new_mode
free

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_set_app_type
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_configure_narrow_argv
_wassert
exit

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 272KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

a70a8f2e8bf25d6e2b17d997982aa3ec

Code Sign

af:f3:c7:7f:8c:1d:78:ad:35:94:c4:57:7d:a9:2b:a8Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

d6:c8:2d:4a:48:8d:2a:7c:3c:f6:61:46:f1:33:66:48:18:21:d2:10Signer

Signature Validations

Verification

07-02-2023 20:39 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

crypt32

bcrypt

shell32

ole32

advapi32

user32

ws2_32

secur32

setupapi

shlwapi

oleaut32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 7.2MB - Virtual size: 7.2MB

.rdata Size: 2.3MB - Virtual size: 2.3MB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 272KB - Virtual size: 271KB

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 32KB - Virtual size: 32KB

af:f3:c7:7f:8c:1d:78:ad:35:94:c4:57:7d:a9:2b:a8
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

d6:c8:2d:4a:48:8d:2a:7c:3c:f6:61:46:f1:33:66:48:18:21:d2:10
Signer

07-02-2023 20:39
Valid: true

.text
Size: 7.2MB - Virtual size: 7.2MB

.rdata
Size: 2.3MB - Virtual size: 2.3MB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 272KB - Virtual size: 271KB

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 32KB - Virtual size: 32KB