doctor's opinion[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

doctor's opinion.exe
Size

600.4MB
MD5

9987a7de34f41441c1b9ba8d8f71ff3f
SHA1

6f75a71ce957c882777fb11ab6d428af4d109e10
SHA256

9dc5bf48505557f0b13b334ec11aec014bb4e277e2fb50a69974593f07f714b4
SHA512

2c01cf9749517c606d86667bbdc8b491608bc196db7faf520a57de03dde27db729d5f7277cce1094e441ae38f8948d7bd20d555027d8feda6a0938b7be17fd7e
SSDEEP

6144:xNFQq2kz4O+H3EJ/ybAvn36eK6IQjLoIxTot+BAY8h5VF2XP64QVfYywDOh0O3:xNm44O+H0F0AZ2QQIZ1An3VFOqVqOZ

Score

1^/10

Malware Config

Signatures

Files

doctor's opinion.exe
.exe windows x86

a01249a11ad56cc27bb7173ed6438e32

Code Sign

59:27:c4:97:18:e3:19:c8:4a:72:53:f7:de:b1:a4:20
Certificate

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

21/03/2023, 20:47

Not After

20/03/2024, 20:47

Subject

SERIALNUMBER=1518980,CN=GS2 SOFTWARE\, LLC,O=GS2 SOFTWARE\, LLC,L=Cincinnati,ST=Ohio,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

26/03/2019, 17:44

Not After

22/03/2034, 17:44

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09/12/2022, 18:30

Not After

06/12/2032, 18:30

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

11/09/2018, 09:26

Not After

11/09/2023, 09:26

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

13/11/2019, 18:50

Not After

12/11/2034, 18:50

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:fe:08:65:cd:89:14:b2:39:48:6c:25:86:2f:c5:27:c0:3a:bd:1a:dd:3e:88:5c:f9:95:02:47:70:fe:06:a4
Signer

Actual PE Digest

11:fe:08:65:cd:89:14:b2:39:48:6c:25:86:2f:c5:27:c0:3a:bd:1a:dd:3e:88:5c:f9:95:02:47:70:fe:06:a4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVolumeNameForVolumeMountPointA
GetCommandLineW
GetComputerNameA
GetFileSize
SetDefaultCommConfigA
GetDriveTypeW
GetConsoleAliasExesLengthA
BuildCommDCBAndTimeoutsA
UpdateResourceA
InterlockedIncrement
MoveFileExW
GetConsoleAliasA
InterlockedDecrement
WaitNamedPipeA
GetCurrentProcess
SetConsoleActiveScreenBuffer
GetProfileStringW
GetUserDefaultLCID
SetComputerNameW
FreeEnvironmentStringsA
_lclose
_lcreat
GetModuleHandleW
CreateNamedPipeW
GetConsoleAliasesLengthA
GetNumberFormatA
GetWindowsDirectoryA
GetConsoleAliasExesW
EnumTimeFormatsW
GlobalAlloc
GetPrivateProfileIntA
SetFileShortNameW
LoadLibraryW
TerminateThread
ReadConsoleInputA
_hread
GetPrivateProfileStructW
GetCalendarInfoW
SetConsoleCP
DeleteVolumeMountPointW
GetFileAttributesA
TransactNamedPipe
GetTimeFormatW
GetCompressedFileSizeA
GetStartupInfoW
CreateMailslotW
GetNamedPipeHandleStateW
EnumSystemLocalesA
SetCurrentDirectoryA
GetLastError
IsDBCSLeadByteEx
SetLastError
GetProcAddress
BackupWrite
MoveFileW
GlobalFree
LoadLibraryA
OpenWaitableTimerW
LocalAlloc
SetConsoleCtrlHandler
GlobalGetAtomNameW
FindNextChangeNotification
CreateIoCompletionPort
_lread
GetModuleHandleA
OpenFileMappingW
FreeEnvironmentStringsW
FindNextFileW
VirtualProtect
GetCurrentDirectoryA
EnumDateFormatsW
GetConsoleCursorInfo
FatalAppExitA
OpenSemaphoreW
FindFirstVolumeA
TerminateJobObject
LocalSize
DeleteFileW
ReadConsoleOutputCharacterW
DeleteFileA
CloseHandle
ReadFile
WriteConsoleW
LCMapStringW
HeapReAlloc
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
HeapFree
HeapAlloc
ExitProcess
GetCommandLineA
HeapSetInformation
RtlUnwind
HeapCreate
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
WriteFile
GetModuleFileNameW
SetFilePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
RaiseException
GetModuleFileNameA
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
MultiByteToWideChar
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
CreateFileW

user32

CharUpperA
CharUpperBuffA

winhttp

WinHttpCloseHandle

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 263KB - Virtual size: 30.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a01249a11ad56cc27bb7173ed6438e32

Code Sign

59:27:c4:97:18:e3:19:c8:4a:72:53:f7:de:b1:a4:20Certificate

Extended Key Usages

Key Usages

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04Certificate

Extended Key Usages

Key Usages

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4bCertificate

Extended Key Usages

Key Usages

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1cCertificate

Key Usages

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56Certificate

Extended Key Usages

Key Usages

11:fe:08:65:cd:89:14:b2:39:48:6c:25:86:2f:c5:27:c0:3a:bd:1a:dd:3e:88:5c:f9:95:02:47:70:fe:06:a4Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

winhttp

Sections

.text Size: 155KB - Virtual size: 155KB

.data Size: 263KB - Virtual size: 30.9MB

.rsrc Size: 24KB - Virtual size: 23KB

59:27:c4:97:18:e3:19:c8:4a:72:53:f7:de:b1:a4:20
Certificate

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

11:fe:08:65:cd:89:14:b2:39:48:6c:25:86:2f:c5:27:c0:3a:bd:1a:dd:3e:88:5c:f9:95:02:47:70:fe:06:a4
Signer

.text
Size: 155KB - Virtual size: 155KB

.data
Size: 263KB - Virtual size: 30.9MB

.rsrc
Size: 24KB - Virtual size: 23KB