CIS_2024_beta[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CIS_2024_beta.exe
Size

78.1MB
MD5

03e2e29f055bff3f9c2fedce6919c624
SHA1

03c901748001681dbe436231dd40ef630cf0a2d1
SHA256

908564493b32a956a9ee48f9c8ecaf09948c85ea3d446cfc28f2cacb66f99f88
SHA512

64da59118c6275c202fe37536268ecb8456af3a71066c79f9991ab060eaa3fed965ffcd88ce0f639f52903ab9748ccf1f628f465a5a1edf6c814acce956a6676
SSDEEP

1572864:EcEAlWg8N2/kP36+xOxUvlCZa3bBbRzXWsAVahOEjQ5F/1+ZzpmvR9:EpAlWrwOHOxelaaLltmsAIrjy/YHmvR9

Score

1^/10

Malware Config

Signatures

Files

CIS_2024_beta.exe
.exe windows x86

cb2f8861ae9e888fc248b97ed817726f

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:73:4d:11:1b:4b:5c:87:9b:bd:5a:8c:49:ab:2a:90
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

07/12/2021, 00:00

Not After

06/12/2024, 23:59

Subject

SERIALNUMBER=0400751588,CN=Comodo Security Solutions\, Inc,O=Comodo Security Solutions\, Inc,ST=New Jersey,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a4e6577204a6572736579,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

22:77:02:0d:4e:f3:c8:0f:4a:d2:89:5a:ad:29:fe:e6:1e:4f:28:ff:7b:5a:8d:62:eb:2c:e9:80:98:ce:02:1f
Signer

Actual PE Digest

22:77:02:0d:4e:f3:c8:0f:4a:d2:89:5a:ad:29:fe:e6:1e:4f:28:ff:7b:5a:8d:62:eb:2c:e9:80:98:ce:02:1f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

kernel32

SizeofResource
GetStdHandle
WriteFile
FindClose
MulDiv
GetSystemTimeAsFileTime
CompareFileTime
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrlenA
lstrlenW
LoadLibraryA
GetModuleHandleW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
FindResourceExA
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoW
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetSystemDefaultLCID
GetVersion
SetProcessWorkingSetSize
GetCurrentProcess
GetExitCodeProcess
CreateIoCompletionPort
GetQueuedCompletionStatus
ResumeThread
CloseHandle
GetModuleFileNameW
CreateProcessW
GetStartupInfoW
GetCommandLineW
SetEnvironmentVariableW
GetDriveTypeW
GetSystemDirectoryA
GetTempPathW
SetCurrentDirectoryW
CreateFileW
GetVersionExW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
InitializeCriticalSection
SetEvent
ResetEvent
CreateEventW
LocalFree
GetCurrentThreadId
TerminateThread
SuspendThread
FormatMessageW
lstrcpyW
GetSystemDirectoryW
IsBadReadPtr
EnterCriticalSection
LoadResource
DeleteCriticalSection
VirtualAlloc
VirtualFree
GetFileSize
ReadFile
SetEndOfFile
SetFilePointer
SetFileTime
GetFileInformationByHandle
WaitForMultipleObjects
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
LCMapStringW
LoadLibraryW
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
GetProcessHeap
TlsFree
TlsSetValue
WriteConsoleW
TlsGetValue
TlsAlloc
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
InterlockedIncrement
IsDebuggerPresent
HeapSize
GetModuleHandleExW
ExitProcess
InterlockedDecrement
IsProcessorFeaturePresent
GetCommandLineA
HeapReAlloc
HeapAlloc
HeapFree
RaiseException
RtlUnwind
LoadLibraryExW
ExitThread
DecodePointer
GlobalFree
GlobalAlloc
GetProcAddress
LockResource
SetFileAttributesW
GetDiskFreeSpaceExW
SystemTimeToFileTime
GetLocalTime
Sleep
SetLastError
WaitForSingleObject
GetLastError
GetExitCodeThread
CreateThread
LeaveCriticalSection
EncodePointer

user32

EndDialog
SendMessageW
wsprintfW
wsprintfA
SystemParametersInfoW
DrawIconEx
LoadImageW
LoadIconW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
SetWindowLongW
PtInRect
ClientToScreen
MessageBeep
GetClientRect
GetDC
DrawTextW
EnableMenuItem
GetSystemMenu
GetSystemMetrics
EnableWindow
SetFocus
GetDlgItem
DialogBoxIndirectParamW
ShowWindow
IsWindow
CreateWindowExA
CallWindowProcW
DefWindowProcW
MessageBoxA
GetKeyState
CopyImage
GetClassNameA
GetParent
GetWindowLongW
GetSysColor
ScreenToClient
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
ReleaseDC
GetWindowDC
GetMenu
KillTimer
SetTimer
CharUpperW
SetWindowPos
DestroyWindow
CreateWindowExW
DispatchMessageW
GetMessageW
wvsprintfW

gdi32

CreateFontIndirectW
GetObjectW
SetStretchBltMode
StretchBlt
SelectObject
GetDeviceCaps
GetCurrentObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject

advapi32

AllocateAndInitializeSid
CheckTokenMembership
FreeSid

shell32

SHGetFileInfoW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
ShellExecuteW

ole32

CoCreateInstance
CoInitialize
CreateStreamOnHGlobal

oleaut32

SysFreeString
OleLoadPicture
SysAllocString
VariantClear
SysAllocStringLen

Sections

.text
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb2f8861ae9e888fc248b97ed817726f

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

1f:73:4d:11:1b:4b:5c:87:9b:bd:5a:8c:49:ab:2a:90Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

22:77:02:0d:4e:f3:c8:0f:4a:d2:89:5a:ad:29:fe:e6:1e:4f:28:ff:7b:5a:8d:62:eb:2c:e9:80:98:ce:02:1fSigner

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 141KB - Virtual size: 140KB

.rdata Size: 34KB - Virtual size: 34KB

.data Size: 5KB - Virtual size: 29KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

.reloc Size: 14KB - Virtual size: 13KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

1f:73:4d:11:1b:4b:5c:87:9b:bd:5a:8c:49:ab:2a:90
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

22:77:02:0d:4e:f3:c8:0f:4a:d2:89:5a:ad:29:fe:e6:1e:4f:28:ff:7b:5a:8d:62:eb:2c:e9:80:98:ce:02:1f
Signer

.text
Size: 141KB - Virtual size: 140KB

.rdata
Size: 34KB - Virtual size: 34KB

.data
Size: 5KB - Virtual size: 29KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

.reloc
Size: 14KB - Virtual size: 13KB