AIBgRemoverCN 6811348[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AIBgRemoverCN 6811348.exe
Size

14.6MB
MD5

6b7476b7280ba82e924622d6c7f35cc5
SHA1

6513d47ec15fc5ba7a24989bb49700461d2a7403
SHA256

6c64148674f633cb48f5ae31112565e5cd9862758aca67e2275747e393d357c4
SHA512

f50c533ba8772ea8c1e055758fa19a88980a3d69e7ff635c4e8c42057037adf9de5b106bc96d97f6418ad3afc3e6a2b7627296c1fcaff8db51ab958cbef27f0c
SSDEEP

393216:P9PjcliIKbRhvcMt+WHlIKj0U10rxx7kngaY:PZcli3fcMt+KRj0frv7P

Score

1^/10

Malware Config

Signatures

Files

AIBgRemoverCN 6811348.exe
.exe windows x86

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0c:07:0f:b8:42:8c:20:6b:d6:12:cd:60:b5:71:3c:f7
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

12/07/2022, 00:00

Not After

10/07/2025, 23:59

Subject

SERIALNUMBER=91110304MA01J5Q6X5,CN=北京神奇像素科技有限公司,O=北京神奇像素科技有限公司,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e9809ae5b79ee58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e58c97e4baace5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:7e:18:4f:6c:a4:59:69:61:f2:af:6d:1f:67:2a:c7:6f:ce:92:f4:e1:d0:45:b0:cb:a1:e4:d6:f5:e7:f2:e7
Signer

Actual PE Digest

3d:7e:18:4f:6c:a4:59:69:61:f2:af:6d:1f:67:2a:c7:6f:ce:92:f4:e1:d0:45:b0:cb:a1:e4:d6:f5:e7:f2:e7

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91110304MA01J5Q6X5,CN=北京神奇像素科技有限公司,O=北京神奇像素科技有限公司,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e9809ae5b79ee58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e58c97e4baace5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

03/05/2023, 12:02
Valid: true

Chain 1

SERIALNUMBER=91110304MA01J5Q6X5,CN=北京神奇像素科技有限公司,O=北京神奇像素科技有限公司,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e9809ae5b79ee58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e58c97e4baace5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

EurekaLog_AttachedFilesRequestEvent
EurekaLog_CallCreateThread
EurekaLog_CallExceptObject
EurekaLog_CallExitThread
EurekaLog_CallGeneralRaise
EurekaLog_CallResumeThread
EurekaLog_CustomButtonClickEvent
EurekaLog_CustomDataRequestEventEx
EurekaLog_CustomWebFieldsRequestEvent
EurekaLog_ExceptionActionNotifyEvent
EurekaLog_ExceptionErrorNotifyEvent
EurekaLog_ExceptionNotifyEvent
EurekaLog_HandledExceptionNotifyEvent
EurekaLog_LastDelphiException
EurekaLog_PasswordRequestEvent
EurekaLog_PasswordRequestEventEx
ExceptionManager

Sections

CODE
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 36KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 544B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 113KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12.9MB - Virtual size: 12.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

0c:07:0f:b8:42:8c:20:6b:d6:12:cd:60:b5:71:3c:f7Certificate

Extended Key Usages

Key Usages

3d:7e:18:4f:6c:a4:59:69:61:f2:af:6d:1f:67:2a:c7:6f:ce:92:f4:e1:d0:45:b0:cb:a1:e4:d6:f5:e7:f2:e7Signer

Signature Validations

Verification

03/05/2023, 12:02 Valid: true

Chain 1

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 1.6MB - Virtual size: 1.6MB

DATA Size: 67KB - Virtual size: 67KB

BSS Size: - Virtual size: 36KB

.idata Size: 22KB - Virtual size: 21KB

.edata Size: 1024B - Virtual size: 752B

.tls Size: - Virtual size: 544B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 113KB

.rsrc Size: 12.9MB - Virtual size: 12.9MB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

0c:07:0f:b8:42:8c:20:6b:d6:12:cd:60:b5:71:3c:f7
Certificate

3d:7e:18:4f:6c:a4:59:69:61:f2:af:6d:1f:67:2a:c7:6f:ce:92:f4:e1:d0:45:b0:cb:a1:e4:d6:f5:e7:f2:e7
Signer

03/05/2023, 12:02
Valid: true

CODE
Size: 1.6MB - Virtual size: 1.6MB

DATA
Size: 67KB - Virtual size: 67KB

BSS
Size: - Virtual size: 36KB

.idata
Size: 22KB - Virtual size: 21KB

.edata
Size: 1024B - Virtual size: 752B

.tls
Size: - Virtual size: 544B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 113KB

.rsrc
Size: 12.9MB - Virtual size: 12.9MB