CiscoJabber[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

CiscoJabber.exe
Size

204KB
MD5

4efa47b832e8b93459cf6bbc1238eb41
SHA1

2fc256942190936451ba5e4e0083b215500255cc
SHA256

d424de1ea0a715bf7e821bf3a400863d6700dec89fbb2f99340a5d5ca3569e0b
SHA512

b3832e1bf2c3f51d8e6b9f4027db42017fa370911f28598af82cfed9a25c0eea8fcc6d0a780d5007121a9e989c60a34b861d82d48044d8da0c53aab79a302b0d
SSDEEP

3072:9LsqSS5Ffj5MotgxQchSxspa+dPlAoeatyxjYxxvsqVgkEpGzRTjJH:9ot4XRbX+vAoeaIji+FqjJH

Score

1^/10

Malware Config

Signatures

Files

CiscoJabber.exe
.exe windows x86

4c4ccf3baa3f3af2f818fdfad8c6e694

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:0b:c1:98:06:de:00:cb:d0:e1:9b:df:fc:d2:37:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

05/03/2021, 00:00

Not After

03/04/2022, 23:59

Subject

CN=Cisco Systems\, Inc.,O=Cisco Systems\, Inc.,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

a2:bd:cc:d4:a9:3c:d8:25:cc:c3:6e:9d:e3:cb:2a:50:63:2b:0f:e7
Signer

Actual PE Digest

a2:bd:cc:d4:a9:3c:d8:25:cc:c3:6e:9d:e3:cb:2a:50:63:2b:0f:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ceb

cebPreTranslateMessage

cefwrapper

?SetDpiAwareness@Cef@CefWrapper@@SAXXZ
?unInitial@Cef@CefWrapper@@SAXXZ
?initialChildProcess@Cef@CefWrapper@@SAHPAUHINSTANCE__@@@Z
?initialMainProcess@Cef@CefWrapper@@SAHPAUHINSTANCE__@@@Z
?isMainProcess@Cef@CefWrapper@@SA_NXZ

servicesframework

?getInstance@ServiceFactory@CSFUnified@@SA?AV?$shared_ptr@VServiceFactory@CSFUnified@@@std@@XZ

csflogger

?CSFLog@@YAXPAUCSFLogger@@W4CSFLogLevel@@PBDH2ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?CSFLog@@YAXPAUCSFLogger@@W4CSFLogLevel@@PBDH2ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
CSFLogger_getLogger

kernel32

GlobalUnlock
lstrcmpW
MulDiv
LoadLibraryExW
IsDebuggerPresent
lstrcmpiW
IsProcessorFeaturePresent
FreeLibrary
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetProcessHeap
HeapFree
HeapAlloc
EncodePointer
GetModuleHandleW
GetCurrentProcessId
DeleteCriticalSection
GlobalLock
GetProcAddress
SetCurrentDirectoryW
DecodePointer
FindResourceW
LoadResource
LoadLibraryW
RaiseException
CloseHandle
GlobalAlloc
OutputDebugStringW
GetLastError
MultiByteToWideChar
GetCurrentThreadId
WaitForSingleObject
InitializeCriticalSectionEx
CreateMutexW
LeaveCriticalSection
SetProcessShutdownParameters
GetModuleFileNameW
EnterCriticalSection
SetLastError
SizeofResource
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
LoadLibraryExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetStartupInfoW
QueryPerformanceCounter
FlushInstructionCache

user32

SystemParametersInfoW
ShowWindow
GetDesktopWindow
GetWindowTextW
EndPaint
BeginPaint
ReleaseDC
InvalidateRect
SetForegroundWindow
ReleaseCapture
RegisterWindowMessageW
GetParent
GetClassInfoExW
GetDlgItem
GetClientRect
SetWindowLongW
GetWindowLongW
GetWindowThreadProcessId
GetWindowTextLengthW
GetMessageW
DefWindowProcW
CallWindowProcW
GetWindow
GetFocus
DestroyWindow
GetDC
SetWindowPos
FillRect
CreateWindowExW
ScreenToClient
SendMessageW
UnregisterClassW
SetWindowTextW
RegisterClassExW
SetCapture
IsWindow
InvalidateRgn
DispatchMessageW
RedrawWindow
ClientToScreen
DestroyAcceleratorTable
PeekMessageW
IsChild
AttachThreadInput
GetSysColor
GetForegroundWindow
MoveWindow
CreateAcceleratorTableW
SetFocus
CharNextW
TranslateMessage
FindWindowW
LoadCursorW
GetClassNameW

gdi32

CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject
BitBlt
CreateSolidBrush

advapi32

RegCreateKeyExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW

ole32

CoInitializeSecurity
OleInitialize
CreateStreamOnHGlobal
CoTaskMemFree
OleLockRunning
CoCreateInstance
CoTaskMemAlloc
CLSIDFromString
CoTaskMemRealloc
OleUninitialize
CoGetClassObject
CLSIDFromProgID
StringFromGUID2

oleaut32

VarUI4FromStr
SysAllocStringLen
SysFreeString
SysStringLen
LoadRegTypeLi
VariantInit
LoadTypeLi
SysAllocString
OleCreateFontIndirect
VariantClear

jabberutils

?dispatchForExecution@WindowsMessageQueueHelper@jabberutils@@SAXV?$function@$$A6AXXZ@std@@@Z
?initialize@WindowsMessageQueueHelper@jabberutils@@SAXW4MessageQueueOperationMode@12@@Z
?convertLegacyLocalFileStore@LegacyLocalFileStoreConverter@jabberutils@@SA_NXZ
?toLowercase@jabberutils@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV23@@Z
?enableAllExceptions@ExceptionHandlingHelper@jabberutils@@SAXXZ
?decimalToHexString@jabberutils@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@K@Z
?getValueFromCmdline@CommandLineHelper@jabberutils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@0@Z
?submitCommandLine@CommandLineHelper@jabberutils@@SAXAAVSecureString@csf@@_N@Z
?setDpiAwareness@SystemUtils@jabberutils@@SAJXZ
?getJabberAppID@SystemUtils@jabberutils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?toString@jabberutils@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z
?getLocationOfExecutable@EnvironmentUtils@jabberutils@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?Init@Logger@jabberutils@@SAXXZ
?toBool@jabberutils@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?GetInstance@CHideWnd@@SAAAV1@XZ
?DestroyWindow@CHideWnd@@QAEXXZ
?Cleanup@FipsUtils@jabberutils@@SAXXZ
?StartCurlAndSSL@FipsUtils@jabberutils@@SA_NXZ
?Initialize@CHideWnd@@QAEXXZ

wclextend

WclPreTranslateMessage

wcldll

?GetCurrentSession@CWclApp@AT@@SAAAV12@XZ

msvcp140

?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
_Strxfrm
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ

comctl32

InitCommonControlsEx

gdiplus

GdiplusStartup
GdiplusShutdown

vcruntime140

memcpy
_except_handler4_common
strchr
__std_terminate
memset
memmove
_CxxThrowException
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
_purecall
wcsstr

api-ms-win-crt-stdio-l1-1-0

fread
feof
ftell
_lseek
fwrite
_fileno
fgets
_write
_close
_setmode
__stdio_common_vfprintf
_sopen_dispatch
fseek
_read
__stdio_common_vswprintf_s
clearerr
fclose
fflush
__acrt_iob_func
_set_fmode
ferror
__p__commode
fopen

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
malloc
realloc
free
_recalloc

api-ms-win-crt-runtime-l1-1-0

exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_exit
_invalid_parameter_noinfo
_set_app_type
system
_c_exit
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_controlfp_s
_seh_filter_exe
_register_thread_local_exe_atexit_callback
terminate

api-ms-win-crt-string-l1-1-0

wcsncpy_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

libcrypto-1_1

EVP_EncryptUpdate
EVP_EncryptFinal_ex
RAND_bytes
EVP_aes_256_cbc
EVP_CIPHER_CTX_free
EVP_CIPHER_CTX_new
EVP_CIPHER_CTX_reset
EVP_EncryptInit_ex

Exports

Exports

OPENSSL_Applink

Sections

.text
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c4ccf3baa3f3af2f818fdfad8c6e694

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0f:0b:c1:98:06:de:00:cb:d0:e1:9b:df:fc:d2:37:25Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

a2:bd:cc:d4:a9:3c:d8:25:cc:c3:6e:9d:e3:cb:2a:50:63:2b:0f:e7Signer

Headers

DLL Characteristics

File Characteristics

Imports

ceb

cefwrapper

servicesframework

csflogger

kernel32

user32

gdi32

advapi32

ole32

oleaut32

jabberutils

wclextend

wcldll

msvcp140

comctl32

gdiplus

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

libcrypto-1_1

Exports

Exports

Sections

.text Size: 97KB - Virtual size: 96KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 6KB - Virtual size: 6KB

.rsrc Size: 48KB - Virtual size: 47KB

.reloc Size: 8KB - Virtual size: 8KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0f:0b:c1:98:06:de:00:cb:d0:e1:9b:df:fc:d2:37:25
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

a2:bd:cc:d4:a9:3c:d8:25:cc:c3:6e:9d:e3:cb:2a:50:63:2b:0f:e7
Signer

.text
Size: 97KB - Virtual size: 96KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 48KB - Virtual size: 47KB

.reloc
Size: 8KB - Virtual size: 8KB