0902e3bd2b5aab8512ee729d3[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

0902e3bd2b5aab8512ee729d3.exe
Size

146KB
MD5

a286bf3a9b847c897f76487b4e4bf1ef
SHA1

699fa257c77c35112897e8a1fee990bab57cd7c3
SHA256

0902e3bd2b5aab8512ee729d3c09bd16f14e7a70c47b61519047db316237ed26
SHA512

fa1f15a6172f837152163bfb2c8a0fe053834195b435d80905f78f4f3588f11c0135fcc674c42af5d72ae4167c87c0128b233b626b69d7cb5b8dc72caf5aef02
SSDEEP

3072:zeEnujURRqcLCjGqdY2H3TEhk4y0nwZlP:6EnujhcLhqG234k4jwX

Score

1^/10

Malware Config

Signatures

Files

0902e3bd2b5aab8512ee729d3.exe
.exe windows x86

229cf8902ddcac5e42b3369206f18e8f

Code Sign

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08/03/2016, 13:10

Not After

30/05/2027, 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:ae:ce:a4:5b:fd:40:ce:7d:62:d7:d7:11:91:6d:7d
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/02/2019, 00:00

Not After

22/02/2020, 23:59

Subject

CN=ALINA LTD,O=ALINA LTD,POSTALCODE=M1 2JQ,STREET=83 Ducie Street,L=MANCHESTER,ST=MANCHESTER,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

13:ea:28:70:5b:f4:ec:ed:0c:36:63:09:80:61:43:36
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

26:b6:b1:5b:fa:13:6d:79:29:7a:14:96:3a:b0:94:3a:b4:e8:38:44
Signer

Actual PE Digest

26:b6:b1:5b:fa:13:6d:79:29:7a:14:96:3a:b0:94:3a:b4:e8:38:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

NetGroupGetInfo

user32

ValidateRgn

gdi32

GetPixelFormat

kernel32

GlobalFlags
ExitProcess
LCMapStringA
GetAtomNameW

advapi32

AdjustTokenPrivileges
GetSecurityDescriptorRMControl

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

229cf8902ddcac5e42b3369206f18e8f

Code Sign

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70Certificate

Extended Key Usages

Key Usages

09:ae:ce:a4:5b:fd:40:ce:7d:62:d7:d7:11:91:6d:7dCertificate

Extended Key Usages

Key Usages

13:ea:28:70:5b:f4:ec:ed:0c:36:63:09:80:61:43:36Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

26:b6:b1:5b:fa:13:6d:79:29:7a:14:96:3a:b0:94:3a:b4:e8:38:44Signer

Headers

DLL Characteristics

File Characteristics

Imports

netapi32

user32

gdi32

kernel32

advapi32

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 17KB

.reloc Size: 84KB - Virtual size: 82KB

.rsrc Size: 4KB - Virtual size: 896B

.reloc Size: 4KB - Virtual size: 1KB

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

09:ae:ce:a4:5b:fd:40:ce:7d:62:d7:d7:11:91:6d:7d
Certificate

13:ea:28:70:5b:f4:ec:ed:0c:36:63:09:80:61:43:36
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

26:b6:b1:5b:fa:13:6d:79:29:7a:14:96:3a:b0:94:3a:b4:e8:38:44
Signer

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 17KB

.reloc
Size: 84KB - Virtual size: 82KB

.rsrc
Size: 4KB - Virtual size: 896B

.reloc
Size: 4KB - Virtual size: 1KB