ff0040c1f1dfb3e4c6390ff69ceec4e51d7951f179692769d1fb4a253ca4611b

Sharing

Copy URL

Twitter E-mail

General

Target

ff0040c1f1dfb3e4c6390ff69ceec4e51d7951f179692769d1fb4a253ca4611b
Size

759KB
MD5

354997acf88334522cfd6dc569c477b0
SHA1

8a643a1418a6cf34c4e0310bd3d6717d602bcf29
SHA256

ff0040c1f1dfb3e4c6390ff69ceec4e51d7951f179692769d1fb4a253ca4611b
SHA512

5832058f447e4bc8fa1da199d88d88362b9bf4954c0a38f9e5e35225a93a0031969717709b3559c8a6f64e7003309deff1840e297dadbdaec556a3e893fd5f7b
SSDEEP

12288:uIK9m66hfvhUz1ET51uhnP26+Oovb/nX04of+8hFALR/:bKe3nt4hndovbv5l8hFALp

Score

1^/10

Malware Config

Signatures

Files

ff0040c1f1dfb3e4c6390ff69ceec4e51d7951f179692769d1fb4a253ca4611b
.exe windows x64

dd978f7824c4be636488fd7eae62ec24

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-09-2021 18:32

Not After

01-09-2022 18:32

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ec:5c:b4:09:26:83:d2:7f:e4:b4:98:ad:d3:5c:dd:69:e1:4b:c7:db:ce:9a:d7:79:d8:00:2a:03:ae:fb:2d:5c
Signer

Actual PE Digest

ec:5c:b4:09:26:83:d2:7f:e4:b4:98:ad:d3:5c:dd:69:e1:4b:c7:db:ce:9a:d7:79:d8:00:2a:03:ae:fb:2d:5c

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13-04-2023 18:10
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
FreeLibraryAndExitThread
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
GetModuleFileNameA

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapSize

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA
SetStdHandle
SetEnvironmentVariableW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineW
GetStdHandle

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
EnterCriticalSection
AcquireSRWLockExclusive
TryEnterCriticalSection
LeaveCriticalSection
SetEvent
DeleteCriticalSection
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
InitializeSRWLock
ResetEvent
CreateEventW
CreateMutexW

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
ExitProcess
GetExitCodeProcess
GetCurrentProcess
TerminateProcess
ExitThread
CreateThread
GetExitCodeThread
TlsFree
GetStartupInfoW
SwitchToThread
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageA
LCMapStringEx
GetUserDefaultLCID
EnumSystemLocalesW
GetLocaleInfoW
GetOEMCP
GetACP
IsValidCodePage
LCMapStringW
FormatMessageW
IsValidLocale
GetCPInfo

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak
IsDebuggerPresent
OutputDebugStringW

msi

ord88

shlwapi

PathRemoveFileSpecW

user32

FindWindowW
SendMessageW
MessageBoxW

shell32

ShellExecuteExW
SHGetKnownFolderPath

api-ms-win-core-console-l1-1-0

ReadConsoleW
WriteConsoleA
GetConsoleCP
WriteConsoleW
GetConsoleMode

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
GetDynamicTimeZoneInformation

api-ms-win-core-file-l1-1-0

DeleteFileW
GetFileType
GetFileAttributesW
WriteFile
SetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
GetFileAttributesExW
FindNextFileW
ReadFile
FlushFileBuffers
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
GetFileSizeEx

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableSRW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo
SetConsoleTextAttribute

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoGetObjectContext
CoGetApartmentType
CoTaskMemFree

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
RtlPcToFileHeader
RtlVirtualUnwind
RtlUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

oleaut32

SetErrorInfo
GetErrorInfo
SysStringLen
SysAllocString
SysFreeString

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Sections

.text
Size: 528KB - Virtual size: 527KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd978f7824c4be636488fd7eae62ec24

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

ec:5c:b4:09:26:83:d2:7f:e4:b4:98:ad:d3:5c:dd:69:e1:4b:c7:db:ce:9a:d7:79:d8:00:2a:03:ae:fb:2d:5cSigner

Signature Validations

Verification

13-04-2023 18:10 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-debug-l1-1-0

msi

shlwapi

user32

shell32

api-ms-win-core-console-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-2

api-ms-win-core-file-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-datetime-l1-1-0

oleaut32

api-ms-win-core-libraryloader-l1-2-1

Sections

.text Size: 528KB - Virtual size: 527KB

.rdata Size: 152KB - Virtual size: 151KB

.data Size: 25KB - Virtual size: 33KB

.pdata Size: 26KB - Virtual size: 26KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 4KB - Virtual size: 4KB

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

ec:5c:b4:09:26:83:d2:7f:e4:b4:98:ad:d3:5c:dd:69:e1:4b:c7:db:ce:9a:d7:79:d8:00:2a:03:ae:fb:2d:5c
Signer

13-04-2023 18:10
Valid: false

.text
Size: 528KB - Virtual size: 527KB

.rdata
Size: 152KB - Virtual size: 151KB

.data
Size: 25KB - Virtual size: 33KB

.pdata
Size: 26KB - Virtual size: 26KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 4KB - Virtual size: 4KB