pciclearstalecache_d243a607b50db10ed50f03cff570498018c61a59[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

pciclearstalecache_d243a607b50db10ed50f03cff570498018c61a59.exe
Size

31KB
MD5

8749ee2d97409941deeecb60acf0a151
SHA1

d243a607b50db10ed50f03cff570498018c61a59
SHA256

3001813b0f4c6af924dc803030eecaa99c726c0110311b00102c39cb5c68c82c
SHA512

2d6c299abfd6d0409385cee348cc3d6730fc74f10eef0c8ea051d71cb39d90f90fe2e6859e5f59870962bd444b70713f3fee20cd3c44e34428c5cc8b755d8bf1
SSDEEP

384:TVp997pGGhH5TQtTfQBz+P0afeMmoWVlWxpb7F0GftpBjBn5kS/0LgoHXhlXSO:T9GGhH5GTYe02eM4Y+i/5kS8rf

Score

1^/10

Malware Config

Signatures

Files

pciclearstalecache_d243a607b50db10ed50f03cff570498018c61a59.exe
.exe windows x64

d1fc4c5e5c072eff3a36f3ccb5290eb4

Code Sign

33:00:00:01:18:6e:4b:34:ea:61:ed:30:2c:00:00:00:00:01:18
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/10/2018, 21:07

Not After

10/01/2020, 21:07

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:D6BD-E3E7-1685,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:38:91:cb:4c:c7:11:fd:cd:05:00:00:00:00:02:38
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:07

Not After

08/08/2019, 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e4:91:92:9f:0d:29:b1:3e:9c:b0:cf:ed:21:8d:4d:df:6c:10:43:06:72:98:88:9c:4c:42:8b:42:72:a1:b1:bb
Signer

Actual PE Digest

e4:91:92:9f:0d:29:b1:3e:9c:b0:cf:ed:21:8d:4d:df:6c:10:43:06:72:98:88:9c:4c:42:8b:42:72:a1:b1:bb

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

27/03/2023, 18:26
Valid: false

5b:53:8b:15:fe:e2:ac:46:f0:61:96:86:92:9c:88:14:70:0c:95:67
Signer

Actual PE Digest

5b:53:8b:15:fe:e2:ac:46:f0:61:96:86:92:9c:88:14:70:0c:95:67

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

08/05/2019, 03:25
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteTreeW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegCopyTreeW

kernel32

GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetLastError
LocalAlloc
LocalFree
GetSystemTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetSystemTimeAsFileTime

msvcrt

__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_amsg_exit
memset
_XcptFilter
__C_specific_handler
__wgetmainargs
_exit
exit
_cexit
??2@YAPEAX_K@Z
fclose
fputws
??3@YAXPEAX@Z
_vsnwprintf
wprintf
_wfopen_s
_initterm
memcpy

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1fc4c5e5c072eff3a36f3ccb5290eb4

Code Sign

33:00:00:01:18:6e:4b:34:ea:61:ed:30:2c:00:00:00:00:01:18Certificate

Extended Key Usages

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:02:38:91:cb:4c:c7:11:fd:cd:05:00:00:00:00:02:38Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

e4:91:92:9f:0d:29:b1:3e:9c:b0:cf:ed:21:8d:4d:df:6c:10:43:06:72:98:88:9c:4c:42:8b:42:72:a1:b1:bbSigner

Signature Validations

Verification

27/03/2023, 18:26 Valid: false

5b:53:8b:15:fe:e2:ac:46:f0:61:96:86:92:9c:88:14:70:0c:95:67Signer

Signature Validations

Verification

08/05/2019, 03:25 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

version

Sections

.text Size: 12KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 512B - Virtual size: 252B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 76B

33:00:00:01:18:6e:4b:34:ea:61:ed:30:2c:00:00:00:00:01:18
Certificate

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:02:38:91:cb:4c:c7:11:fd:cd:05:00:00:00:00:02:38
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

e4:91:92:9f:0d:29:b1:3e:9c:b0:cf:ed:21:8d:4d:df:6c:10:43:06:72:98:88:9c:4c:42:8b:42:72:a1:b1:bb
Signer

27/03/2023, 18:26
Valid: false

5b:53:8b:15:fe:e2:ac:46:f0:61:96:86:92:9c:88:14:70:0c:95:67
Signer

08/05/2019, 03:25
Valid: false

.text
Size: 12KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 512B - Virtual size: 252B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 76B