fe4242fb137f497363aaf4b10715560628ba2e648d168e553e6c45bdbff05d79

Sharing

Copy URL Twitter E-mail

General

Target

fe4242fb137f497363aaf4b10715560628ba2e648d168e553e6c45bdbff05d79
Size

1.3MB
MD5

50f12c58bd80bb7748b2a6f063a5fba4
SHA1

2edb3d6955c9ed56bbd80a016854f1995596ad45
SHA256

fe4242fb137f497363aaf4b10715560628ba2e648d168e553e6c45bdbff05d79
SHA512

742022e1c106ad582645afabcc458232fb38f186855035fe01f0718605825d6531c7c2f6f0435191e6bb6c465fc9e81d31e54a76c8360b15bd43205390591b8c
SSDEEP

12288:Pfwkc/p5B166j/8NAag8ag4Za04pDxaS5QSwf:P43/G6z8rqDZa04SS53g

Score

1^/10

Malware Config

Signatures

Files

fe4242fb137f497363aaf4b10715560628ba2e648d168e553e6c45bdbff05d79
.exe windows x64

095c46b0acc0d625f3b3e194dfc98095

Code Sign

33:00:00:04:25:35:21:6f:36:08:7c:eb:06:00:00:00:00:04:25
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:25

Not After

01/09/2022, 18:25

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:1c:8d:f3:1e:81:0f:7a:62:4f:de:ad:7f:62:30:91:ff:17:32:2f:9d:00:47:d6:95:e1:77:ee:95:25:70:9e
Signer

Actual PE Digest

37:1c:8d:f3:1e:81:0f:7a:62:4f:de:ad:7f:62:30:91:ff:17:32:2f:9d:00:47:d6:95:e1:77:ee:95:25:70:9e

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

vcruntime140

memset

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-runtime-l1-1-0

exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sections

.MPRESS1
Size: 4KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

095c46b0acc0d625f3b3e194dfc98095

Code Sign

33:00:00:04:25:35:21:6f:36:08:7c:eb:06:00:00:00:00:04:25Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

37:1c:8d:f3:1e:81:0f:7a:62:4f:de:ad:7f:62:30:91:ff:17:32:2f:9d:00:47:d6:95:e1:77:ee:95:25:70:9eSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.MPRESS1 Size: 4KB - Virtual size: 24KB

.MPRESS2 Size: 1KB - Virtual size: 1KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

33:00:00:04:25:35:21:6f:36:08:7c:eb:06:00:00:00:00:04:25
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

37:1c:8d:f3:1e:81:0f:7a:62:4f:de:ad:7f:62:30:91:ff:17:32:2f:9d:00:47:d6:95:e1:77:ee:95:25:70:9e
Signer

.MPRESS1
Size: 4KB - Virtual size: 24KB

.MPRESS2
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB