19ec79f626b3edbe06922521479a3e0ea0d3b884502a5c8f25afc3ac53a2b7c2

Sharing

Copy URL Twitter E-mail

General

Target

19ec79f626b3edbe06922521479a3e0ea0d3b884502a5c8f25afc3ac53a2b7c2
Size

4.2MB
MD5

c9df18361b95ca180c212db232843518
SHA1

102e504602e7b5a7b890f49172b1d54e75806cfe
SHA256

19ec79f626b3edbe06922521479a3e0ea0d3b884502a5c8f25afc3ac53a2b7c2
SHA512

0444f4e6cced3359b0848082173cb46b8751a476c1607718bb3eff72d8d1a6a5ead19f766302e747fbb7005c0acca292841aeb25af930a30cc0c4fc35dc18e7d
SSDEEP

98304:2oheVeQacgD8CqZ1aFu0epP5JV1z+XaxcdmZNrr:IeRhSjbpBJVRMaKcZp

Score

1^/10

Malware Config

Signatures

Files

19ec79f626b3edbe06922521479a3e0ea0d3b884502a5c8f25afc3ac53a2b7c2
.exe windows x86

6e29094ab2442fb5ec594f97615f19ce

Code Sign

fe:0a:f2:74:22:bb:71:d8:e3:fd:6f:d5:5e:12:91:68
Certificate

Issuer

CN=522434573635311625120101053d123d53210e113336571014061e5d361525000421,POSTALCODE=10307,ST=0b1c1115005f5c4e0f020a1000040b144b0114+ST=0b1c1115494a5c111413080004511740571216140506085f501c465147571b51505119141402511b5716571c511b0904121c030e061111050a0600110102055b0c0b0a070b

Not Before

01/05/2023, 05:17

Not After

30/04/2024, 05:17

Subject

CN=522434573635311625120101053d123d53210e113336571014061e5d361525000421,POSTALCODE=10307,ST=0b1c1115005f5c4e0f020a1000040b144b0114+ST=0b1c1115494a5c111413080004511740571216140506085f501c465147571b51505119141402511b5716571c511b0904121c030e061111050a0600110102055b0c0b0a070b

c6:81:c3:a8:1c:34:c1:28:48:59:07:e8:72:79:b4:b9:86:e8:b3:2a:97:fe:40:07:73:d7:2c:4c:18:be:a8:a9
Signer

Actual PE Digest

c6:81:c3:a8:1c:34:c1:28:48:59:07:e8:72:79:b4:b9:86:e8:b3:2a:97:fe:40:07:73:d7:2c:4c:18:be:a8:a9

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=522434573635311625120101053d123d53210e113336571014061e5d361525000421,POSTALCODE=10307,ST=0b1c1115005f5c4e0f020a1000040b144b0114+ST=0b1c1115494a5c111413080004511740571216140506085f501c465147571b51505119141402511b5716571c511b0904121c030e061111050a0600110102055b0c0b0a070b

03/05/2023, 12:07
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleAliasA
WaitForSingleObject
SetComputerNameW
AddConsoleAliasW
GetComputerNameW
_lclose
GetModuleHandleW
EnumCalendarInfoExW
GetConsoleAliasesA
GetNumberFormatA
GetConsoleTitleA
ReadConsoleW
GetWindowsDirectoryA
GetConsoleAliasExesW
EnumTimeFormatsW
CreateActCtxW
SetProcessPriorityBoost
FindResourceExA
GetCalendarInfoW
GetSystemWindowsDirectoryA
FindNextVolumeW
Beep
WriteConsoleW
GetConsoleFontSize
lstrlenW
GlobalUnlock
GetShortPathNameA
GetCPInfoExW
SetLastError
GetProcAddress
GetLongPathNameA
VirtualAlloc
HeapSize
ReadConsoleA
BeginUpdateResourceW
EnumSystemCodePagesW
_hwrite
SetThreadPriorityBoost
LoadLibraryA
InterlockedExchangeAdd
LocalAlloc
AddAtomW
RemoveDirectoryW
QueryDosDeviceW
WriteProfileSectionW
FindAtomA
EnumResourceTypesW
GetModuleFileNameA
GetOEMCP
SetConsoleCursorInfo
GetConsoleTitleW
WriteConsoleOutputAttribute
GetDiskFreeSpaceExW
WriteFileEx
DeleteTimerQueueTimer
SuspendThread
GetModuleHandleA
GetLocaleInfoA
SystemTimeToFileTime
lstrlenA
GetDefaultCommConfigW
IsBadHugeWritePtr
FindResourceA
HeapAlloc
MultiByteToWideChar
GetCommandLineA
GetStartupInfoA
GetLastError
HeapFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
HeapReAlloc
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetUnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

ToAsciiEx
GetKeyNameTextA
CharLowerBuffW
CreateAcceleratorTableW
GetWindowLongW
GetSysColorBrush
SetCaretPos
ModifyMenuA
IsCharAlphaNumericA
ChangeMenuA

gdi32

CreateHalftonePalette
GetCharABCWidthsW
GetCharWidthW

advapi32

BackupEventLogA

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e29094ab2442fb5ec594f97615f19ce

Code Sign

fe:0a:f2:74:22:bb:71:d8:e3:fd:6f:d5:5e:12:91:68Certificate

c6:81:c3:a8:1c:34:c1:28:48:59:07:e8:72:79:b4:b9:86:e8:b3:2a:97:fe:40:07:73:d7:2c:4c:18:be:a8:a9Signer

Signature Validations

Verification

03/05/2023, 12:07 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Sections

.text Size: 4.0MB - Virtual size: 4.0MB

.data Size: 6KB - Virtual size: 6.1MB

.rsrc Size: 130KB - Virtual size: 130KB

.reloc Size: 31KB - Virtual size: 31KB

fe:0a:f2:74:22:bb:71:d8:e3:fd:6f:d5:5e:12:91:68
Certificate

c6:81:c3:a8:1c:34:c1:28:48:59:07:e8:72:79:b4:b9:86:e8:b3:2a:97:fe:40:07:73:d7:2c:4c:18:be:a8:a9
Signer

03/05/2023, 12:07
Valid: false

.text
Size: 4.0MB - Virtual size: 4.0MB

.data
Size: 6KB - Virtual size: 6.1MB

.rsrc
Size: 130KB - Virtual size: 130KB

.reloc
Size: 31KB - Virtual size: 31KB