playit-0[.]9[.]3-signed[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

playit-0.9.3-signed.exe
Size

13.1MB
MD5

da0750733bf36c61222eefaba4805dcb
SHA1

304e90d123300e646b768f1f358e59ba506b7dce
SHA256

c9ff8f05cdde137cb0e1e386184a42d4889988c4cfd235fd3340fe545f5e06ac
SHA512

f9a8e89f294257f785388e237a6da1f363f8d78af7c9b473d67261b99526224eb84598eacbba17f01a9f2eb2f6fea0740f7e37df92891df8fa39a33820287454
SSDEEP

98304:6apOovS/Un0PwGpPRzrkEF1u+aVbrE+ziKZRqAo/pkyJIjKAUroIMlUtbPb9c/z4:zkr7pZk5EgiSs5

Score

1^/10

Malware Config

Signatures

Files

playit-0.9.3-signed.exe
.exe windows x64

5617d2ae4986f292c850e0f0e71f97d9

Code Sign

02:62:f5:e1:d6:f4:86:63:31:1c:24:67:58:85:85:68
Certificate

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

19-06-2020 22:28

Not After

19-06-2023 22:28

Subject

SERIALNUMBER=NV20201722387,CN=Developed Methods LLC,O=Developed Methods LLC,L=Zephyr Cove,ST=Nevada,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13064e6576616461,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

26-03-2019 17:44

Not After

22-03-2034 17:44

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

22:5e:c3:de:22:6e:0c:a6:49:3c:e5:ae:49:d4:b9:39:5c:92:5d:ea:df:6a:1f:13:8b:1a:82:00:9d:0b:17:77
Signer

Actual PE Digest

22:5e:c3:de:22:6e:0c:a6:49:3c:e5:ae:49:d4:b9:39:5c:92:5d:ea:df:6a:1f:13:8b:1a:82:00:9d:0b:17:77

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=NV20201722387,CN=Developed Methods LLC,O=Developed Methods LLC,L=Zephyr Cove,ST=Nevada,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13064e6576616461,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

24-04-2023 13:31
Valid: true

Chain 1

SERIALNUMBER=NV20201722387,CN=Developed Methods LLC,O=Developed Methods LLC,L=Zephyr Cove,ST=Nevada,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13064e6576616461,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ncrypt

NCryptFreeObject

advapi32

CryptDestroyKey
OpenProcessToken
SystemFunction036

ws2_32

WSACleanup
WSADuplicateSocketW
WSAGetLastError
WSAIoctl
WSAPoll
WSARecv
WSARecvFrom
WSASend
WSASendTo
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
CancelIo
CancelIoEx
CloseHandle
CompareStringOrdinal
ConnectNamedPipe
CopyFileExW
CreateConsoleScreenBuffer
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreateIoCompletionPort
CreateMutexA
CreateNamedPipeW
CreateProcessW
CreateSemaphoreW
CreateSymbolicLinkW
CreateThread
CreateToolhelp32Snapshot
DeleteFileW
DeviceIoControl
DisconnectNamedPipe
DuplicateHandle
ExitProcess
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFinalPathNameByHandleW
GetFullPathNameW
GetLargestConsoleWindowSize
GetLastError
GetLogicalProcessorInformation
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNamedPipeInfo
GetNumberOfConsoleInputEvents
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessId
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetWindowsDirectoryW
HeapAlloc
HeapFree
HeapReAlloc
LoadLibraryA
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleInputW
ReadConsoleW
ReadFile
ReadFileEx
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryW
SetConsoleActiveScreenBuffer
SetConsoleCtrlHandler
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsoleScreenBufferSize
SetConsoleTextAttribute
SetConsoleWindowInfo
SetCurrentDirectoryW
SetEnvironmentVariableW
SetFileAttributesW
SetFileCompletionNotificationModes
SetFileInformationByHandle
SetFilePointerEx
SetHandleInformation
SetLastError
SetThreadStackGuarantee
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SleepEx
SwitchToThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
UnmapViewOfFile
UnregisterWaitEx
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WriteConsoleW
WriteFile
WriteFileEx
DeleteCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
RaiseException
RtlAddFunctionTable
RtlUnwindEx
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

user32

GetForegroundWindow
GetKeyboardLayout
GetWindowThreadProcessId
ToUnicodeEx

userenv

GetUserProfileDirectoryW

ole32

CoInitializeEx
CoUninitialize

crypt32

CertAddCertificateContextToStore
CertAddEncodedCTLToStore
CertAddEncodedCertificateToStore
CertCloseStore
CertCreateCertificateContext
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertDuplicateStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertOpenStore
CertSetCertificateContextProperty
CertVerifyTimeValidity
CryptAcquireCertificatePrivateKey
CryptBinaryToStringA
CryptEncodeObjectEx
CryptHashCertificate
CryptStringToBinaryA
PFXExportCertStore
PFXImportCertStore

secur32

AcquireCredentialsHandleA
FreeCredentialsHandle

shell32

ShellExecuteW

bcrypt

BCryptGenRandom

msvcrt

__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_fpreset
_initterm
_lock
_onexit
_unlock
abort
atexit
calloc
exit
fmod
fmodf
fprintf
free
fwrite
malloc
signal
strncmp
vfprintf

ntdll

NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlNtStatusToDosError
RtlVirtualUnwind
__C_specific_handler
floor
memcmp
memcpy
memmove
memset
strlen

Sections

.text
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 570KB - Virtual size: 570KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5617d2ae4986f292c850e0f0e71f97d9

Code Sign

02:62:f5:e1:d6:f4:86:63:31:1c:24:67:58:85:85:68Certificate

Extended Key Usages

Key Usages

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04Certificate

Extended Key Usages

Key Usages

22:5e:c3:de:22:6e:0c:a6:49:3c:e5:ae:49:d4:b9:39:5c:92:5d:ea:df:6a:1f:13:8b:1a:82:00:9d:0b:17:77Signer

Signature Validations

Verification

24-04-2023 13:31 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

ncrypt

advapi32

ws2_32

kernel32

user32

userenv

ole32

crypt32

secur32

shell32

bcrypt

msvcrt

ntdll

Sections

.text Size: 6.2MB - Virtual size: 6.2MB

.data Size: 25KB - Virtual size: 22KB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.pdata Size: 215KB - Virtual size: 215KB

.xdata Size: 570KB - Virtual size: 570KB

.bss Size: - Virtual size: 4KB

.idata Size: 10KB - Virtual size: 10KB

.CRT Size: 512B - Virtual size: 208B

.tls Size: 512B - Virtual size: 104B

02:62:f5:e1:d6:f4:86:63:31:1c:24:67:58:85:85:68
Certificate

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

22:5e:c3:de:22:6e:0c:a6:49:3c:e5:ae:49:d4:b9:39:5c:92:5d:ea:df:6a:1f:13:8b:1a:82:00:9d:0b:17:77
Signer

24-04-2023 13:31
Valid: true

.text
Size: 6.2MB - Virtual size: 6.2MB

.data
Size: 25KB - Virtual size: 22KB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.pdata
Size: 215KB - Virtual size: 215KB

.xdata
Size: 570KB - Virtual size: 570KB

.bss
Size: - Virtual size: 4KB

.idata
Size: 10KB - Virtual size: 10KB

.CRT
Size: 512B - Virtual size: 208B

.tls
Size: 512B - Virtual size: 104B