12559c9388e51a9dd771cda0eadb87ede408b089fcbad6103efcfa271459b97f

Sharing

Copy URL Twitter E-mail

General

Target

12559c9388e51a9dd771cda0eadb87ede408b089fcbad6103efcfa271459b97f
Size

84KB
MD5

ea4a5db744a0644dca26b11e027dbcdf
SHA1

b9471c24f2a014ed4a56f0bea4f34cb6f7ece58b
SHA256

12559c9388e51a9dd771cda0eadb87ede408b089fcbad6103efcfa271459b97f
SHA512

f24b08fb3de598dbb0455c084289114d4ce572adb2f2d10c0bc01fa7da1d1ebce818b9f634ec1b1eb94dae7cb00f00ae20fbb73946c962f1f30651b31ff34521
SSDEEP

1536:otByQx/GQSRa7KrC+14nwrDeDjNUynEz6xrX4A4MSZSkQeDaXjXgZC3elkYsZbD:ot0Qaa7gC+14nVnL7h4AzFkQlXICQkYe

Score

1^/10

Malware Config

Signatures

Files

12559c9388e51a9dd771cda0eadb87ede408b089fcbad6103efcfa271459b97f
.dll windows x64

4563ac4a8448208a475ecfcc25377dc6

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:11:ed:10:06:34:3e:0f:d1:bc:55:11:f3:ab:20:84
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

31/08/2022, 00:00

Not After

31/08/2023, 23:59

Subject

CN=12980215 Canada Inc.,O=12980215 Canada Inc.,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a6:0b:7b:89:80:c0:c4:43:90:bf:5d:84:80:78:01:1b:2a:35:e7:50:18:2d:13:15:06:19:65:c6:4a:71:58:bf
Signer

Actual PE Digest

a6:0b:7b:89:80:c0:c4:43:90:bf:5d:84:80:78:01:1b:2a:35:e7:50:18:2d:13:15:06:19:65:c6:4a:71:58:bf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

Process32First
GetCurrentProcess
GetProcessMitigationPolicy
OpenProcess
SetProcessMitigationPolicy
CreateToolhelp32Snapshot
Process32Next
CloseHandle
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
RtlCaptureContext
InitializeSListHead
IsDebuggerPresent

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
__C_specific_handler
__std_exception_destroy
memmove
memcpy
__std_type_info_destroy_list
__std_exception_copy
memset

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-runtime-l1-1-0

_cexit
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_invalid_parameter_noinfo_noreturn
_execute_onexit_table

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4563ac4a8448208a475ecfcc25377dc6

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

1d:11:ed:10:06:34:3e:0f:d1:bc:55:11:f3:ab:20:84Certificate

Extended Key Usages

Key Usages

a6:0b:7b:89:80:c0:c4:43:90:bf:5d:84:80:78:01:1b:2a:35:e7:50:18:2d:13:15:06:19:65:c6:4a:71:58:bfSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 19KB - Virtual size: 19KB

.rdata Size: 55KB - Virtual size: 54KB

.data Size: 512B - Virtual size: 103KB

.pdata Size: 1024B - Virtual size: 720B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 84B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

1d:11:ed:10:06:34:3e:0f:d1:bc:55:11:f3:ab:20:84
Certificate

a6:0b:7b:89:80:c0:c4:43:90:bf:5d:84:80:78:01:1b:2a:35:e7:50:18:2d:13:15:06:19:65:c6:4a:71:58:bf
Signer

.text
Size: 19KB - Virtual size: 19KB

.rdata
Size: 55KB - Virtual size: 54KB

.data
Size: 512B - Virtual size: 103KB

.pdata
Size: 1024B - Virtual size: 720B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 84B