d2b681ae5c1559947ddb1e0d204e3be56f571a003e9ba9cea2e3d9f93835940b

Sharing

Copy URL Twitter E-mail

General

Target

d2b681ae5c1559947ddb1e0d204e3be56f571a003e9ba9cea2e3d9f93835940b
Size

2.8MB
MD5

00d220adcd47998f591664b07b7c1804
SHA1

8580ac2cca5a6163ec85942ceb378b08c08e0ff0
SHA256

d2b681ae5c1559947ddb1e0d204e3be56f571a003e9ba9cea2e3d9f93835940b
SHA512

4ce4802b62018fc158f475db60e4360711110ae31facac7e4954b3b21774568473d70a463df8022ffef66a42038158f77c17f77aaace1222fd908234b2b80a33
SSDEEP

24576:QjxT+syzJn9HHHHHHvKwsoxuPdR8rdn/T0elMlHvtR4r5gsYgBVi25zgdhgrrEIF:xtD0r8F/T0eEstVi24GJoD

Score

1^/10

Malware Config

Signatures

Files

d2b681ae5c1559947ddb1e0d204e3be56f571a003e9ba9cea2e3d9f93835940b
.exe windows x86

45b217b9c42a7b05be6ab044ebe67595

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:0c:63:9d:13:3c:36:bd:fa:0c:83:a5:7d:0f:bb:bb
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

11/10/2021, 00:00

Not After

10/10/2024, 23:59

Subject

CN=Nurgo Software,O=Nurgo Software,ST=Normandie,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9a:01:82:6d:99:59:bc:6d:76:72:19:30:49:80:04:1a:b8:64:8a:de:35:ec:64:90:9e:62:14:ee:f5:4e:89:a9
Signer

Actual PE Digest

9a:01:82:6d:99:59:bc:6d:76:72:19:30:49:80:04:1a:b8:64:8a:de:35:ec:64:90:9e:62:14:ee:f5:4e:89:a9

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imagehlp

MapFileAndCheckSumW

kernel32

CompareStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GlobalFlags
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesExW
SystemTimeToTzSpecificLocalTime
SetErrorMode
GetUserDefaultLCID
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SizeofResource
LockResource
OutputDebugStringW
LCMapStringW
GetStringTypeW
GetCPInfo
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetCommandLineA
HeapQueryInformation
GetStdHandle
GetFileType
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetUserDefaultUILanguage
FindResourceExW
GetCurrentProcess
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetVolumeInformationW
FlushFileBuffers
DeleteFileW
lstrcmpA
GetVersionExW
GetCurrentThread
GetCurrentProcessId
FormatMessageW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
FreeLibrary
GetSystemDirectoryW
EncodePointer
LoadLibraryA
VirtualProtect
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
SetLastError
OutputDebugStringA
GetACP
WideCharToMultiByte
WritePrivateProfileStructW
WritePrivateProfileStringW
GetPrivateProfileStructW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetFileAttributesW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateFileW
VirtualQuery
ReleaseMutex
CreateMutexW
FindNextFileW
FindFirstFileW
FindClose
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
LoadResource
HeapFree
ResetEvent
SetEvent
WaitForSingleObject
FreeResource
GlobalAlloc
ResumeThread
GlobalFree
MulDiv
GlobalUnlock
GlobalLock
CreateEventW
MultiByteToWideChar
GetCommandLineW
GetCurrentThreadId
ExitProcess
GetFullPathNameW
GetModuleFileNameW
GetTickCount
CloseHandle
UnmapViewOfFile
MapViewOfFile
LocalFree
FormatMessageA
OpenFileMappingW
GetLastError
FindResourceW
WriteConsoleW

user32

CheckMenuItem
IsDialogMessageW
SetWindowTextW
GetMonitorInfoW
MonitorFromWindow
WinHelpW
LoadIconW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetLastActivePopup
GetTopWindow
GetClassNameW
PtInRect
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
GetScrollPos
ValidateRect
EndPaint
BeginPaint
SetMenuItemBitmaps
GetForegroundWindow
UpdateWindow
GetMenuItemCount
GetMenuItemID
SetMenu
GetMenu
GetKeyState
GetDlgCtrlID
IsIconic
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DrawTextW
DestroyWindow
IsChild
IsMenu
IsWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
GetSubMenu
MapDialogRect
GetWindow
GetWindowLongW
GetWindowRect
RemovePropW
GetPropW
SetPropW
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
CreateDialogIndirectParamW
EndDialog
SetActiveWindow
IsWindowEnabled
GetNextDlgTabItem
GetDesktopWindow
SetForegroundWindow
GetCapture
GetAsyncKeyState
GetActiveWindow
SetFocus
GetDlgItem
SetWindowPos
ShowWindow
GetParent
SetRectEmpty
SendDlgItemMessageA
SetCursor
MessageBeep
SetWindowLongW
DestroyCursor
LoadCursorW
UnregisterClassW
LoadImageW
DestroyIcon
CopyRect
FillRect
ReleaseDC
GetDC
SetRect
GetSystemMetrics
GetClassLongW
SetClassLongW
MessageBoxW
KillTimer
SetTimer
InvalidateRect
OffsetRect
DrawFocusRect
DrawTextExW
GrayStringW
TabbedTextOutW
ClientToScreen
GetWindowThreadProcessId
PostQuitMessage
GetMessageW
TranslateMessage
GetCursorPos
WindowFromPoint
CharUpperW
DestroyMenu
RealChildWindowFromPoint
GetSysColorBrush
GetFocus
DrawFrameControl
InflateRect
GetSysColor
GetClientRect
PostMessageW
RedrawWindow
SendMessageW
EnableWindow
RegisterWindowMessageW
EnableMenuItem

gdi32

ExcludeClipRect
GetClipBox
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SetBkMode
SetMapMode
Escape
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
EnumFontFamiliesExW
CreatePen
CreateBitmap
SetTextColor
SetBkColor
GetStockObject
CreateFontIndirectW
GetObjectW
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
DeleteObject
SetPixel
DeleteDC
SelectObject
GetDeviceCaps
CreateSolidBrush

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegSetValueExW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegEnumKeyW
RegCreateKeyExW
RegEnumValueW
RegQueryValueW

shell32

ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathFileExistsW

ole32

CoTaskMemFree
CreateStreamOnHGlobal
CoUninitialize
CoCreateGuid
CoCreateInstance
CoInitialize

oleaut32

SysAllocString
VariantChangeType
VariantClear
VariantInit
SysFreeString
OleLoadPicture

wintrust

WinVerifyTrust

crypt32

CryptQueryObject
CryptMsgGetParam
CertGetNameStringW
CertCloseStore
CryptMsgClose
CertFreeCertificateContext
CertFindCertificateInStore

oleacc

CreateStdAccessibleObject
LresultFromObject

Sections

.text
Size: 533KB - Virtual size: 533KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

45b217b9c42a7b05be6ab044ebe67595

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

90:0c:63:9d:13:3c:36:bd:fa:0c:83:a5:7d:0f:bb:bbCertificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

9a:01:82:6d:99:59:bc:6d:76:72:19:30:49:80:04:1a:b8:64:8a:de:35:ec:64:90:9e:62:14:ee:f5:4e:89:a9Signer

Headers

DLL Characteristics

File Characteristics

Imports

imagehlp

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

wintrust

crypt32

oleacc

Sections

.text Size: 533KB - Virtual size: 533KB

.rdata Size: 166KB - Virtual size: 166KB

.data Size: 10KB - Virtual size: 29KB

.gfids Size: 8KB - Virtual size: 8KB

.giats Size: 512B - Virtual size: 4B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 49KB - Virtual size: 49KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

90:0c:63:9d:13:3c:36:bd:fa:0c:83:a5:7d:0f:bb:bb
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

9a:01:82:6d:99:59:bc:6d:76:72:19:30:49:80:04:1a:b8:64:8a:de:35:ec:64:90:9e:62:14:ee:f5:4e:89:a9
Signer

.text
Size: 533KB - Virtual size: 533KB

.rdata
Size: 166KB - Virtual size: 166KB

.data
Size: 10KB - Virtual size: 29KB

.gfids
Size: 8KB - Virtual size: 8KB

.giats
Size: 512B - Virtual size: 4B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 49KB - Virtual size: 49KB