344af7d0712b37125f6774430b80179d75dce510e8816259eaf308d582184a23

Sharing

Copy URL Twitter E-mail

General

Target

344af7d0712b37125f6774430b80179d75dce510e8816259eaf308d582184a23
Size

266KB
MD5

3cc91a1eef875524b47f751387af9882
SHA1

5e1baa620ad8a0a123bf58be77b22897ef34e2d3
SHA256

344af7d0712b37125f6774430b80179d75dce510e8816259eaf308d582184a23
SHA512

e1cc7dab3bbcb532054f9ebd500741df2dc060adb954c7e6e3c68e11cba577607ae9dadc820e8d07fcbfa24a5aef796ff3170b8040ec086181342e23fac888cd
SSDEEP

3072:50oEo9go7DnGTALIhoCJXuJ8OnKv7crWvigYTKfXIHnhz2jsRZzFPk2I111KYTIm:579g4GTAWJXu8mK++1XanNdHMzTy1k

Score

1^/10

Malware Config

Signatures

Files

344af7d0712b37125f6774430b80179d75dce510e8816259eaf308d582184a23
.exe windows x86

4c30f4f7a9b69e1617ec9bcb3340fd17

Code Sign

33:00:00:03:6c:e5:7e:eb:5d:1c:c2:be:17:00:00:00:00:03:6c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/01/2022, 19:31

Not After

26/01/2023, 19:31

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:d9:a7:04:c5:94:ae:14:06:a9:45:55:0d:d8:7b:ca:e0:b3:78:c7:17:8f:ca:83:6e:e1:c9:d5:c0:e5:2a:41
Signer

Actual PE Digest

90:d9:a7:04:c5:94:ae:14:06:a9:45:55:0d:d8:7b:ca:e0:b3:78:c7:17:8f:ca:83:6e:e1:c9:d5:c0:e5:2a:41

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

27/03/2023, 18:22
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetProcAddress
LoadLibraryA
GetOEMCP
GetLastError
GetCommandLineA
GetProcessHeap
InterlockedIncrement
lstrlenA
GetVersionExA
GetVersionExW
GetCurrentThread
GetCommandLineW
VirtualAllocEx
GetCurrentProcess
GetModuleHandleA
GetStartupInfoW

user32

LoadIconA
SetWindowLongW
SetWindowTextW
DefWindowProcW
RegisterClassW
DestroyIcon
SendMessageW
DestroyWindow
CreateWindowExA
CreateWindowExW
UnregisterClassA
LoadStringW
PostMessageW

gdi32

CreateDIBSection
CreateBitmap

comctl32

ImageList_Add

msvcrt

_exit
_XcptFilter
_c_exit
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
__dllonexit
_onexit
_except_handler3
_cexit

Exports

Exports

ClearPropVariantArray
ClearVariantArray
GetProxyDllInfo
InitPropVariantFromBooleanVector
InitPropVariantFromBuffer
InitPropVariantFromCLSID
InitPropVariantFromDoubleVector
InitPropVariantFromFileTime
InitPropVariantFromFileTimeVector
InitPropVariantFromGUIDAsString
InitPropVariantFromInt16Vector
InitPropVariantFromInt32Vector
InitPropVariantFromInt64Vector
InitPropVariantFromPropVariantVectorElem
InitPropVariantFromResource
InitPropVariantFromStrRet
InitPropVariantFromStringAsVector
InitPropVariantFromStringVector
InitPropVariantFromUInt16Vector
InitPropVariantFromUInt32Vector
InitPropVariantFromUInt64Vector
InitPropVariantVectorFromPropVariant
InitVariantFromBooleanArray
InitVariantFromBuffer
InitVariantFromDoubleArray
InitVariantFromFileTime
InitVariantFromFileTimeArray
InitVariantFromGUIDAsString
InitVariantFromInt16Array
InitVariantFromInt32Array
InitVariantFromInt64Array
InitVariantFromResource
InitVariantFromStrRet
InitVariantFromStringArray
InitVariantFromUInt16Array
InitVariantFromUInt32Array
InitVariantFromUInt64Array
InitVariantFromVariantArrayElem
PSCoerceToCanonicalValue
PSCreateAdapterFromPropertyStore
PSCreateDelayedMultiplexPropertyStore
PSCreateMemoryPropertyStore
PSCreateMultiplexPropertyStore
PSCreatePropertyChangeArray
PSCreatePropertyStoreFromObject
PSCreatePropertyStoreFromPropertySetStorage
PSCreateSimplePropertyChange
PSEnumeratePropertyDescriptions
PSFormatForDisplay
PSFormatForDisplayAlloc
PSFormatPropertyValue
PSGetImageReferenceForValue
PSGetItemPropertyHandler
PSGetItemPropertyHandlerWithCreateObject
PSGetNameFromPropertyKey
PSGetNamedPropertyFromPropertyStorage
PSGetPropertyDescription
PSGetPropertyDescriptionByName
PSGetPropertyDescriptionListFromString
PSGetPropertyFromPropertyStorage
PSGetPropertyKeyFromName
PSGetPropertySystem
PSGetPropertyValue
PSLookupPropertyHandlerCLSID
PSPropertyBag_Delete
PSPropertyBag_ReadBOOL
PSPropertyBag_ReadBSTR
PSPropertyBag_ReadDWORD
PSPropertyBag_ReadGUID
PSPropertyBag_ReadInt
PSPropertyBag_ReadLONG
PSPropertyBag_ReadPOINTL
PSPropertyBag_ReadPOINTS
PSPropertyBag_ReadPropertyKey
PSPropertyBag_ReadRECTL
PSPropertyBag_ReadSHORT
PSPropertyBag_ReadStr
PSPropertyBag_ReadStrAlloc
PSPropertyBag_ReadStream
PSPropertyBag_ReadType
PSPropertyBag_ReadULONGLONG
PSPropertyBag_ReadUnknown
PSPropertyBag_WriteBOOL
PSPropertyBag_WriteBSTR
PSPropertyBag_WriteDWORD
PSPropertyBag_WriteGUID
PSPropertyBag_WriteInt
PSPropertyBag_WriteLONG
PSPropertyBag_WritePOINTL
PSPropertyBag_WritePOINTS
PSPropertyBag_WritePropertyKey
PSPropertyBag_WriteRECTL
PSPropertyBag_WriteSHORT
PSPropertyBag_WriteStr
PSPropertyBag_WriteStream
PSPropertyBag_WriteULONGLONG
PSPropertyBag_WriteUnknown
PSPropertyKeyFromString
PSRefreshPropertySchema
PSRegisterPropertySchema
PSSetPropertyValue
PSStringFromPropertyKey
PSUnregisterPropertySchema
PropVariantChangeType
PropVariantCompareEx
PropVariantGetBooleanElem
PropVariantGetDoubleElem
PropVariantGetElementCount
PropVariantGetFileTimeElem
PropVariantGetInt16Elem
PropVariantGetInt32Elem
PropVariantGetInt64Elem
PropVariantGetStringElem
PropVariantGetUInt16Elem
PropVariantGetUInt32Elem
PropVariantGetUInt64Elem
PropVariantToBSTR
PropVariantToBoolean
PropVariantToBooleanVector
PropVariantToBooleanVectorAlloc
PropVariantToBooleanWithDefault
PropVariantToBuffer
PropVariantToDouble
PropVariantToDoubleVector
PropVariantToDoubleVectorAlloc
PropVariantToDoubleWithDefault
PropVariantToFileTime
PropVariantToFileTimeVector
PropVariantToFileTimeVectorAlloc
PropVariantToGUID
PropVariantToInt16
PropVariantToInt16Vector
PropVariantToInt16VectorAlloc
PropVariantToInt16WithDefault
PropVariantToInt32
PropVariantToInt32Vector
PropVariantToInt32VectorAlloc
PropVariantToInt32WithDefault
PropVariantToInt64
PropVariantToInt64Vector
PropVariantToInt64VectorAlloc
PropVariantToInt64WithDefault
PropVariantToStrRet
PropVariantToString
PropVariantToStringAlloc
PropVariantToStringVector
PropVariantToStringVectorAlloc
PropVariantToStringWithDefault
PropVariantToUInt16
PropVariantToUInt16Vector
PropVariantToUInt16VectorAlloc
PropVariantToUInt16WithDefault
PropVariantToUInt32
PropVariantToUInt32Vector
PropVariantToUInt32VectorAlloc
PropVariantToUInt32WithDefault
PropVariantToUInt64
PropVariantToUInt64Vector
PropVariantToUInt64VectorAlloc
PropVariantToUInt64WithDefault
PropVariantToVariant
StgDeserializePropVariant
StgSerializePropVariant
VariantCompare
VariantGetBooleanElem
VariantGetDoubleElem
VariantGetElementCount
VariantGetInt16Elem
VariantGetInt32Elem
VariantGetInt64Elem
VariantGetStringElem
VariantGetUInt16Elem
VariantGetUInt32Elem
VariantGetUInt64Elem
VariantToBoolean
VariantToBooleanArray
VariantToBooleanArrayAlloc
VariantToBooleanWithDefault
VariantToBuffer
VariantToDosDateTime
VariantToDouble
VariantToDoubleArray
VariantToDoubleArrayAlloc
VariantToDoubleWithDefault
VariantToFileTime
VariantToGUID
VariantToInt16
VariantToInt16Array
VariantToInt16ArrayAlloc
VariantToInt16WithDefault
VariantToInt32
VariantToInt32Array
VariantToInt32ArrayAlloc
VariantToInt32WithDefault
VariantToInt64
VariantToInt64Array
VariantToInt64ArrayAlloc
VariantToInt64WithDefault
VariantToPropVariant
VariantToStrRet
VariantToString
VariantToStringAlloc
VariantToStringArray
VariantToStringArrayAlloc
VariantToStringWithDefault
VariantToUInt16
VariantToUInt16Array
VariantToUInt16ArrayAlloc
VariantToUInt16WithDefault
VariantToUInt32
VariantToUInt32Array
VariantToUInt32ArrayAlloc
VariantToUInt32WithDefault
VariantToUInt64
VariantToUInt64Array
VariantToUInt64ArrayAlloc
VariantToUInt64WithDefault

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 744B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4c30f4f7a9b69e1617ec9bcb3340fd17

Code Sign

33:00:00:03:6c:e5:7e:eb:5d:1c:c2:be:17:00:00:00:00:03:6cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

90:d9:a7:04:c5:94:ae:14:06:a9:45:55:0d:d8:7b:ca:e0:b3:78:c7:17:8f:ca:83:6e:e1:c9:d5:c0:e5:2a:41Signer

Signature Validations

Verification

27/03/2023, 18:22 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comctl32

msvcrt

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 6KB

.bss Size: - Virtual size: 20KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 144KB - Virtual size: 143KB

.rsrc Size: 84KB - Virtual size: 81KB

.reloc Size: 4KB - Virtual size: 744B

33:00:00:03:6c:e5:7e:eb:5d:1c:c2:be:17:00:00:00:00:03:6c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

90:d9:a7:04:c5:94:ae:14:06:a9:45:55:0d:d8:7b:ca:e0:b3:78:c7:17:8f:ca:83:6e:e1:c9:d5:c0:e5:2a:41
Signer

27/03/2023, 18:22
Valid: false

.text
Size: 8KB - Virtual size: 6KB

.bss
Size: - Virtual size: 20KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 144KB - Virtual size: 143KB

.rsrc
Size: 84KB - Virtual size: 81KB

.reloc
Size: 4KB - Virtual size: 744B