Lingo64_20[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Lingo64_20.exe
Size

5.3MB
MD5

d22a64531eb875b28d11c044a70638e5
SHA1

28a044320f7a74d7ae2c187da7f56d1664a7071d
SHA256

a011351523fc0a6ebe34d6c07d043fb1a478a1f7ecb1cea3cc6a2dcf0bbb4744
SHA512

a63d538ec7f311ce9d9eba895b77b029009652ff5ed7e40689d09a40cd8c016582ef6f5f2d4545b333ea41fd0e2d3e71f1989249c4cf08f1821660f977075787
SSDEEP

24576:JiFEecp59D2DQQxYQ23wcz8UUs1m/gfL+inZI9:o+ecnxWchL+b9

Score

1^/10

Malware Config

Signatures

Files

Lingo64_20.exe
.exe windows x64

017fc7829725d4d982b062f7c9ead33d

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

08:98:b0:58:a2:66:56:75:9f:a5:28:09:dc:d8:a6:d2
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/08/2023, 00:00

Not After

26/08/2024, 23:59

Subject

SERIALNUMBER=53352499,CN=LINDO Systems\, Inc.,OU=LINDO Systems Inc,O=LINDO Systems\, Inc.,L=Chicago,ST=Illinois,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1308496c6c696e6f6973,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

78:c3:b1:76:85:d8:ec:a8:86:8a:3f:c0:20:03:4a:31:27:fe:9a:a4
Signer

Actual PE Digest

78:c3:b1:76:85:d8:ec:a8:86:8a:3f:c0:20:03:4a:31:27:fe:9a:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mfc140

ord11810
ord1762
ord11437
ord5725
ord11442
ord3706
ord7222
ord8828
ord11275
ord11184
ord2149
ord12049
ord9898
ord5730
ord7817
ord12179
ord3996
ord9942
ord8727
ord9977
ord10918
ord9124
ord9056
ord11133
ord9944
ord8553
ord8571
ord9054
ord10009
ord10166
ord11058
ord10844
ord11445
ord11126
ord12772
ord12411
ord4709
ord4609
ord2704
ord9037
ord5619
ord12043
ord14200
ord2858
ord5550
ord7104
ord931
ord1399
ord5016
ord2968
ord1757
ord13091
ord9059
ord2636
ord8742
ord6483
ord365
ord11668
ord1057
ord3571
ord4938
ord12391
ord6230
ord3051
ord4069
ord1051
ord8779
ord1426
ord3588
ord6321
ord3091
ord6749
ord4074
ord8404
ord2902
ord3740
ord14113
ord2687
ord1155
ord8784
ord6237
ord3053
ord4072
ord8403
ord2901
ord3738
ord1055
ord8781
ord489
ord1119
ord3944
ord6069
ord2342
ord7041
ord4903
ord4503
ord13961
ord13955
ord8025
ord963
ord1980
ord12241
ord10656
ord8692
ord7199
ord6845
ord14070
ord11109
ord9790
ord10239
ord10144
ord9789
ord9912
ord11375
ord10175
ord8670
ord8773
ord8944
ord10636
ord5547
ord3670
ord7896
ord1628
ord13963
ord12873
ord8374
ord488
ord6681
ord1118
ord4711
ord6292
ord13689
ord5653
ord13732
ord6023
ord5668
ord3679
ord3579
ord4334
ord10030
ord1761
ord4232
ord3871
ord5724
ord11440
ord11732
ord10024
ord12902
ord4230
ord970
ord8137
ord1434
ord13351
ord7060
ord844
ord9008
ord12420
ord8066
ord12109
ord11842
ord11065
ord1353
ord2545
ord3799
ord5529
ord10873
ord8990
ord8927
ord7322
ord854
ord1361
ord841
ord12155
ord1350
ord482
ord5310
ord12410
ord4937
ord12189
ord1506
ord12510
ord8128
ord6288
ord5312
ord11594
ord5657
ord11981
ord2796
ord812
ord12370
ord1976
ord1331
ord2218
ord5539
ord6053
ord11849
ord11881
ord11869
ord5687
ord3723
ord6590
ord981
ord8123
ord4298
ord13469
ord12165
ord6101
ord14208
ord6102
ord14209
ord6100
ord14207
ord7688
ord12160
ord14007
ord1838
ord11614
ord11615
ord2004
ord11659
ord7637
ord12571
ord3941
ord4002
ord9049
ord14133
ord7619
ord14135
ord12170
ord12171
ord2437
ord9792
ord9799
ord5167
ord7989
ord4436
ord12490
ord12552
ord10079
ord11877
ord8050
ord1446
ord7363
ord8131
ord13007
ord13510
ord804
ord5986
ord3959
ord12161
ord1358
ord865
ord2926
ord2267
ord869
ord2686
ord2173
ord13501
ord2338
ord306
ord1505
ord13906
ord2395
ord486
ord13255
ord1678
ord345
ord1045
ord11978
ord4628
ord2790
ord4463
ord2269
ord2285
ord4209
ord2512
ord4348
ord7159
ord11432
ord872
ord2364
ord5953
ord1874
ord12315
ord3989
ord10078
ord8083
ord10366
ord8875
ord11424
ord9664
ord11463
ord9804
ord3046
ord9904
ord10621
ord10669
ord5074
ord12413
ord12163
ord11167
ord12636
ord5297
ord8524
ord11420
ord8840
ord11048
ord9783
ord5246
ord5538
ord11130
ord9055
ord9058
ord9139
ord11127
ord11054
ord10834
ord9159
ord3302
ord3793
ord10886
ord1362
ord10912
ord8853
ord5917
ord9984
ord2661
ord5181
ord5174
ord5375
ord10623
ord10670
ord10913
ord7326
ord7190
ord1418
ord932
ord7106
ord7465
ord13399
ord13623
ord6095
ord3732
ord6679
ord11725
ord14068
ord7923
ord13304
ord5526
ord12780
ord2344
ord8418
ord1107
ord886
ord5723
ord13683
ord7510
ord11033
ord11544
ord9177
ord1063
ord2263
ord6239
ord5731
ord497
ord3945
ord3721
ord8506
ord843
ord3951
ord3306
ord1352
ord6624
ord6630
ord6641
ord13047
ord13504
ord8026
ord8028
ord7107
ord933
ord7751
ord7969
ord10151
ord9906
ord10868
ord10866
ord11297
ord10800
ord14141
ord8575
ord10744
ord5084
ord5023
ord11927
ord12781
ord3733
ord10758
ord11750
ord8663
ord10787
ord9695
ord9654
ord9677
ord10203
ord7341
ord5565
ord14139
ord357
ord5031
ord4713
ord10764
ord10788
ord375
ord10679
ord5610
ord5623
ord6881
ord6323
ord4076
ord8786
ord11735
ord7221
ord5753
ord2701
ord3578
ord4326
ord6562
ord3155
ord3262
ord2348
ord8922
ord8954
ord10154
ord10156
ord1127
ord6893
ord549
ord8397
ord3178
ord7508
ord11738
ord8063
ord9004
ord11812
ord11444
ord8869
ord11438
ord3717
ord4863
ord13291
ord13289
ord3803
ord8892
ord7225
ord2217
ord13216
ord5597
ord5613
ord13379
ord13373
ord6533
ord3138
ord3258
ord1381
ord13680
ord3590
ord3587
ord7092
ord902
ord13300
ord8630
ord10876
ord10663
ord8695
ord10974
ord10214
ord10811
ord11571
ord11574
ord11572
ord11573
ord6062
ord1384
ord10642
ord11846
ord7337
ord2905
ord12652
ord7093
ord910
ord912
ord3139
ord6008
ord4864
ord12845
ord12846
ord1899
ord4336
ord10143

kernel32

LockResource
SizeofResource
FindResourceW
DecodePointer
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
HeapSize
LoadLibraryExA
GetSystemInfo
VirtualProtect
VirtualQuery
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
SleepEx
GetModuleHandleW
OutputDebugStringA
lstrcpynA
MulDiv
OpenFile
GetSystemTimeAsFileTime
CloseHandle
WriteFile
FlushFileBuffers
CompareFileTime
SetLastError
InitializeCriticalSectionAndSpinCount
LoadResource
SetDllDirectoryA
lstrlenA
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
GetVersionExA
SetCurrentDirectoryA
FormatMessageA
LocalFree
GetLastError
Beep
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
ExpandEnvironmentStringsA
OutputDebugStringW
GetProcessHeap
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
FindResourceExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead

user32

CreateCursor
LoadCursorA
GetParent
MapWindowPoints
ScreenToClient
SetCursor
InvalidateRect
ReleaseDC
GetDC
UpdateWindow
EnableWindow
KillTimer
SetTimer
ReleaseCapture
SetCapture
IsWindowVisible
SendMessageA
TrackMouseEvent
PeekMessageA
CheckMenuItem
EnableMenuItem
LockWindowUpdate
PostMessageA
OffsetRect
DestroyCursor
GetSysColor
DrawFocusRect
FillRect
GetMenuState
GetMenuItemCount
RemoveMenu
FindWindowA
BringWindowToTop
IsWindow
PrintWindow
SetScrollPos
SetScrollRange
ShowScrollBar
ClientToScreen
ClipCursor
InvertRect
SetRect
PtInRect
LoadBitmapW
DestroyIcon
UnregisterClassA
LoadIconA
PostQuitMessage
SetDlgItemTextA
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
LoadMenuW
GetSubMenu
GetClientRect
GetWindowRect
MessageBoxA
GetWindow
GetFocus
wsprintfA
GetDlgItemTextA
CopyRect
SendDlgItemMessageA
GetScrollPos

gdi32

CreateCompatibleBitmap
CreateFontA
GetPixel
GetTextExtentPoint32A
SelectObject
SetPixel
StretchBlt
GetTextMetricsA
GetTextColor
GetDeviceCaps
GetStockObject
CreateFontIndirectA
LPtoDP
StretchDIBits
CreatePen
GetObjectA
CreateDIBSection
DeleteObject
CreateSolidBrush
Rectangle
BitBlt
CreateCompatibleDC

msimg32

AlphaBlend

advapi32

RegSetValueA
RegCreateKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey

shell32

DragAcceptFiles

comctl32

ImageList_DrawEx
ImageList_GetIconSize
ImageList_GetIcon
ImageList_Draw

shlwapi

PathRemoveFileSpecA

oleaut32

VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetDim
SysFreeString

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140

memcpy
__current_exception_context
_purecall
__std_terminate
memchr
memcmp
memmove
__std_exception_copy
__std_exception_destroy
_CxxThrowException
strchr
strrchr
memset
__C_specific_handler
__current_exception
__std_type_info_destroy_list

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strcat_s
strcpy
_strnset
strcpy_s
isalnum
strncpy
strcmp
strcat
strlen
toupper

api-ms-win-crt-utility-l1-1-0

labs
abs

api-ms-win-crt-time-l1-1-0

_time64
_localtime64_s

api-ms-win-crt-math-l1-1-0

atan
__setusermatherr
pow
sqrt
fabs

api-ms-win-crt-heap-l1-1-0

realloc
_set_new_mode
_recalloc
malloc
free

api-ms-win-crt-runtime-l1-1-0

exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_exit
_set_app_type
_seh_filter_exe
terminate
_cexit
_crt_at_quick_exit
_crt_atexit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_errno
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_c_exit
_execute_onexit_table

api-ms-win-crt-convert-l1-1-0

_itoa
strtod
strtol

api-ms-win-crt-filesystem-l1-1-0

_splitpath
_stat64i32
remove

api-ms-win-crt-stdio-l1-1-0

fgetc
__stdio_common_vfprintf
__stdio_common_vsprintf
_set_fmode
__p__commode
fclose
fopen
_getcwd

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcpy

api-ms-win-crt-locale-l1-1-0

_setmbcp
_configthreadlocale

Exports

Exports

CHART2CREATE
CHART2DELETE
CHART2GANTTTASKS
CHART2HISTOBINS
CHART2LABELS
CHART2LEGENDS
CHART2LOADDATA
CHART2LOADGROUPDATA
CHART2LOADOBJECTDATA
CHART2SHOW
CHART2STACKEDBARDIR
CHART2TITLE
CHART2TORNADOBASE
CHART2TYPE
CHART2XAXISTITLE
CHART2YAXISLABELS
CHART2YAXISTITLE
CHART2ZAXISTITLE
CHARTAXISLABELS
CHARTCREATE
CHARTDELETE
CHARTDISPLAY
CHARTHEADER
CHARTHISTOBINS
CHARTLEGEND
CHARTTEMPLATESTRING
CHARTTYPE
CLRSOLVETIME
CLRSTAT
CLRSTS
DISPLAYSTATUSBAR
DSPLIC
EBOX
EVENTLOOP
FGETFILENAME2
GETFIRSTLIC
GETGENERATESTATUS
GETPTRVALS
GETRSPC
GETRTIC
GETSTARTUPDIR
GETYESORNO
GOTOLF
IN2WND
LOADW
LSBPOST
LSBREMV
LSBUPDT
MARKASLINDOMODEL
MORE
NEWOUTLINESREADY
NULLNAME
NWATSUPC
PAWS
PRINTB
PUTPTRVALS
QV
READCL
RECORD
RECVAR
REQUESTFULLD
RLSVAR
SELECTMULTIMIPSOLUTION
SETFEINTFLAG
SETINTBUTTON
SETLINGOSTABILITYFLAG
SETPANE0LOCK
SETPANE0LOCK2
SETPANE0UNLOCK
SHOWSTATUSWINDOW
SHOWUSERINFOFILELOCATION
SIGBOXF
STATUPD
STSMEM
TEXTOUTF
TIMETOUPDATE
UPDATESOLVEBUTTONS
UPDTST
USERINTERRUPT
WARN
WATSUPC
WATSUPGEN
WINDOZ

Sections

.text
Size: 737KB - Virtual size: 737KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 283KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

017fc7829725d4d982b062f7c9ead33d

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

08:98:b0:58:a2:66:56:75:9f:a5:28:09:dc:d8:a6:d2Certificate

Extended Key Usages

Key Usages

78:c3:b1:76:85:d8:ec:a8:86:8a:3f:c0:20:03:4a:31:27:fe:9a:a4Signer

Headers

DLL Characteristics

File Characteristics

Imports

mfc140

kernel32

user32

gdi32

msimg32

advapi32

shell32

comctl32

shlwapi

oleaut32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 737KB - Virtual size: 737KB

.rdata Size: 283KB - Virtual size: 283KB

.data Size: 9KB - Virtual size: 41KB

.pdata Size: 63KB - Virtual size: 63KB

.rsrc Size: 4.2MB - Virtual size: 4.2MB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

08:98:b0:58:a2:66:56:75:9f:a5:28:09:dc:d8:a6:d2
Certificate

78:c3:b1:76:85:d8:ec:a8:86:8a:3f:c0:20:03:4a:31:27:fe:9a:a4
Signer

.text
Size: 737KB - Virtual size: 737KB

.rdata
Size: 283KB - Virtual size: 283KB

.data
Size: 9KB - Virtual size: 41KB

.pdata
Size: 63KB - Virtual size: 63KB

.rsrc
Size: 4.2MB - Virtual size: 4.2MB