FATTURA_[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

FATTURA_.exe
Size

188KB
MD5

328b725b116f47d648faf7f7ddbb5188
SHA1

d5a1d8e599d397cd53abd160086aed6422177539
SHA256

49cc8ff363544178e9b08989622638de92ca05aea3f8ba50be8257afae02b340
SHA512

4bcb7f6e27defb1de55f2c58d161d008ac79dc93296f4a766f37fa4a6476a96fc57e6d3b75283fc42f75d62db66bb24521e0e657d9d9e3c518381f83e8547977
SSDEEP

3072:EeEdAwOZs0vupaEJnnjzmqBLmgRTVKvAoAt5RoDuK4vLn5d079cAbu:E3Oq9DVbvRoDF4vLE7fbu

Score

1^/10

Malware Config

Signatures

Files

FATTURA_.exe
.exe windows x64

1e3c4e072d6a52ba210cdd5519484719

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:11:ed:10:06:34:3e:0f:d1:bc:55:11:f3:ab:20:84
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

31/08/2022, 00:00

Not After

31/08/2023, 23:59

Subject

CN=12980215 Canada Inc.,O=12980215 Canada Inc.,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d9:be:c0:fd:21:d2:63:99:46:65:89:89:e8:8c:d9:82:7b:92:65:47
Signer

Actual PE Digest

d9:be:c0:fd:21:d2:63:99:46:65:89:89:e8:8c:d9:82:7b:92:65:47

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=12980215 Canada Inc.,O=12980215 Canada Inc.,ST=Ontario,C=CA

15/05/2023, 13:30
Valid: true

Chain 1

CN=12980215 Canada Inc.,O=12980215 Canada Inc.,ST=Ontario,C=CA

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__C_specific_handler
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf

wininet

InternetCheckConnectionA

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1e3c4e072d6a52ba210cdd5519484719

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

1d:11:ed:10:06:34:3e:0f:d1:bc:55:11:f3:ab:20:84Certificate

Extended Key Usages

Key Usages

d9:be:c0:fd:21:d2:63:99:46:65:89:89:e8:8c:d9:82:7b:92:65:47Signer

Signature Validations

Verification

15/05/2023, 13:30 Valid: true

Chain 1

Headers

File Characteristics

Imports

kernel32

msvcrt

wininet

Sections

.text Size: 66KB - Virtual size: 66KB

.data Size: 109KB - Virtual size: 109KB

.rdata Size: 1KB - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 636B

.xdata Size: 1024B - Virtual size: 524B

.bss Size: - Virtual size: 2KB

.idata Size: 2KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

1d:11:ed:10:06:34:3e:0f:d1:bc:55:11:f3:ab:20:84
Certificate

d9:be:c0:fd:21:d2:63:99:46:65:89:89:e8:8c:d9:82:7b:92:65:47
Signer

15/05/2023, 13:30
Valid: true

.text
Size: 66KB - Virtual size: 66KB

.data
Size: 109KB - Virtual size: 109KB

.rdata
Size: 1KB - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 636B

.xdata
Size: 1024B - Virtual size: 524B

.bss
Size: - Virtual size: 2KB

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B