70e843771b1203b42aa7e8e75f1f097e062e012629b2ea41bf114863660b0e32

Sharing

Copy URL Twitter E-mail

General

Target

70e843771b1203b42aa7e8e75f1f097e062e012629b2ea41bf114863660b0e32
Size

5.5MB
MD5

ed7eb5a29e5f55f98ba131ca21a40d2c
SHA1

90bbca4ba1b56affe722f231d3a94e9c9fbff0f7
SHA256

70e843771b1203b42aa7e8e75f1f097e062e012629b2ea41bf114863660b0e32
SHA512

6ad8cb71a0be063d0bd8df6a867b6199c221b8c9aeb54fd4326b4e4508b2b3bc40bcb9b5d73ad81d4a2f6ad15769e5af8e602deab3c5c91e25104696556ade29
SSDEEP

98304:UkPtinbJBtJ5E0tG+nOZ60DP5UEkVveov2weQ1XyebtSVCnYirzHkguwGLhwAUWb:UKibFnzG+Oo0DP5UEkVX2iXOVDirDAwW

Score

1^/10

Malware Config

Signatures

Files

70e843771b1203b42aa7e8e75f1f097e062e012629b2ea41bf114863660b0e32
.exe windows x64

847ebbfe628d1e7775aaf964905b965f

Code Sign

33:00:00:04:0a:87:d0:ea:67:86:e3:6b:07:00:00:00:00:04:0a
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/01/2023, 19:22

Not After

15/12/2023, 19:22

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:9a:a3:18:52:4f:3e:e8:20:68:b1:82:27:33:e2:66:44:07:ff:52:f7:ac:49:69:36:0b:34:6c:e3:ee:1c:f0
Signer

Actual PE Digest

1f:9a:a3:18:52:4f:3e:e8:20:68:b1:82:27:33:e2:66:44:07:ff:52:f7:ac:49:69:36:0b:34:6c:e3:ee:1c:f0

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetVersionExA
GetVersion
GetThreadLocale
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CheckMenuItem

gdi32

CreateEllipticRgn

oleaut32

SysAllocString

msimg32

TransparentBlt

comctl32

ImageList_GetIconSize

shlwapi

PathFindExtensionA

oledlg

ord8

gdiplus

GdipBitmapUnlockBits

oleacc

AccessibleObjectFromWindow

imm32

ImmGetOpenStatus

winmm

PlaySoundA

winspool.drv

ClosePrinter

comdlg32

GetFileTitleA

advapi32

RegCreateKeyExA

shell32

DragQueryFileA

ole32

CoRevokeClassObject

Sections

.text
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 681KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

847ebbfe628d1e7775aaf964905b965f

Code Sign

33:00:00:04:0a:87:d0:ea:67:86:e3:6b:07:00:00:00:00:04:0aCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

1f:9a:a3:18:52:4f:3e:e8:20:68:b1:82:27:33:e2:66:44:07:ff:52:f7:ac:49:69:36:0b:34:6c:e3:ee:1c:f0Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

oleaut32

msimg32

comctl32

shlwapi

oledlg

gdiplus

oleacc

imm32

winmm

winspool.drv

comdlg32

advapi32

shell32

ole32

Sections

.text Size: - Virtual size: 1.9MB

.rdata Size: - Virtual size: 681KB

.data Size: - Virtual size: 86KB

.pdata Size: - Virtual size: 91KB

text Size: - Virtual size: 2KB

data Size: - Virtual size: 1KB

.vmp0 Size: - Virtual size: 4.5MB

.vmp1 Size: 5.3MB - Virtual size: 5.3MB

.reloc Size: 512B - Virtual size: 12B

.rsrc Size: 190KB - Virtual size: 189KB

33:00:00:04:0a:87:d0:ea:67:86:e3:6b:07:00:00:00:00:04:0a
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

1f:9a:a3:18:52:4f:3e:e8:20:68:b1:82:27:33:e2:66:44:07:ff:52:f7:ac:49:69:36:0b:34:6c:e3:ee:1c:f0
Signer

.text
Size: - Virtual size: 1.9MB

.rdata
Size: - Virtual size: 681KB

.data
Size: - Virtual size: 86KB

.pdata
Size: - Virtual size: 91KB

text
Size: - Virtual size: 2KB

data
Size: - Virtual size: 1KB

.vmp0
Size: - Virtual size: 4.5MB

.vmp1
Size: 5.3MB - Virtual size: 5.3MB

.reloc
Size: 512B - Virtual size: 12B

.rsrc
Size: 190KB - Virtual size: 189KB