c739f062673565c6e7c1a62926f449cdd8e09175bfdf32b2522332c332966e8b

Sharing

Copy URL Twitter E-mail

General

Target

c739f062673565c6e7c1a62926f449cdd8e09175bfdf32b2522332c332966e8b
Size

12.8MB
MD5

14001238e69b7705a4610734d0c6110b
SHA1

2e1335de6f93c1224eac55f0e20c980a9a8f4657
SHA256

c739f062673565c6e7c1a62926f449cdd8e09175bfdf32b2522332c332966e8b
SHA512

7472dbf38ea725d008d3829025dd9a06ed07bdfb61d17fc8769fb4c6eb9a195ce4520a3103d5d490316b16041c7f2217b8dedfcf27954ea80d34a5043a02003c
SSDEEP

196608:VglQtXx+CYPEyRFQitvTkxVzmmlCgZ8J3B5viCgo+tsjhKCpvf1pA:VaQWFPpRjvTmHlB2J3B5viWosj/pA

Score

1^/10

Malware Config

Signatures

Files

c739f062673565c6e7c1a62926f449cdd8e09175bfdf32b2522332c332966e8b
.exe windows x86

e12701c3e38856c5bbd3eb0cbc732592

Code Sign

2b:0d:a0:84:22:88:18:90:45:cd:d5:49:9a:0a:1f:a4
Certificate

Issuer

CN=叙利亚云工具箱,ST=Fujian,C=Chian,1.2.840.113549.1.9.1=#0c11323835373233373231364071712e636f6d

Not Before

02/09/2023, 17:03

Not After

31/12/2039, 23:59

Subject

CN=叙利亚云工具箱,ST=Fujian,C=Chian,1.2.840.113549.1.9.1=#0c11323835373233373231364071712e636f6d

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

28/07/2022, 08:56

Not After

27/07/2033, 08:56

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bb:27:3c:c5:64:ed:3a:88:86:8a:df:3d:d9:45:3d:0e:ae:c3:cf:ab
Signer

Actual PE Digest

bb:27:3c:c5:64:ed:3a:88:86:8a:df:3d:d9:45:3d:0e:ae:c3:cf:ab

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

rasapi32

RasHangUpA

winmm

midiStreamRestart

ws2_32

WSAStartup

kernel32

GetVersion
GetVersionExA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetPropA

gdi32

RectVisible

winspool.drv

OpenPrinterA

advapi32

RegQueryValueA

shell32

Shell_NotifyIconA

ole32

CLSIDFromString

oleaut32

UnRegisterTypeLi

comctl32

ord17

wininet

InternetCanonicalizeUrlA

comdlg32

ChooseColorA

Sections

.text
Size: - Virtual size: 916KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 19.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 379KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.L]Y
Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.a3q
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Qgw
Size: 12.7MB - Virtual size: 12.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e12701c3e38856c5bbd3eb0cbc732592

Code Sign

2b:0d:a0:84:22:88:18:90:45:cd:d5:49:9a:0a:1f:a4Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

bb:27:3c:c5:64:ed:3a:88:86:8a:df:3d:d9:45:3d:0e:ae:c3:cf:abSigner

Headers

File Characteristics

Imports

rasapi32

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wininet

comdlg32

Sections

.text Size: - Virtual size: 916KB

.rdata Size: - Virtual size: 19.2MB

.data Size: - Virtual size: 379KB

.L]Y Size: - Virtual size: 3.1MB

.a3q Size: 4KB - Virtual size: 2KB

.Qgw Size: 12.7MB - Virtual size: 12.7MB

.rsrc Size: 52KB - Virtual size: 48KB

2b:0d:a0:84:22:88:18:90:45:cd:d5:49:9a:0a:1f:a4
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

bb:27:3c:c5:64:ed:3a:88:86:8a:df:3d:d9:45:3d:0e:ae:c3:cf:ab
Signer

.text
Size: - Virtual size: 916KB

.rdata
Size: - Virtual size: 19.2MB

.data
Size: - Virtual size: 379KB

.L]Y
Size: - Virtual size: 3.1MB

.a3q
Size: 4KB - Virtual size: 2KB

.Qgw
Size: 12.7MB - Virtual size: 12.7MB

.rsrc
Size: 52KB - Virtual size: 48KB