1d2b30b68962af3d19af75515aae44eeb39031432655824b18d1121a8a582aab

Sharing

Copy URL Twitter E-mail

General

Target

1d2b30b68962af3d19af75515aae44eeb39031432655824b18d1121a8a582aab
Size

28.0MB
MD5

83432cfda6a30f376d00eba4e1e6c93f
SHA1

f4e013b822ab31df44280557f6e03dfd45525e75
SHA256

1d2b30b68962af3d19af75515aae44eeb39031432655824b18d1121a8a582aab
SHA512

afa88932e20b9b492c7e8fdf37e7ce140d5033464b1103720811105e64c5125c082037e998248179d6d7f021f2c2e3a84cbcb51e97ee016a83b4d92eb3f29e37
SSDEEP

393216:dtFUo3veUOyPie9dUYTPm50rES/6NjBhz1J1yXYrNZ/7cBnKHHAjm3ofcYy:vFUdUUYT28qj3z1yIrNBrQm3ofcYy

Score

1^/10

Malware Config

Signatures

Files

1d2b30b68962af3d19af75515aae44eeb39031432655824b18d1121a8a582aab
.exe windows x64

ffd0fa11d62a03aa3299c02a14b1bf77

Code Sign

09:90:7e:01:ed:c3:e3:4b:49:71:b2:a5:07:92:7b:6e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

14/01/2022, 00:00

Not After

14/01/2023, 23:59

Subject

CN=Cisco Systems\, Inc.,O=Cisco Systems\, Inc.,L=Milpitas,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:c2:63:a8:d8:f0:d9:ff:fc:d7:46:d8:23:12:3d:16:11:25:4f:fc:27:41:55:9b:14:5d:17:93:97:8d:20:32
Signer

Actual PE Digest

2d:c2:63:a8:d8:f0:d9:ff:fc:d7:46:d8:23:12:3d:16:11:25:4f:fc:27:41:55:9b:14:5d:17:93:97:8d:20:32

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SizeofResource
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

advapi32

CryptCreateHash

user32

GetSystemMetrics

shell32

ShellExecuteExW

ole32

CoInitializeEx

crypt32

CryptDecodeObjectEx

ws2_32

connect

bcrypt

BCryptGenRandom

oleaut32

SysFreeString

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: - Virtual size: 629KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.roba0
Size: - Virtual size: 17.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.roba1
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.roba2
Size: 27.9MB - Virtual size: 27.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ffd0fa11d62a03aa3299c02a14b1bf77

Code Sign

09:90:7e:01:ed:c3:e3:4b:49:71:b2:a5:07:92:7b:6eCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

2d:c2:63:a8:d8:f0:d9:ff:fc:d7:46:d8:23:12:3d:16:11:25:4f:fc:27:41:55:9b:14:5d:17:93:97:8d:20:32Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

user32

shell32

ole32

crypt32

ws2_32

bcrypt

oleaut32

ntdll

Sections

.text Size: - Virtual size: 629KB

.rdata Size: - Virtual size: 179KB

.data Size: - Virtual size: 10KB

.pdata Size: - Virtual size: 21KB

_RDATA Size: - Virtual size: 348B

.roba0 Size: - Virtual size: 17.5MB

.roba1 Size: 4KB - Virtual size: 3KB

.roba2 Size: 27.9MB - Virtual size: 27.9MB

.reloc Size: 512B - Virtual size: 60B

.rsrc Size: 18KB - Virtual size: 18KB

09:90:7e:01:ed:c3:e3:4b:49:71:b2:a5:07:92:7b:6e
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

2d:c2:63:a8:d8:f0:d9:ff:fc:d7:46:d8:23:12:3d:16:11:25:4f:fc:27:41:55:9b:14:5d:17:93:97:8d:20:32
Signer

.text
Size: - Virtual size: 629KB

.rdata
Size: - Virtual size: 179KB

.data
Size: - Virtual size: 10KB

.pdata
Size: - Virtual size: 21KB

_RDATA
Size: - Virtual size: 348B

.roba0
Size: - Virtual size: 17.5MB

.roba1
Size: 4KB - Virtual size: 3KB

.roba2
Size: 27.9MB - Virtual size: 27.9MB

.reloc
Size: 512B - Virtual size: 60B

.rsrc
Size: 18KB - Virtual size: 18KB