Signed_applet_x64[.]cpl

Resubmissions

14/03/2023, 15:00

230314-sdkvasgb35 3

14/03/2023, 08:03

230314-jxp4paec49 7

Sharing

Copy URL Twitter E-mail

General

Target

Signed_applet_x64.cpl
Size

280KB
MD5

f5f46f28a2d4cd60a092915714388d93
SHA1

dadca84d9cb9b4779dccc15173681d754431e0bf
SHA256

bfe4b6d91bf336637376d186af83375ecf8629e2273c999052acd09cf0bf29c6
SHA512

43c13fc66efa59dbc8d32d2f3d6eb9cb22e4c12ca7291792c93d1f82bb49c6fe35af34035f346b6f3f0a89b0920938691e555eb265bccf82fb4a13f43edd9207
SSDEEP

6144:AkR9b8dHbm1aKDCF2TGjSNgAMRmMLCXYGKz7KR8PdjFOjmU:xR9bWbmIKWYTG+8tcQz2R0ZF6mU

Score

1^/10

Malware Config

Signatures

Files

Signed_applet_x64.cpl
.dll regsvr32 windows x64

3d753b06f1d71bbcc2efeb2b96696ae2

Code Sign

63:ef:81:29:d4:43:f2:77:de:fd:ea:e6
Certificate

Issuer

CN=GlobalSign RSA OV SSL CA 2018,O=GlobalSign nv-sa,C=BE

Not Before

14/03/2022, 12:46

Not After

15/04/2023, 12:46

Subject

CN=alfabank.ru,O=AO ALFA-BANK,L=Moscow,ST=Moscow,C=RU

fe:1b:61:7c:ad:0e:b8:0f:d1:1d:89:ad:0d:a4:19:ca:b0:11:8a:22
Signer

Actual PE Digest

fe:1b:61:7c:ad:0e:b8:0f:d1:1d:89:ad:0d:a4:19:ca:b0:11:8a:22

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=alfabank.ru,O=AO ALFA-BANK,L=Moscow,ST=Moscow,C=RU

09/03/2023, 18:55
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CryptDestroyHash
CryptDestroyKey

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf

Exports

Exports

AESDecrypt
DllGetClassObject
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
Sizam
shellcode_fast_1
shellcode_fast_2
shellcode_slow_1
shellcode_slow_2
start

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 263KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 272B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

3d753b06f1d71bbcc2efeb2b96696ae2

Code Sign

63:ef:81:29:d4:43:f2:77:de:fd:ea:e6Certificate

fe:1b:61:7c:ad:0e:b8:0f:d1:1d:89:ad:0d:a4:19:ca:b0:11:8a:22Signer

Signature Validations

Verification

09/03/2023, 18:55 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.data Size: 263KB - Virtual size: 263KB

.rdata Size: 2KB - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 528B

.xdata Size: 512B - Virtual size: 372B

.bss Size: - Virtual size: 272B

.edata Size: 512B - Virtual size: 332B

.idata Size: 1KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 96B

63:ef:81:29:d4:43:f2:77:de:fd:ea:e6
Certificate

fe:1b:61:7c:ad:0e:b8:0f:d1:1d:89:ad:0d:a4:19:ca:b0:11:8a:22
Signer

09/03/2023, 18:55
Valid: false

.text
Size: 7KB - Virtual size: 6KB

.data
Size: 263KB - Virtual size: 263KB

.rdata
Size: 2KB - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 528B

.xdata
Size: 512B - Virtual size: 372B

.bss
Size: - Virtual size: 272B

.edata
Size: 512B - Virtual size: 332B

.idata
Size: 1KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 96B