58ff02258749716f030394daa1577b359684159ee33263cc7ac73945f108925a

Sharing

Copy URL Twitter E-mail

General

Target

58ff02258749716f030394daa1577b359684159ee33263cc7ac73945f108925a
Size

29.2MB
MD5

a494e9ff391db7deac7ad21cadf45cca
SHA1

881ce85775cb4283ba9acc0f58f9fcfd477b28be
SHA256

58ff02258749716f030394daa1577b359684159ee33263cc7ac73945f108925a
SHA512

1b0bba6620a8baf7196e74f8ac7a165ffc26b04f9bd2931435bd20a42fb6105fd9784f5b6c156950727e0d17e14ecbc835f338cf9edca565b16a84a32e03f083
SSDEEP

393216:g2t8beUamPDDeLUt2/URvCdes2DJgTPI+ua6egb0WTbFW/cRaGFdG25B6J2xAtWQ:lwdveLteCINJSg+uSwF2257mL

Score

1^/10

Malware Config

Signatures

Files

58ff02258749716f030394daa1577b359684159ee33263cc7ac73945f108925a
.exe windows x64

ffd0fa11d62a03aa3299c02a14b1bf77

Code Sign

20:65:8e:ff:a8:b5:48:a6:48:67:4e:bf:5d:73:46:4f
Certificate

Issuer

CN=Air Ltd.

Not Before

18/05/2023, 19:36

Not After

18/05/2024, 19:56

Subject

CN=Air Ltd.

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b9:c9:3e:9b:46:73:f6:f3:76:0a:b5:8e:d4:cc:6e:39:05:1d:53:a2:fb:b1:9a:86:c0:99:6a:c9:c5:a9:92:8f
Signer

Actual PE Digest

b9:c9:3e:9b:46:73:f6:f3:76:0a:b5:8e:d4:cc:6e:39:05:1d:53:a2:fb:b1:9a:86:c0:99:6a:c9:c5:a9:92:8f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SizeofResource
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

advapi32

CryptCreateHash

user32

GetSystemMetrics

shell32

ShellExecuteExW

ole32

CoInitializeEx

crypt32

CryptDecodeObjectEx

ws2_32

connect

bcrypt

BCryptGenRandom

oleaut32

SysFreeString

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: - Virtual size: 629KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.juba0
Size: - Virtual size: 17.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.juba1
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.juba2
Size: 28.8MB - Virtual size: 28.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 329KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ffd0fa11d62a03aa3299c02a14b1bf77

Code Sign

20:65:8e:ff:a8:b5:48:a6:48:67:4e:bf:5d:73:46:4fCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

b9:c9:3e:9b:46:73:f6:f3:76:0a:b5:8e:d4:cc:6e:39:05:1d:53:a2:fb:b1:9a:86:c0:99:6a:c9:c5:a9:92:8fSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

user32

shell32

ole32

crypt32

ws2_32

bcrypt

oleaut32

ntdll

Sections

.text Size: - Virtual size: 629KB

.rdata Size: - Virtual size: 179KB

.data Size: - Virtual size: 10KB

.pdata Size: - Virtual size: 21KB

_RDATA Size: - Virtual size: 348B

.juba0 Size: - Virtual size: 17.4MB

.juba1 Size: 4KB - Virtual size: 3KB

.juba2 Size: 28.8MB - Virtual size: 28.8MB

.reloc Size: 512B - Virtual size: 60B

.rsrc Size: 329KB - Virtual size: 328KB

20:65:8e:ff:a8:b5:48:a6:48:67:4e:bf:5d:73:46:4f
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

b9:c9:3e:9b:46:73:f6:f3:76:0a:b5:8e:d4:cc:6e:39:05:1d:53:a2:fb:b1:9a:86:c0:99:6a:c9:c5:a9:92:8f
Signer

.text
Size: - Virtual size: 629KB

.rdata
Size: - Virtual size: 179KB

.data
Size: - Virtual size: 10KB

.pdata
Size: - Virtual size: 21KB

_RDATA
Size: - Virtual size: 348B

.juba0
Size: - Virtual size: 17.4MB

.juba1
Size: 4KB - Virtual size: 3KB

.juba2
Size: 28.8MB - Virtual size: 28.8MB

.reloc
Size: 512B - Virtual size: 60B

.rsrc
Size: 329KB - Virtual size: 328KB