6d8d5aac7ffda33caa1addcdc0d4e801de40cb437cf45cface5350710cde2a74[.]sample

Resubmissions

14/05/2023, 07:14

230514-h2y2qadd4s 1

03/12/2022, 22:21

221203-19wknsaf26 1

26/07/2021, 12:57

210726-2z5f2cszd2 1

Sharing

Copy URL Twitter E-mail

General

Target

6d8d5aac7ffda33caa1addcdc0d4e801de40cb437cf45cface5350710cde2a74.sample
Size

280KB
MD5

380545a208f8cc5e4208e0c308e69c42
SHA1

fb66c66cd8fa805394ec7b2253238dfee89b2964
SHA256

6d8d5aac7ffda33caa1addcdc0d4e801de40cb437cf45cface5350710cde2a74
SHA512

73eca1b4d10de365548050b4d0127c82ef18ba9c56c304440413d2691601c772de68230bd53944f8895754ac3bd83e220c104a3cdc6fc9be3d89af6994198ffb
SSDEEP

6144:iegToffRpM0Ck9XDPThGge1mfxkOIrwb88m5u:YyZpEMnhYgxjh

Score

1^/10

Malware Config

Signatures

Files

6d8d5aac7ffda33caa1addcdc0d4e801de40cb437cf45cface5350710cde2a74.sample
.exe windows x86

e2a0e272719c1c6c82741e146ef10cee

Code Sign

11:26:13:b7:b5:f6:96:cf:37:76:80:f6:46:3f:cc:8c
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/08/2019, 00:00

Not After

22/08/2020, 23:59

Subject

CN=Infoware Cloud Limited,O=Infoware Cloud Limited,POSTALCODE=N41 F519,STREET=24 The Waterfront,L=Dromod,ST=Leitrim,C=IE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

01/02/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:80:3a:86:77:6d:6a:f4:b3:a4:1d:fa:d4:39:b7:fa:f5:8d:3f:e9
Signer

Actual PE Digest

0d:80:3a:86:77:6d:6a:f4:b3:a4:1d:fa:d4:39:b7:fa:f5:8d:3f:e9

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Infoware Cloud Limited,O=Infoware Cloud Limited,POSTALCODE=N41 F519,STREET=24 The Waterfront,L=Dromod,ST=Leitrim,C=IE

13/11/2019, 18:14
Valid: true

Chain 1

CN=Infoware Cloud Limited,O=Infoware Cloud Limited,POSTALCODE=N41 F519,STREET=24 The Waterfront,L=Dromod,ST=Leitrim,C=IE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateMutexA
GetOEMCP
GetProcAddress
LoadLibraryW
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
InterlockedDecrement
VirtualAllocEx
TerminateProcess
ExitProcess
HeapDestroy
CreateEventW
GetTickCount
GetEnvironmentStringsW
GetACP
GetCommandLineA
CompareStringW
CompareStringA
GetModuleHandleA
FormatMessageW
CreateEventA
GetLocaleInfoW
GetTimeZoneInformation
GetVersionExA
GetUserDefaultLCID
EnumSystemLocalesA
GetStartupInfoA
GetVersion
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InterlockedIncrement
FatalAppExitA
GetCPInfo
HeapAlloc
VirtualAlloc
HeapReAlloc
IsBadWritePtr
LoadLibraryA
SetConsoleCtrlHandler
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
Sleep
LCMapStringA
LCMapStringW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
SetEnvironmentVariableA

user32

LoadCursorFromFileA

advapi32

RegOpenKeyExW
RegOpenKeyExA

ole32

CoReleaseMarshalData
OleInitialize

setupapi

SetupDecompressOrCopyFileA

Sections

.text
Size: 148KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

e2a0e272719c1c6c82741e146ef10cee

Code Sign

11:26:13:b7:b5:f6:96:cf:37:76:80:f6:46:3f:cc:8cCertificate

Extended Key Usages

Key Usages

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2dCertificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

0d:80:3a:86:77:6d:6a:f4:b3:a4:1d:fa:d4:39:b7:fa:f5:8d:3f:e9Signer

Signature Validations

Verification

13/11/2019, 18:14 Valid: true

Chain 1

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

setupapi

Sections

.text Size: 148KB - Virtual size: 146KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 104KB - Virtual size: 103KB

.reloc Size: 8KB - Virtual size: 4KB

11:26:13:b7:b5:f6:96:cf:37:76:80:f6:46:3f:cc:8c
Certificate

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

0d:80:3a:86:77:6d:6a:f4:b3:a4:1d:fa:d4:39:b7:fa:f5:8d:3f:e9
Signer

13/11/2019, 18:14
Valid: true

.text
Size: 148KB - Virtual size: 146KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 104KB - Virtual size: 103KB

.reloc
Size: 8KB - Virtual size: 4KB