5254fc5d_aaa43d6494a421a710a52e589567289ca7131a9737eddc35bddd21b77b6a7bf8[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

5254fc5d_aaa43d6494a421a710a52e589567289ca7131a9737eddc35bddd21b77b6a7bf8.7z
Size

21.1MB
MD5

e17d230f8ae08c8200acbed0959fa961
SHA1

de40d8394df915700ae20c0786e3ae32a35597f8
SHA256

24fd03c709d8b6fcb083d73883bdf80eeac300e6528d2a7a9e0d5ded958d3362
SHA512

0f30e8a48ea611abd2bf2489ab46e43fc1ac1e4aaf89b69d67c47ccb91729cb7cf16c39e1f5a8bdeb717ae1410661b84ddcbcb76c6679ae5507b0ba8d1e528f0
SSDEEP

393216:OcWNtam1UJv6lFHc8bnOP2vCrDGfUq7uT8W19+wsH57xSssDec9jQxaLHz4shGPH:BEagAyJKrSHyT/+7HDEDeTm8ruQIQ6e

Score

1^/10

Malware Config

Signatures

Files

5254fc5d_aaa43d6494a421a710a52e589567289ca7131a9737eddc35bddd21b77b6a7bf8.7z
.7z

Password: infected
5254fc5d_aaa43d6494a421a710a52e589567289ca7131a9737eddc35bddd21b77b6a7bf8
.exe windows x64

Password: infected

cb5df3dfa0d1b94217ee496690c3a796

Code Sign

05:35:93:bf:71:f7:48:1b:9f:b7:6b:cb:4e:cc:f5:78
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/12/2020, 00:00

Not After

20/12/2022, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:82:f6:e6:2f:de:7c:90:65:07:3a:bd:81:88:ef:68:d3:44:48:28:13:2b:bf:16:7b:06:5b:dc:4b:a2:91:5e
Signer

Actual PE Digest

7a:82:f6:e6:2f:de:7c:90:65:07:3a:bd:81:88:ef:68:d3:44:48:28:13:2b:bf:16:7b:06:5b:dc:4b:a2:91:5e

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

GetSystemMetrics

kernel32

GetSystemDirectoryA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

advapi32

CryptAcquireContextA

shell32

ShellExecuteExW

ole32

CoInitializeEx

crypt32

PFXImportCertStore

ws2_32

connect

bcrypt

BCryptGenRandom

oleaut32

SysFreeString

ntdll

ZwUnmapViewOfSection

vcruntime140

__C_specific_handler

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-stdio-l1-1-0

fgets

api-ms-win-crt-runtime-l1-1-0

__sys_errlist

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

strftime

api-ms-win-crt-filesystem-l1-1-0

_stat64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 493KB - Virtual size: 492KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vRh
Size: 25.7MB - Virtual size: 25.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xE\
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cdx
Size: 15.9MB - Virtual size: 15.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

cb5df3dfa0d1b94217ee496690c3a796

Code Sign

05:35:93:bf:71:f7:48:1b:9f:b7:6b:cb:4e:cc:f5:78Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

7a:82:f6:e6:2f:de:7c:90:65:07:3a:bd:81:88:ef:68:d3:44:48:28:13:2b:bf:16:7b:06:5b:dc:4b:a2:91:5eSigner

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

advapi32

shell32

ole32

crypt32

ws2_32

bcrypt

oleaut32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 493KB - Virtual size: 492KB

.rdata Size: 141KB - Virtual size: 141KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 16KB - Virtual size: 15KB

.vRh Size: 25.7MB - Virtual size: 25.7MB

.xE\ Size: 4KB - Virtual size: 3KB

.cdx Size: 15.9MB - Virtual size: 15.9MB

.reloc Size: 3KB - Virtual size: 3KB

.rsrc Size: 22KB - Virtual size: 22KB

05:35:93:bf:71:f7:48:1b:9f:b7:6b:cb:4e:cc:f5:78
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

7a:82:f6:e6:2f:de:7c:90:65:07:3a:bd:81:88:ef:68:d3:44:48:28:13:2b:bf:16:7b:06:5b:dc:4b:a2:91:5e
Signer

.text
Size: 493KB - Virtual size: 492KB

.rdata
Size: 141KB - Virtual size: 141KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 16KB - Virtual size: 15KB

.vRh
Size: 25.7MB - Virtual size: 25.7MB

.xE\
Size: 4KB - Virtual size: 3KB

.cdx
Size: 15.9MB - Virtual size: 15.9MB

.reloc
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 22KB - Virtual size: 22KB