12073456732[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

12073456732.zip
Size

201KB
MD5

95e12127ffb90151b3eef187fa5d7cd7
SHA1

cf1e9262df3e6eee33fa81d19b75c6c13e4ba0cd
SHA256

f858e52d6aee5c3ef3af7e4311f6e7b278eeb3be997fd984b713c0bfb87a48b9
SHA512

823f44e8642feec6f887bcb408c6e8f42d032d6c06b05d4d0321d08c8145d47ac8c7b3ee91aeea1d2fadcd1a356063eef75eb9c58cc1c9276e82a4bb3c979180
SSDEEP

6144:aze+qeZA59QH3gOymgLV79roEnE4JR2kILY5MF2mpInEHo:gecZA7SgfZ798EE4JIkQY5IBI1

Score

1^/10

Malware Config

Signatures

Files

12073456732.zip
.zip

Password: infected
2cf9bef62939a9b645d43d05959e181f3962e7f10c9e4d73288c7f36af7d5ec2
.exe windows:4 windows x64

06f25df4360c0ab9ee30cbac816de0f4

Code Sign

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:2f:27:05:35:c2:d5:e7:63:07:20:fb:22:9b:5d:1c
Certificate

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

18/05/2023, 11:35

Not After

17/05/2024, 11:35

Subject

SERIALNUMBER=0001028448,CN=KOZUZ SP. Z O.O.,O=KOZUZ SP. Z O.O.,POSTALCODE=27-200,STREET=ul. Spółdzielcza 27,L=Starachowice,ST=świętokrzyskie,C=PL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13064b69656c6365,1.3.6.1.4.1.311.60.2.1.2=#0c10c59b7769c499746f6b727a79736b6965,1.3.6.1.4.1.311.60.2.1.3=#1302504c

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

28/07/2022, 08:56

Not After

27/07/2033, 08:56

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

99:58:b2:f4:b0:54:49:4e:c9:9a:c3:0d:a6:02:31:cd:68:a3:07:93:1b:ff:98:89:dc:75:f9:a1:93:e6:2f:79
Signer

Actual PE Digest

99:58:b2:f4:b0:54:49:4e:c9:9a:c3:0d:a6:02:31:cd:68:a3:07:93:1b:ff:98:89:dc:75:f9:a1:93:e6:2f:79

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__C_specific_handler
__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_lock
_onexit
_unlock
abort
atoi
calloc
exit
fprintf
free
fwrite
malloc
memcpy
memset
signal
strlen
strncmp
vfprintf

user32

MessageBoxA

Exports

Exports

AAQyFNAIhMSuIoKLWBnmus
AAhcHbiZENoimESpp
AAzNcqEfBNCiRGhaBmbFpmZJ
ACDIQergMtsVZk
ACNNEKPSqAJHcc
ACUnBQiCwauDbaRTYwODhHYVJ
AClCwLn
ADHeyxxxcy
ADJZyuTARiqolrSVDGp
ADaXWYiVvIMuQWl
ADjAGGVQvYcumyEsaz
AEdXTWHyohxvsD
AEnbOMBMOza
AEshNwcQt
AFNVTmiLGKuKPdYfG
AFnVtlmsHJXygYFeIuNdfZN
AGAKsTYyMqRdQKwefbI
AGQBtiaKmvaOn
AGWhyWwPVRprzfANfRHo
AGjNbeneYt
AGoRFRtesUFArxgJZHWiBpOuko
AGtCbsuMJTlYZuFiI
AHVtLbGEtzPkxhxK
AHggldGqf
AHpMmVaFSJVU
AIolTzpL
AIxsdpLgtocQErURePDObj
AJgqUuVAwysTtlYHXMeOCfTrF
AKGBZMlizeRbkRWVQbl
AKgwUnBgU
AKiqkwOdRHFUZWeysFq
ALjOUTUEEvPkNIQT
ALmBDofGeVuttxSYaMv
AMZpAlijwXauFSUdi
AMiGoxoPIfQnQaDLjDHLOsXTF
ANHYKc
ANJThDfeP
ANJirNyalErrpQ
AOTOWLdWErG
AOtSowKjXaXnSNsak
AOxwDhiovSMEF
APdlZFAgFAlQQYNbXYTXTJ
APqFSNflXjWucyETPyGZOupov
AQBPYoEXCurWC
AQLYoUg
AQbCauibuRQ
AQhhkdWTrK
AQiRZPDDBvkThPXNhRS
ARaIMspVPqsDwSRdwlDJEWLQ
ARwfbM
ASHtNRbYzTZkzhxjwnQ
ASKXBKbAIUSobUPi
ASUMaBMEEHvuGRNewUuEaFOw
ASVZqpdsnerDOkyUfrMPP
ASViIsRkpCGNhRTHju
ASXZiPeExcnkj
ASZdcpLtjpUeJ
ASelvjwmrnXVuJtaNdnRVgmFm
ATqcNrFpiDG
ATvInicS
AUogDGUIJMBcOnxsd
AUychlVlHmprXJQXj
AVCkNNhMeaAgoxkSSZOObLr
AVWEwHWl
AVZbNUH
AVZosupTYOjKsSC
AVahkqMlPYVKRChjLNhfWBG
AVaqszBELQMnaKBqpZIa
AVoHOpdUyBQopWoa
AWokGRIDjXBNtq
AXerTEhkDSAowS
AXgoAhKAIXHiZwIQAec
AYAhMOlEgwrVmSmkGX
AYbUdLhLHvNF
AYiKROFdThjDXkreAnJDbL
AZQcyfnsbDhII
AZcbOgcfHgkirvvAis
AZpwmNrjQf
AZzFwGfnIMNNWSnUMbd
AaGHRdhyRq
AaGVEOli
AaTZyFLppw
AalBOOpPEMhrtHkOwf
AbWWCDTZfdtKFoda
AblkNcOWAvoTJZdmXoi
AcDbnQkqsu
AcelZOpmyNxyudKy
AcfLQJdpPDcIccmzTaESXsGA
AcpMOgaQHnmmFyBGGZQZYLti
AdapqxlwuVmRPtTI
AeLDGvezWkvkOqqXSC
AeQHLCplTExcPyo
AedkaPUDrnPBiYuOBijkanVdt
AeeBvtDTQjI
AeedPqLhaDdItHn
AeqzzdaBtSzbRXmbqunpyGZD
AfBoZarjdhyZYWSo
AfEDYhfHKaXWOwqzJ
AgLnwkzHDcqLcuP
AgdchotgPRXe
AgiCyZiAXRoOOEKzD
AiGyGUVGbtYGMGxLycRuvoq
AigxEvYBPuGNLrfxF
AivbqoRVCOGrgnCEh
AjTQsIywdYtrAtKYrnsgEh
AkVFEaJSrCCw
AkYYIunmZrBuZUnaEIxlWBKH
AkZCEq
AkpbprhRZoKp
AlCdVJsbAKNvQMXvJf
AlPByPZorsIvp
AlVTtcepVwhzr
AlheDUULMYKiUMOqu
AmWGPgjsdJgEDQXewXfIYf
AnAPRCZeKxOmBqfXXBatNrZ
AnBdcgiPRbOfkkfZi
AnTMHWIVyFIPauxHEoEx
AoFjIuQXlaarHVgRDaMfG
AoTyhylWLQHGpUhk
AotHFb
ApUxwscy
ApipBkJzhEDQxidcdc
ApngNsNFF
ApuUcrbOwmnYhddr
AqQOzaLOXgCqX
AqgdvVtpqvEoqmHyipnmvDdeEw
AquGkNtOdviyzpmeDyuQ
ArprSgnpyIliusurppzfjxHhks
AsBzLbkCGtcvfVnUznSrWMBg
AsMEFa
AscnsUgHyfBKShJKBMb
AsfAPnOBYlknf
AshroDCmAAuEXN
AswTXMfGdHvgiDaDHN
AtKnaZJtgANvHsAxLyMZkXivUG
AtQlPjXwVsMpHVYXoTAAzRmg
AtTEBwGIMv
AtUCJkpsLHUIsPIBLXiBowldcJ
AtmSagXPYXZ
AtpvDwMAmfQfeHSGgLigus
AuGRGhMKzgr
AueAjoUBNMsEWOiYDzIS
AulBSOZGMXQg
AuqeYFXyKvXHAjhonpjyc
AuylWalQDb
AvRAsvId
AvmbzWmYBLY
AxJRnAUCqphuabvKweoMS
AxWrTeZMqFB
AxbQGvT
AxhFemWxZVmfzEWJLdUr
AxoCtSscFnFOWMVBZXUgZSdOvt
AxrBmLq
AxxSIFUYuLwh
Ayjmqqy
AyuOfjGjasVAEfDnjwYGzV
AyylULipchGEJnMmxwj
AzquWTO
BAGSpWFatRuO
BAdsPxHYJtaIkotG
BAjfPnCudoGWEbTaznWLGoHvw
BBISqRGGCbfqjwGPQVYhFyZj
BBaPvorzRbjlc
BBvkNoSnWMEtb
BCVcORTILdlagkRAxPFsYtHGE
BClVCAgQsjHgp
BCnKptrUlxbN
BDRbygxZwATfly
BDoAVQYiSRlRRXftyh
BEPMHzwzfSj
BEjvlwnGwlseIPCngCnVDJbm
BFxVQev
BGVglaQsDXPJnCbFTMhsNM
BGaOMSoBwDssanpzLKnzeLWuCp
BGfspu
BGgCmCnqYRj
BHaqROWBKBhJmwQGGjNhBSx
BHvZatrQtpzuV
BIHdIhOmsQgkYLCGtZyanmtmn
BIkEHazJuRDtpKHIHPnUDQdq
BIpNngw
BJJXPWVGVLwZsyWbfZnpzSL
BJuZXMchHsdDZoOnNkA
BKIDfNCFUFWm
BKMyFSwdOhpvsOMNkmEwrKNzDJ
BLLNAtrEqYAjlbCSu
BLLvmtqoXbCHgCYLTPmmkOm
BMzdlDrlhHxTNKfnRF
BNCHNZaMbHkmS
BQaNmHQolKTvYXTudZIJrIEhZ
BQbOhjbcMRwd
BQlLqzjQ
BRMEdtcDWcByzpXBahqi
BRRTTsxfn
BRuUyvrnoS
BTrIUXUiEkkgPcnKyLBEtxdS
BUCaOyzASpbTpnRuvR
BUJPlK
BUbATMVikRiskailrLof
BVbkVtcxOvqzQH
BWCqKmGeTpQnY
BWFiibvmE
BWTVAleNzNdkxTEQwnxKOGORWe
BXiZNOS
BXrAUhPDm
BYrEuamExqZ
BZombZcN
BaKnQglIW
BanXpIyROQPbzyK
BarZWZnU
BbRwGdFDDbQGgkkwMc
BcaDuMyFaCrLLbZPIQXw
BcaRRvixQUjCaUIBt
BdlWIVo
BeNeTWFFuTTAJmLzpyR
BfAKjj
BfKMNHiZPjbjXv
BfQprzdrcPhBosYWnKyFS
BfUULBqllEHCaRPxOLmgGbZ
BgkMmMPl
BglvuN
BgwfwNejPNlBnRmojzxQpDDxx
BhLykTJcFPqTUckHDWqN
BhXEDoCGdvtZkfDBEAw
BhqnzvUNkMVkuTt
BhwXKlBXsnmxCdzWM
BiXVfPkOFCNwpqBRXo
BjHraIqBqNchB
BjVtvYLskIqpoPnlOkRHo
BjdxgWnbTVB
BjsVZsRzMxIXpBe
BjumBzRTVTmvyivMkuTUndgHk
BjvqBqYthYiWrrrCIxnDERZgk
BkFJlXMWGjYyHQBXiodK
BkQiCKWVsMqz
BkhgPQAffOpJzuCHMOOiqeH
BlIpUf
BmfmHaDORqwIUavzrsbGYLCkoy
BmrHuPWwgPT
BmsUAwJhqQeRUBcjKdtSiyliY
BnXqAYu
BnxVNvdkUYEDYG
BoXhejAYKvMkKMZjGjog
BoeBtoWn
BojAivWbezKWSEK
BpegNbJOgnG
BpmKKI
BqGgQn
BqVVnVk
BqhWTx
BsCqgVgBGiDPpkQesbnqGoU
BsHZqiOyyN
BsTnXzDVddJlHtjX
BtNmXNAgEie
BuBouPlrNyoeg
BuCuuoNkAimTGopTwy
BuVfTRZJeEUb
ButuqBdGHzpYNAhrsqTU
BvFlEBtvSmLDOkRNqrBpreP
BvKXrPYFsqBQdmSQqjMMBVq
BwFjktETCxPEoxUWLVxugvbma
BwnRhRQhst
BxJCACB
BxPTNblF
BxkcolTjKsixH
BxsAFuX
BzCsbQeoGsBNVUL
BzuBMMdyWzALkRN
CAHmqmtqUummuMDGZyP
CAXrvFSGflroAZhaSOOukjj
CAuSITbwZAfDzrDI
CBxQDByuUvhLejVgZQXPFB
CBysDucuxetpWba
CCZOIkSyyxxGs
CDBfCEGsOKXWCOQpmpfhdNK
CDHYZRDddCRIUoFOBUifbhEw
CDRSsmHTrZgqSYoNLmE
CDViwOZbhZ
CEESvxJbQoDooLSRINjvc
CEFmQgHcVWdeOzboxxDM
CENuAbXhCll
CFOHCI
CFOoojOhlqRoQVXzZVrsWuBsUv
CFcUAlv
CFmVXULkkPjinth
CFufAFLRf
CGfXIc
CHDpMFUeCvkbViXSHZTAluwdqx
CHaojKCru
CHdKUpzgvdUYNAKjPKFwMZqOE
CHeMeUIDlJlTHrLO
CHnMEYdivilnfUMaxK
CIDyAFkWpIXSlvy
CIwLRndIuuoEcWHzfWFev
CJJEvHhXyaRcGKRTSFGAzdmt
CJjLdLIoeXWx
CJoJbJrND
CKHRzIIXnSqI
CKQEkDtpulMFmW
CKlzZrep
CKujjYTTgi
CKvzKEUPLYNzlmn
CLIevecdHY
CLfQFMFCDPBbipqrwYWYglNRlv
CLsrogTYCmc
CMWrvPcVLWfFKYMqVbHu
CMuaCvPgiVMpRwYoVtes
CNcryV
CNwefzRY
COPDkYkwCe
COZUod
CPPsgBpUkZjwbZCUahrGru
CQHSkFZOmYhdDFXOBOIt
CQhwMkvZvCL
CQjqKMHISdQmiVGmvLI
CRfhVZGkECZeSZrRFMwgS
CRnKlhLCrYdNsmiqQvoPnj
CRqBhCowbgZAswbYv
CSHbpOOX
CSPSJxWWtSRRMnI
CTWuZkBTAbwdVUXpDzXw
CTdirY
CTzOzxygHSSMxLJtyEovCin
CUEbEbbArn
CUWvVYgk
CUaEnXMuPUiMGerthllzFSP
CUgTqFBzfmNGRt
CUwzHsJwyiEMqxIrgSd
CVSQRvThtpXqnDX
CVpCNrUFDRe
CVwsma
CXFrXHhadJGYrkYVEwWYvRfe
CXXGGQJHxPgLCgPA
CYQNYmsGXRmNpmmYIbL
CYRitfQlykQcEGAEF
CYUEmwq
CYXcNxeWxifGtunZU
CYgrnQMmHoJRpEwQXoasaz
CYtLEe
CZEzjQZM
CZdbUvrrcMBFopOFQNClHkvMRk
CZzKJsWwCBmvnw
CaBTUnNNSMd
CaDvJKmNebobGlB
CaJjvUZYtfbrmTygtSKdEE
CaXixRKZr
CaXldjuNDGJnaD
CagZGmhMpzPYoicG
CbHefmPgtvpt
CbKjDR
CbLiLyGORxxgLXBmB
CbOTci
CblYshWCepSIAcBV
CbpyivYgqdiEyoaxVvxzEif
CbsVOtbeyWmPkThpZ
CdCZxmvIavUW
CePyETGtzZmTahoNXCdIoZEDfK
CehhkeLyx
CfLbAwLSaCkFtzoPzsXBJOKVBs
CfQwaxJMJCBjPCEhMx
CgTHvlGCVSEyZgo
CgcdOSUNSuBoCMmTprEf
ChKUwbTZPGjLUtiTDUiy
ChQWKxIoFepsoiWIYMCVZuSbmQ
ChlVrUzaTajmEKWtIuOZRYfOCF
ChrNtpIurOJkNdkWGvLWcV
ChvgEyrzXGAEchuLDT
CiYzKs
CizKMpIfmjGnwtpKhPDyqoVN
CkHWZUOljYHym
CkLDnlkaaxzxpkc
CkmyyeTfYJYzNasuFasdbzOKaf
ClDUusHEnstkJUCk
CmTDYFhjryieHUxPceSCnU
CmnBupsDYw
CoBpxMztsbum
CpBJfTvP
CpQoTkQ
CphSoOEbSUjcDeYdITPtyvK
CprnMMVCBYUFiVHBIQEqRCmE
CqYPjsbCFGtdzLbpxKGxEdgj
CqyQfWwwsSVpmsqAypcFeA
CrrszpnvpCDCcG
CsMwgjkQIXpSJeT
CsPBYKLkweEqkBjR
CspNwAqXMW
CtJxupuY
CuBHbdZd
CucWbqgWoHLegstTgyOckEq
CueVIYraAOIO
CvoevBhsvdThBBnoD
CxDvTr
CxcmWeIviKBwLyBRRUNAEGX
CxngmUkPNjV
CxqUoaAlbZSErJWuCYzul
CyDoHwvkMX
CyEaskXgmduRcd
DAVUQH
DAWOFibiNrRabcKVkZOAcgN
DBDLlKxPukGOBIIXtvttjMQdY
DBGaqSyyCPxXkSHCjz
DBfBTDignStln
DBgoVgQHlpbyaKCFMAgAKj
DCGIBJjlCCxY
DCHAErwhPOi
DCUnowUgOwWEjlKGUDnSOe
DCVjuBAfNTBr
DCYbYsaNLuwoJKlKsscLmL
DCwmQIJqyFsiCUTdaAakZ
DDJgTqQkaGBrx
DDxDOvYSAncHHmZBOAvJo
DDzuzsJvyQqfMlVUkK
DFOZVdcvHecSbdjB
DFatrvqpm
DFwCFnKmen
DFxoKdwXYUg
DGBGDMPSpZZOywo
DGeRzPGciKXfgTbbVA
DGlHNKeemqktAAbRmLAuQaYHwn
DGvmjjMyPhNPhiYuiwVpckJ
DHQuBxmVHeje
DHtEliNtlxiXFfWJxUNyP
DIhSRyUpVTlmKpe
DJMmiyfIpfGkdrKXwkLWaAglSu
DKIqAZgfyJXEweY
DKPAVCrhXjYI
DKifaRzEGWPQVdVizIZ
DKkaYlOdegZiywaNlV
DKpBYyHwFfYbUkhc
DLNjPLLGxNnqZKHXENXPnxyQgk
DLOEOOFP
DLQgUbvEuSSBYruXyGY
DLSsqhHxXoLSKUZnVXHRYg
DLVBmhSh
DLVegQlBVobBBnKYspTmEmHy
DLnPElKnwV
DMQyeLg
DMVqKTZCePv
DMkWVYmbvNiyWIsOlL
DNilmuBPLRLZsXwlzgcipmzos
DNomomeziKOeYJwipu
DNxgkJMFuaR
DNyBVfL
DONuzdk
DOpEBEOclqIoMnxUypfRESAe
DPVJYcrvcYHNEnyUkvVsOQ
DPbGcPlw
DQDaSqQzyBAQMvsyj
DQESdmYtBjwVlzvKhYSkHpE
DRfqxBLaIqrwVprZVwXJ
DRjYxiLzBAoVzf
DRkTuFOuiWRaXy
DSCSvqgCkGsjk
DSPeAgaEornlP
DSagPQMLT
DTQIkr
DTZhwbwE
DUcULAoZBOgzTaCYhWXZ
DUyQcETLPhNhUtKnBIayP
DVbVwedNhNDhrL
DVfZPKIzJxBoLTDrGvj
DVwELoIfKhyWYcLhdAH
DWFKOTihqTgcDPVSJivgU
DWYMka
DWrRPahuVUMRfLbDHCOIzvk
DXehURTpJzTpGUSqk
DYLJldopUUlLX
DZCSWKFWNwEjGyMHkXJazc
DZatlk
DZbpXgzdXTt
DZdgALMwmcagcBC
DZlNDRDQGzJuVroEEmyVbjAZb
DaFvQHUqrXNYjR
DaakwpwO
DblRTb
DcRgBUqscUzlNjj
DdYRbUdQm
DdlxhyVqNlKqXyFCgwnuP
DduzCHBcJJhBBPy
DeGXFcDumcQu
DeioOEP
DejisMcHfDrvDwZWBZkJKfurpH
DfGyGcwvbmnQ
DfWnzMcmgGasUGppRGqQwU
DfaOlxuCEPOAaiwqXRWPahdKhZ
DffZNHdCYmrrDIM
DfvRLTaNSSjSuhQXWFeeIPcbC
DgGCdbGHMiThsp
DgKBydKNuqCLIaOYCueGeHuCY
DgXemgveYKabrGDmeqlWB
DgdIkOZFjDmtXYxBw
DgvxacNDQXSbCwAV
DhdMTOeVwtZXcLIF
DhmqeNCPDHQBWFRHO
DhsnxYCagxZoikhnpIijSGGvJc
DiOMBEt
DiRztqdTlAEI
DicqVAjPSxnBxgR
DixklGLFDLhHMGfQNLGuZzhd
DixrkwwPGWUE

Sections

.text
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 748B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

06f25df4360c0ab9ee30cbac816de0f4

Code Sign

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89Certificate

Extended Key Usages

Key Usages

2a:2f:27:05:35:c2:d5:e7:63:07:20:fb:22:9b:5d:1cCertificate

Extended Key Usages

Key Usages

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

99:58:b2:f4:b0:54:49:4e:c9:9a:c3:0d:a6:02:31:cd:68:a3:07:93:1b:ff:98:89:dc:75:f9:a1:93:e6:2f:79Signer

Headers

File Characteristics

Imports

kernel32

msvcrt

user32

Exports

Exports

Sections

.text Size: 125KB - Virtual size: 124KB

.data Size: 19KB - Virtual size: 19KB

.rdata Size: 2KB - Virtual size: 1KB

.pdata Size: 79KB - Virtual size: 79KB

.xdata Size: 27KB - Virtual size: 26KB

.bss Size: - Virtual size: 2KB

.edata Size: 178KB - Virtual size: 177KB

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 80B

.rsrc Size: 1024B - Virtual size: 748B

.reloc Size: 512B - Virtual size: 80B

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89
Certificate

2a:2f:27:05:35:c2:d5:e7:63:07:20:fb:22:9b:5d:1c
Certificate

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

99:58:b2:f4:b0:54:49:4e:c9:9a:c3:0d:a6:02:31:cd:68:a3:07:93:1b:ff:98:89:dc:75:f9:a1:93:e6:2f:79
Signer

.text
Size: 125KB - Virtual size: 124KB

.data
Size: 19KB - Virtual size: 19KB

.rdata
Size: 2KB - Virtual size: 1KB

.pdata
Size: 79KB - Virtual size: 79KB

.xdata
Size: 27KB - Virtual size: 26KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 178KB - Virtual size: 177KB

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 80B

.rsrc
Size: 1024B - Virtual size: 748B

.reloc
Size: 512B - Virtual size: 80B