f9cc89ef84bfc6b9b39038635f8ed70999f2acef723428a1fcc4a764cfce9960

Resubmissions

16-08-2023 08:23

230816-j96xzagh98 1

11-08-2023 04:42

230811-fbybdsah57 1

Sharing

Copy URL

Twitter E-mail

General

Target

f9cc89ef84bfc6b9b39038635f8ed70999f2acef723428a1fcc4a764cfce9960
Size

1.2MB
MD5

fbbac1795b91061717853be953b8daa5
SHA1

5839ebbaa1a6a65036e97cf24e8d2ebbc8668637
SHA256

f9cc89ef84bfc6b9b39038635f8ed70999f2acef723428a1fcc4a764cfce9960
SHA512

cc8e22947c3aee701e771567c23c8c09e69bdbaf8b63f3ae304263a17e4c6715d7473cb2f85368a440dbcb012f1c9c776d92f6ca27f2df5ec9dc8dcd56a07942
SSDEEP

12288:hERSwB7X1vbW1yR/+8JZZuqmsiGHJGD51jiXsg9edOY7n:5izRbWy/+8JZEK2jiXGd57

Score

1^/10

Malware Config

Signatures

Files

f9cc89ef84bfc6b9b39038635f8ed70999f2acef723428a1fcc4a764cfce9960
.exe windows x64

c89108032f4ecdb4930d4f2cb91f4694

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

49:dd:0b:d0:bd:54:3d:db:4f:1d:8f:6b:b1:74:ca:0b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

30-03-2018 00:00

Not After

28-05-2021 23:59

Subject

CN=Netsparker Ltd,O=Netsparker Ltd,L=Pinner,ST=Middlesex,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

22-07-2014 00:00

Not After

21-07-2024 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:59:b3:72:8a:05:8e:08:eb:5b:aa:c5:fa:d8:ef:89:5f:ee:03:b2:d4:0c:26:4a:aa:e8:21:58:54:77:f1:b1
Signer

Actual PE Digest

1c:59:b3:72:8a:05:8e:08:eb:5b:aa:c5:fa:d8:ef:89:5f:ee:03:b2:d4:0c:26:4a:aa:e8:21:58:54:77:f1:b1

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
DeleteCriticalSection
EnterCriticalSection
GetLastError
GetProcAddress
GetStartupInfoA
InitializeConditionVariable
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableCS
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_commode
_errno
_fileno
_fmode
_initterm
_lock
_onexit
_setjmp
_setmode
_unlock
clock
abort
calloc
exit
fflush
fprintf
fputc
free
fwrite
localeconv
longjmp
malloc
memcmp
memcpy
memmove
memset
qsort
signal
strerror
strlen
strncmp
vfprintf
wcslen

user32

MessageBoxA

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

c89108032f4ecdb4930d4f2cb91f4694

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

49:dd:0b:d0:bd:54:3d:db:4f:1d:8f:6b:b1:74:ca:0bCertificate

Extended Key Usages

Key Usages

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8Certificate

Extended Key Usages

Key Usages

1c:59:b3:72:8a:05:8e:08:eb:5b:aa:c5:fa:d8:ef:89:5f:ee:03:b2:d4:0c:26:4a:aa:e8:21:58:54:77:f1:b1Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

user32

Sections

.text Size: 110KB - Virtual size: 110KB

.data Size: 512B - Virtual size: 320B

.rdata Size: 9KB - Virtual size: 9KB

.pdata Size: 3KB - Virtual size: 3KB

.xdata Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 72KB

.idata Size: 3KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.reloc Size: 512B - Virtual size: 164B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

49:dd:0b:d0:bd:54:3d:db:4f:1d:8f:6b:b1:74:ca:0b
Certificate

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8
Certificate

1c:59:b3:72:8a:05:8e:08:eb:5b:aa:c5:fa:d8:ef:89:5f:ee:03:b2:d4:0c:26:4a:aa:e8:21:58:54:77:f1:b1
Signer

.text
Size: 110KB - Virtual size: 110KB

.data
Size: 512B - Virtual size: 320B

.rdata
Size: 9KB - Virtual size: 9KB

.pdata
Size: 3KB - Virtual size: 3KB

.xdata
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 72KB

.idata
Size: 3KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.reloc
Size: 512B - Virtual size: 164B