7b79d4f44f6c19f56e7d6890c1d8df70426fc63fefd761e2a38a285fc0866b6a

Sharing

Copy URL

Twitter E-mail

General

Target

7b79d4f44f6c19f56e7d6890c1d8df70426fc63fefd761e2a38a285fc0866b6a
Size

51KB
MD5

d1ae3ade7572a8cae4d7cadae10b14da
SHA1

dbef2d027f85d12b0cec80e88f893cc3c7f22b48
SHA256

7b79d4f44f6c19f56e7d6890c1d8df70426fc63fefd761e2a38a285fc0866b6a
SHA512

59c50dc7c350d2d0bbff6dc034153faebe3498bea3e9b276f6771e3ba2cabf73f56efcf19579d5e0690cb0b5b5a99b8fc33d43eeef9cecb0f3143001a0ec2d6c
SSDEEP

768:KOCf0C5DNAdhCAfWD3oucNm3sueF9Q1PwHji9zMWJcNm3sueF9Q1PwHji9zMW6:MP5AdgAeMFF9IPa+zH+F9IPa+zH6

Score

1^/10

Malware Config

Signatures

Files

7b79d4f44f6c19f56e7d6890c1d8df70426fc63fefd761e2a38a285fc0866b6a
.exe windows:6 windows x64

45be05610f4fe00649d2593916021b1a

Code Sign

33:00:00:04:0a:87:d0:ea:67:86:e3:6b:07:00:00:00:00:04:0a
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05-01-2023 19:22

Not After

15-12-2023 19:22

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9a:0b:fc:ba:35:7e:9a:de:b8:b8:7d:60:0d:d0:82:26:cf:04:d7:95:f0:18:59:fe:1a:70:42:d9:30:bc:e1:09
Signer

Actual PE Digest

9a:0b:fc:ba:35:7e:9a:de:b8:b8:7d:60:0d:d0:82:26:cf:04:d7:95:f0:18:59:fe:1a:70:42:d9:30:bc:e1:09

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

HeapCreate
EnumSystemLocalesA
GetLastError
CloseHandle
HeapAlloc
RtlLookupFunctionEntry
GetModuleHandleW
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
RtlCaptureContext

ntdll

RtlIpv4StringToAddressA

vcruntime140

__C_specific_handler
__current_exception
__current_exception_context
memset
memcpy

api-ms-win-crt-stdio-l1-1-0

__p__commode
__stdio_common_vfprintf
__acrt_iob_func
_set_fmode

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_register_thread_local_exe_atexit_callback
terminate
_seh_filter_exe
_set_app_type
_cexit
_crt_atexit
_c_exit
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
__p___argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

45be05610f4fe00649d2593916021b1a

Code Sign

33:00:00:04:0a:87:d0:ea:67:86:e3:6b:07:00:00:00:00:04:0aCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

9a:0b:fc:ba:35:7e:9a:de:b8:b8:7d:60:0d:d0:82:26:cf:04:d7:95:f0:18:59:fe:1a:70:42:d9:30:bc:e1:09Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 396B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 60B

33:00:00:04:0a:87:d0:ea:67:86:e3:6b:07:00:00:00:00:04:0a
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

9a:0b:fc:ba:35:7e:9a:de:b8:b8:7d:60:0d:d0:82:26:cf:04:d7:95:f0:18:59:fe:1a:70:42:d9:30:bc:e1:09
Signer

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 396B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 60B