12125370219[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

12125370219.zip
Size

967KB
MD5

c771c4659ba1d51bd736ee05f7794891
SHA1

0e1fcf9053fd3fa369a231c5a9154ccfa4cca1af
SHA256

96ca4cc3d47e4c189a8afd8e8ae5d20a3c489adb741576b68d837293f4522f3e
SHA512

85a2499479384c23fa6222ecf1d0c731c68adba604621fcc9db0e9a3a9352fc5991626c2a75abe52e9eb85b4cff65c27e423073735ba6a8148c1f02809995883
SSDEEP

24576:RIUf7nlvc4eoJ/pPwicmwUhnMMGA0HiqMRbVRMr7oPIo5:Ci5v5eWdWUGAZ1pVKwI8

Score

1^/10

Malware Config

Signatures

Files

12125370219.zip
.zip

Password: infected
0598e1af6466b0813030d44fa64616eea7f83957d70f2f48376202c3179bd6b1
.dll windows:6 windows x64

6d46ee96189dda46fdb249ac0133b282

Code Sign

f0:fb:13:90:f5:34:0c:d2:57:24:51:d9:5d:b1:d9:2d
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16-03-2021 00:00

Not After

16-03-2022 23:59

Subject

CN=RHM LIMITED,O=RHM LIMITED,POSTALCODE=AL1 2RE,STREET=Premier House\, Centrium Business Park\, Griffiths Way,L=St. Albans,ST=Hertfordshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bb:fc:56:54:01:d1:c1:d3:4a:70:a3:60:4f:07:f8:07:e1:e7:e5:ea:43:71:0a:d0:37:83:9b:eb:dc:bf:f9:ec
Signer

Actual PE Digest

bb:fc:56:54:01:d1:c1:d3:4a:70:a3:60:4f:07:f8:07:e1:e7:e5:ea:43:71:0a:d0:37:83:9b:eb:dc:bf:f9:ec

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
wcschr
_wcsicmp
wcsstr
memset

ntdll

NtFreeVirtualMemory
NtAllocateVirtualMemory
NtResumeThread
NtProtectVirtualMemory
NtWriteVirtualMemory
LdrEnumerateLoadedModules

shlwapi

PathFileExistsW

kernel32

TerminateThread
ExitProcess
CreateFileA
MapViewOfFile
FreeLibrary
GetCurrentProcess
ExpandEnvironmentStringsA
K32GetModuleInformation
GetModuleFileNameW
CreateFileMappingA
GetModuleHandleA
VirtualProtect
CloseHandle
GetThreadContext
SetThreadContext
CreateProcessW
HeapAlloc
UpdateProcThreadAttribute
HeapFree
GetProcessHeap
TerminateProcess
Process32FirstW
Process32NextW
InitializeProcThreadAttributeList
ExpandEnvironmentStringsW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

1
CPlApplet

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
092c344330bd5cba71377dead11946f7277f2dd4af57f5b636b70b343bc7ebe0
.dll windows:6 windows x64

6d46ee96189dda46fdb249ac0133b282

Code Sign

f0:fb:13:90:f5:34:0c:d2:57:24:51:d9:5d:b1:d9:2d
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16-03-2021 00:00

Not After

16-03-2022 23:59

Subject

CN=RHM LIMITED,O=RHM LIMITED,POSTALCODE=AL1 2RE,STREET=Premier House\, Centrium Business Park\, Griffiths Way,L=St. Albans,ST=Hertfordshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:76:13:95:80:25:4c:d8:51:cc:bf:78:af:52:4f:f0:96:b8:31:10:9b:0c:41:55:2d:16:75:e0:ce:55:0a:88
Signer

Actual PE Digest

c6:76:13:95:80:25:4c:d8:51:cc:bf:78:af:52:4f:f0:96:b8:31:10:9b:0c:41:55:2d:16:75:e0:ce:55:0a:88

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
wcschr
_wcsicmp
wcsstr
memset

ntdll

NtFreeVirtualMemory
NtAllocateVirtualMemory
NtResumeThread
NtProtectVirtualMemory
NtWriteVirtualMemory
LdrEnumerateLoadedModules

shlwapi

PathFileExistsW

kernel32

TerminateThread
ExitProcess
CreateFileA
MapViewOfFile
FreeLibrary
GetCurrentProcess
ExpandEnvironmentStringsA
K32GetModuleInformation
GetModuleFileNameW
CreateFileMappingA
GetModuleHandleA
VirtualProtect
CloseHandle
GetThreadContext
SetThreadContext
CreateProcessW
HeapAlloc
UpdateProcThreadAttribute
HeapFree
GetProcessHeap
TerminateProcess
Process32FirstW
Process32NextW
InitializeProcThreadAttributeList
ExpandEnvironmentStringsW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

1
CPlApplet

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
407eb23a1b18efa17c38e9c0d914306c145a2b77b562d4e1077a823190434369
.dll windows:6 windows x64

6d46ee96189dda46fdb249ac0133b282

Code Sign

f0:fb:13:90:f5:34:0c:d2:57:24:51:d9:5d:b1:d9:2d
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16-03-2021 00:00

Not After

16-03-2022 23:59

Subject

CN=RHM LIMITED,O=RHM LIMITED,POSTALCODE=AL1 2RE,STREET=Premier House\, Centrium Business Park\, Griffiths Way,L=St. Albans,ST=Hertfordshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7f:ab:f9:13:82:1c:2d:a3:f1:41:d7:b4:7e:ef:39:f5:e7:7d:60:95:30:77:0e:51:d3:4a:b1:92:05:a6:12:90
Signer

Actual PE Digest

7f:ab:f9:13:82:1c:2d:a3:f1:41:d7:b4:7e:ef:39:f5:e7:7d:60:95:30:77:0e:51:d3:4a:b1:92:05:a6:12:90

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
wcschr
_wcsicmp
wcsstr
memset

ntdll

NtFreeVirtualMemory
NtAllocateVirtualMemory
NtResumeThread
NtProtectVirtualMemory
NtWriteVirtualMemory
LdrEnumerateLoadedModules

shlwapi

PathFileExistsW

kernel32

TerminateThread
ExitProcess
CreateFileA
MapViewOfFile
FreeLibrary
GetCurrentProcess
ExpandEnvironmentStringsA
K32GetModuleInformation
GetModuleFileNameW
CreateFileMappingA
GetModuleHandleA
VirtualProtect
CloseHandle
GetThreadContext
SetThreadContext
CreateProcessW
HeapAlloc
UpdateProcThreadAttribute
HeapFree
GetProcessHeap
TerminateProcess
Process32FirstW
Process32NextW
InitializeProcThreadAttributeList
ExpandEnvironmentStringsW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

1
CPlApplet

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
5671b3a89c0e88a9bfb0bd5bc434fa5245578becfdeb284f4796f65eecbd6f15
.dll windows:6 windows x64

02af3f2b94f5a8da3ade8dee7e01ead2

Code Sign

f0:fb:13:90:f5:34:0c:d2:57:24:51:d9:5d:b1:d9:2d
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16-03-2021 00:00

Not After

16-03-2022 23:59

Subject

CN=RHM LIMITED,O=RHM LIMITED,POSTALCODE=AL1 2RE,STREET=Premier House\, Centrium Business Park\, Griffiths Way,L=St. Albans,ST=Hertfordshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

66:b4:cb:a3:d2:e5:bf:cc:e0:b3:fb:37:ea:5e:2a:95:f2:1d:d9:52:48:0a:f2:31:47:93:bd:77:46:2c:90:fb
Signer

Actual PE Digest

66:b4:cb:a3:d2:e5:bf:cc:e0:b3:fb:37:ea:5e:2a:95:f2:1d:d9:52:48:0a:f2:31:47:93:bd:77:46:2c:90:fb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

wcschr
_wcsicmp
memset

ntdll

NtFreeVirtualMemory
NtAllocateVirtualMemory
NtResumeThread
NtProtectVirtualMemory
NtWriteVirtualMemory
LdrEnumerateLoadedModules

kernel32

ExpandEnvironmentStringsW
ExitProcess
GetModuleFileNameW
GetThreadContext
SetThreadContext
CreateProcessW
HeapAlloc
HeapFree
GetProcessHeap
TerminateThread
TerminateProcess
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
CloseHandle

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

CPlApplet

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
f270202cd88b045630f6d2dec6d5823aa08aa66949b9ccd20f6e924c7992fea7
.dll windows:6 windows x64

6d46ee96189dda46fdb249ac0133b282

Code Sign

f0:fb:13:90:f5:34:0c:d2:57:24:51:d9:5d:b1:d9:2d
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16-03-2021 00:00

Not After

16-03-2022 23:59

Subject

CN=RHM LIMITED,O=RHM LIMITED,POSTALCODE=AL1 2RE,STREET=Premier House\, Centrium Business Park\, Griffiths Way,L=St. Albans,ST=Hertfordshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

60:01:c5:83:7f:d3:19:8f:3e:ba:b5:29:b9:7c:6c:19:f1:17:c2:d7:ae:e0:38:d7:30:7b:a9:b7:62:89:da:9a
Signer

Actual PE Digest

60:01:c5:83:7f:d3:19:8f:3e:ba:b5:29:b9:7c:6c:19:f1:17:c2:d7:ae:e0:38:d7:30:7b:a9:b7:62:89:da:9a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
wcschr
_wcsicmp
wcsstr
memset

ntdll

NtFreeVirtualMemory
NtAllocateVirtualMemory
NtResumeThread
NtProtectVirtualMemory
NtWriteVirtualMemory
LdrEnumerateLoadedModules

shlwapi

PathFileExistsW

kernel32

TerminateThread
ExitProcess
CreateFileA
MapViewOfFile
FreeLibrary
GetCurrentProcess
ExpandEnvironmentStringsA
K32GetModuleInformation
GetModuleFileNameW
CreateFileMappingA
GetModuleHandleA
VirtualProtect
CloseHandle
GetThreadContext
SetThreadContext
CreateProcessW
HeapAlloc
UpdateProcThreadAttribute
HeapFree
GetProcessHeap
TerminateProcess
Process32FirstW
Process32NextW
InitializeProcThreadAttributeList
ExpandEnvironmentStringsW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

1
CPlApplet

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

6d46ee96189dda46fdb249ac0133b282

Code Sign

f0:fb:13:90:f5:34:0c:d2:57:24:51:d9:5d:b1:d9:2dCertificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

bb:fc:56:54:01:d1:c1:d3:4a:70:a3:60:4f:07:f8:07:e1:e7:e5:ea:43:71:0a:d0:37:83:9b:eb:dc:bf:f9:ecSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

shlwapi

kernel32

advapi32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: - Virtual size: 560B

.pdata Size: 512B - Virtual size: 144B

.idata Size: 264KB - Virtual size: 264KB

.rsrc Size: 1024B - Virtual size: 736B

6d46ee96189dda46fdb249ac0133b282

Code Sign

f0:fb:13:90:f5:34:0c:d2:57:24:51:d9:5d:b1:d9:2dCertificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

c6:76:13:95:80:25:4c:d8:51:cc:bf:78:af:52:4f:f0:96:b8:31:10:9b:0c:41:55:2d:16:75:e0:ce:55:0a:88Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

shlwapi

kernel32

advapi32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: - Virtual size: 560B

.pdata Size: 512B - Virtual size: 144B

.idata Size: 264KB - Virtual size: 263KB

.rsrc Size: 1024B - Virtual size: 736B

6d46ee96189dda46fdb249ac0133b282

Code Sign

f0:fb:13:90:f5:34:0c:d2:57:24:51:d9:5d:b1:d9:2dCertificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

7f:ab:f9:13:82:1c:2d:a3:f1:41:d7:b4:7e:ef:39:f5:e7:7d:60:95:30:77:0e:51:d3:4a:b1:92:05:a6:12:90Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

f0:fb:13:90:f5:34:0c:d2:57:24:51:d9:5d:b1:d9:2d
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

bb:fc:56:54:01:d1:c1:d3:4a:70:a3:60:4f:07:f8:07:e1:e7:e5:ea:43:71:0a:d0:37:83:9b:eb:dc:bf:f9:ec
Signer

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: - Virtual size: 560B

.pdata
Size: 512B - Virtual size: 144B

.idata
Size: 264KB - Virtual size: 264KB

.rsrc
Size: 1024B - Virtual size: 736B

f0:fb:13:90:f5:34:0c:d2:57:24:51:d9:5d:b1:d9:2d
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

c6:76:13:95:80:25:4c:d8:51:cc:bf:78:af:52:4f:f0:96:b8:31:10:9b:0c:41:55:2d:16:75:e0:ce:55:0a:88
Signer

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: - Virtual size: 560B

.pdata
Size: 512B - Virtual size: 144B

.idata
Size: 264KB - Virtual size: 263KB

.rsrc
Size: 1024B - Virtual size: 736B

f0:fb:13:90:f5:34:0c:d2:57:24:51:d9:5d:b1:d9:2d
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

7f:ab:f9:13:82:1c:2d:a3:f1:41:d7:b4:7e:ef:39:f5:e7:7d:60:95:30:77:0e:51:d3:4a:b1:92:05:a6:12:90
Signer

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: - Virtual size: 560B

.pdata
Size: 512B - Virtual size: 144B

.idata
Size: 264KB - Virtual size: 263KB

.rsrc
Size: 1024B - Virtual size: 736B

f0:fb:13:90:f5:34:0c:d2:57:24:51:d9:5d:b1:d9:2d
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

66:b4:cb:a3:d2:e5:bf:cc:e0:b3:fb:37:ea:5e:2a:95:f2:1d:d9:52:48:0a:f2:31:47:93:bd:77:46:2c:90:fb
Signer

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: - Virtual size: 560B

.pdata
Size: 512B - Virtual size: 60B

.idata
Size: 104KB - Virtual size: 104KB

.rsrc
Size: 1024B - Virtual size: 768B

f0:fb:13:90:f5:34:0c:d2:57:24:51:d9:5d:b1:d9:2d
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

60:01:c5:83:7f:d3:19:8f:3e:ba:b5:29:b9:7c:6c:19:f1:17:c2:d7:ae:e0:38:d7:30:7b:a9:b7:62:89:da:9a
Signer

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: - Virtual size: 560B

.pdata
Size: 512B - Virtual size: 144B

.idata
Size: 264KB - Virtual size: 263KB

.rsrc
Size: 1024B - Virtual size: 736B