CertFix_Host[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CertFix_Host.exe
Size

153KB
MD5

6efbc770286217ddf1cc13948d400857
SHA1

aa2ca0ecfe1422775caec6628ea30ab0cbe9bb4f
SHA256

7e9be84a87a767021bdbf4c272be2a4fee113d348ce4ee39e85a168245686fc7
SHA512

e29a830e8de11ee7f56191ea4401db72070bdac2e1c4c24e05b67e04de206ac171af064354e31ad9aa4129add5b2479843642558c0780ff2ddbf651705096761
SSDEEP

3072:ba8kHb50Vg5V7wjzlDQ6NsyxFi90y2I5z2ycZd6goCJHEb:dzg5klzNsyxFi9QWEZdhHJHEb

Score

1^/10

Malware Config

Signatures

Files

CertFix_Host.exe
.exe windows x86

532c7dbc65e6c180830d0e17ecbd6c4c

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:cd:5e:96:2c:a0:d7:68:41:f9:78:ce
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/04/2022, 14:35

Not After

15/07/2025, 14:35

Subject

SERIALNUMBER=1026605606620,CN=AO Proizvodstvennaya Firma SKB Kontur,O=AO Proizvodstvennaya Firma SKB Kontur,STREET=Street Narodnaya Volya\, building 19A,L=Yekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#131453766572646c6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:cd:5e:96:2c:a0:d7:68:41:f9:78:ce
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

18/04/2022, 14:35

Not After

15/07/2025, 14:35

Subject

SERIALNUMBER=1026605606620,CN=AO Proizvodstvennaya Firma SKB Kontur,O=AO Proizvodstvennaya Firma SKB Kontur,STREET=Street Narodnaya Volya\, building 19A,L=Yekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#131453766572646c6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:2f:70:50:f3:b2:b1:d4:bd:81:94:e5:85:6f:7d:ea:df:5a:a8:79:02:69:e8:38:56:0f:3c:ee:c3:14:63:3f
Signer

Actual PE Digest

56:2f:70:50:f3:b2:b1:d4:bd:81:94:e5:85:6f:7d:ea:df:5a:a8:79:02:69:e8:38:56:0f:3c:ee:c3:14:63:3f

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=1026605606620,CN=AO Proizvodstvennaya Firma SKB Kontur,O=AO Proizvodstvennaya Firma SKB Kontur,STREET=Street Narodnaya Volya\, building 19A,L=Yekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#131453766572646c6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

26/08/2022, 03:46
Valid: false

14:8a:74:04:a8:91:2f:c8:5b:5b:6a:bc:35:7e:05:38:7d:58:c0:eb
Signer

Actual PE Digest

14:8a:74:04:a8:91:2f:c8:5b:5b:6a:bc:35:7e:05:38:7d:58:c0:eb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=1026605606620,CN=AO Proizvodstvennaya Firma SKB Kontur,O=AO Proizvodstvennaya Firma SKB Kontur,STREET=Street Narodnaya Volya\, building 19A,L=Yekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#131453766572646c6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

26/08/2022, 03:46
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpSetOption
WinHttpReadData
WinHttpSetTimeouts
WinHttpOpen
WinHttpCrackUrl

secur32

GetUserNameExW

kernel32

GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
FreeLibrary
ExitThread
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
GetStdHandle
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
lstrcmpA
InterlockedCompareExchange
FormatMessageW
FileTimeToSystemTime
GetVersionExW
RegisterWaitForSingleObject
CreateEventW
LocalFree
GetSystemTime
lstrcpyA
LoadLibraryW
GetProcessHeap
WideCharToMultiByte
GetProcessTimes
GetSystemTimeAsFileTime
GetCurrentProcess
SetUnhandledExceptionFilter
lstrlenA
GetEnvironmentVariableW
GetCommandLineW
ExitProcess
lstrcmpiW
EnterCriticalSection
GetLastError
lstrlenW
CreateFileW
Sleep
GetModuleHandleW
GetCommandLineA
lstrcpyW
OpenEventW
ReadFile
CreateNamedPipeW
SetEvent
WaitForSingleObject
SetErrorMode
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
LoadLibraryA
GetProcAddress
LCMapStringA
SetLastError
LeaveCriticalSection
InitializeCriticalSection
WriteFile
ResetEvent
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GlobalUnlock
GlobalLock
GlobalAlloc
RaiseException
GetModuleHandleA
SetFilePointer
GetFileSizeEx
lstrcmpW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
LocalAlloc
SetFilePointerEx
SetThreadPriority
CreateThread
CreateIoCompletionPort
GetConsoleCP

user32

wsprintfA
CloseClipboard
OpenClipboard
EmptyClipboard
wsprintfW
SetClipboardData

advapi32

FreeSid
RegQueryInfoKeyW
RegEnumKeyExW
OpenProcessToken
GetTokenInformation
IsValidSid
ConvertSidToStringSidW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
AllocateAndInitializeSid
RegCloseKey
RegQueryValueExW
CryptGetUserKey
CryptDestroyKey
CryptGetProvParam
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
CheckTokenMembership

crypt32

CertFreeCRLContext
CertFindRDNAttr
CertRDNValueToStrW
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CryptHashCertificate
CertGetCertificateContextProperty
CertGetCertificateChain
CertCloseStore
CertFreeCertificateContext
CertGetPublicKeyLength
CryptDecodeObjectEx
CertOpenStore
CryptDecodeObject
CertCreateCertificateContext
CertCreateCRLContext

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

StrStrIW
SHDeleteKeyW

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
SHParseDisplayName
SHFileOperationW

ole32

CoTaskMemFree

Exports

Exports

CrlAcquireRevocation
CrlCache

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

532c7dbc65e6c180830d0e17ecbd6c4c

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

79:cd:5e:96:2c:a0:d7:68:41:f9:78:ceCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

79:cd:5e:96:2c:a0:d7:68:41:f9:78:ceCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

56:2f:70:50:f3:b2:b1:d4:bd:81:94:e5:85:6f:7d:ea:df:5a:a8:79:02:69:e8:38:56:0f:3c:ee:c3:14:63:3fSigner

Signature Validations

Verification

26/08/2022, 03:46 Valid: false

14:8a:74:04:a8:91:2f:c8:5b:5b:6a:bc:35:7e:05:38:7d:58:c0:ebSigner

Signature Validations

Verification

26/08/2022, 03:46 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

secur32

kernel32

user32

advapi32

crypt32

version

shlwapi

shell32

ole32

Exports

Exports

Sections

.text Size: 82KB - Virtual size: 82KB

.rdata Size: 23KB - Virtual size: 22KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 17KB - Virtual size: 16KB

.reloc Size: 9KB - Virtual size: 8KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

79:cd:5e:96:2c:a0:d7:68:41:f9:78:ce
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

79:cd:5e:96:2c:a0:d7:68:41:f9:78:ce
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

56:2f:70:50:f3:b2:b1:d4:bd:81:94:e5:85:6f:7d:ea:df:5a:a8:79:02:69:e8:38:56:0f:3c:ee:c3:14:63:3f
Signer

26/08/2022, 03:46
Valid: false

14:8a:74:04:a8:91:2f:c8:5b:5b:6a:bc:35:7e:05:38:7d:58:c0:eb
Signer

26/08/2022, 03:46
Valid: false

.text
Size: 82KB - Virtual size: 82KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 17KB - Virtual size: 16KB

.reloc
Size: 9KB - Virtual size: 8KB