2afa02cf65578a78679fb977bd27db37b708e76b2fa02340b6a44ea55492b4db

Sharing

Copy URL Twitter E-mail

General

Target

2afa02cf65578a78679fb977bd27db37b708e76b2fa02340b6a44ea55492b4db
Size

31.8MB
MD5

a05ebba41fc47b3d48c87ae1df37d163
SHA1

1a17dc4d8b45782414086d4040b1fe7172847c8f
SHA256

2afa02cf65578a78679fb977bd27db37b708e76b2fa02340b6a44ea55492b4db
SHA512

12fb8d5043ab76442163a00f26df8edfda8f0ecfab86acda9ef6f168d5c66a8b988a150ce9935420bab7053d7e8a13031f2055e0af8f2b9d52155a11728551a3
SSDEEP

786432:jZkvVJ7eVziehHzUexvpUET5nS3OVzjlTTuftE00txP7PTeUceWtD:lkvVJJehHzUexvpUU5Ne

Score

1^/10

Malware Config

Signatures

Files

2afa02cf65578a78679fb977bd27db37b708e76b2fa02340b6a44ea55492b4db
.dll regsvr32 windows:5 windows x64

5cbe53301d8efb9a9e93148ce94a5581

Code Sign

53:ff:64:c3:c5:82:1d:e7:5d:b0:c7:95:be:01:d3:60
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/01/2021, 00:00

Not After

13/01/2024, 23:59

Subject

CN=Siber Systems,O=Siber Systems,POSTALCODE=22030,STREET=Suite 400+STREET=3701 Pender Dr STE 400,L=Fairfax,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetExitCodeThread
ResumeThread
InitializeCriticalSection
WaitForSingleObject
lstrlenW
GetProcAddress
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
FreeLibrary
Sleep
lstrcpynW
GetModuleHandleW
GetTickCount
GetVersion
GetCurrentProcess
OpenProcess
GetCurrentProcessId
TlsGetValue
TlsSetValue
GetCommandLineW
MultiByteToWideChar
lstrcpyW
GetWindowsDirectoryW
MulDiv
lstrcmpiW
lstrcmpW
GetVersionExW
GetLocaleInfoW
LocalFree
GetCurrentThread
CloseHandle
lstrcpynA
ProcessIdToSessionId
WideCharToMultiByte
LocalAlloc
GetShortPathNameW
ReleaseMutex
GetSystemTime
GetSystemTimeAsFileTime
CreateMutexW
GetDateFormatW
IsBadReadPtr
SetEvent
GetStdHandle
WriteFile
OpenMutexW
CreateEventW
OutputDebugStringA
ExpandEnvironmentStringsW
GetFullPathNameW
IsBadWritePtr
IsBadCodePtr
AllocConsole
FreeConsole
AttachConsole
EncodePointer
SetErrorMode
LoadResource
SizeofResource
LoadLibraryExW
FindResourceW
ResetEvent
GetModuleHandleExW
GetModuleFileNameW
LoadLibraryW
DeleteCriticalSection
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetConsoleCP
GetStringTypeW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetModuleFileNameA
SetConsoleCtrlHandler
SetFilePointerEx
GetCPInfo
SetStdHandle
QueryPerformanceFrequency
ExitThread
InterlockedFlushSList
RtlPcToFileHeader
RtlUnwindEx
ConvertThreadToFiber
ConvertFiberToThread
ReadConsoleW
ReadConsoleA
GetEnvironmentVariableW
CreateFiber
DeleteFiber
SwitchToFiber
GetFileType
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
SetLastError
GetLastError
RaiseException
OpenEventW
DecodePointer
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
IsDebuggerPresent
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
AreFileApisANSI
HeapCreate
HeapFree
GetDiskFreeSpaceW
GetFullPathNameA
UnlockFileEx
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
GlobalReAlloc
CreateFileW
CompareStringW
FormatMessageW
GetTimeZoneInformation
SleepEx
GetTimeFormatW
TryEnterCriticalSection
WaitForMultipleObjects
GetLongPathNameW
GetExitCodeProcess
LockFile
UnlockFile
GetFileInformationByHandle
GetFileSize
ReadFile
DeviceIoControl
SetEndOfFile
SetFilePointer
FindClose
SetFileTime
CreateProcessW
GetTempPathW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
GetFileAttributesExW
DeleteFileW
FindFirstFileW
FindNextFileW
CopyFileExW
MoveFileExW
GetConsoleMode
SetConsoleMode
FreeResource
LockResource
GetVersionExA
EnumSystemLanguageGroupsW
EnumLanguageGroupLocalesW
GetLogicalDrives
GetDriveTypeW
GetTempFileNameW
GetDiskFreeSpaceExW
GetVolumeInformationW
GlobalSize
GlobalMemoryStatusEx
GetModuleHandleA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
lstrlenA
lstrcatW
GetGeoInfoW
GetUserGeoID
LoadLibraryA
GetLocalTime
SetThreadPriority
SetThreadExecutionState
ExitProcess
SystemTimeToFileTime
GetACP
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
GetSystemDirectoryA
GetDateFormatA
TlsAlloc
TlsFree
SetFileValidData
ReadDirectoryChangesW
CancelIo
GetOverlappedResult
FlushFileBuffers
SetNamedPipeHandleState
WaitNamedPipeW
TerminateProcess
SetUnhandledExceptionFilter
CopyFileW
QueryInformationJobObject
IsProcessInJob
FreeLibraryAndExitThread
LocalLock
LocalUnlock
CreateThread
DuplicateHandle
QueryPerformanceCounter
FormatMessageA
GetProcessHeap
LockFileEx
CreateFileMappingA
HeapDestroy
HeapCompact
HeapAlloc
HeapReAlloc
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile

msimg32

GradientFill
AlphaBlend

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

oleacc

AccessibleObjectFromWindow
AccessibleObjectFromPoint
AccessibleObjectFromEvent
LresultFromObject
CreateStdAccessibleObject
CreateStdAccessibleProxyW
WindowFromAccessibleObject
AccessibleChildren

ws2_32

freeaddrinfo
getaddrinfo
WSAAddressToStringA

wininet

HttpEndRequestW
HttpSendRequestExA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoW
HttpOpenRequestA
InternetGetLastResponseInfoA
InternetSetOptionExW
InternetSetOptionW
InternetQueryOptionW
InternetWriteFile
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpAddRequestHeadersA

secur32

GetUserNameExW

iphlpapi

GetAdaptersInfo

mpr

WNetCloseEnum
WNetAddConnection2W
WNetCancelConnection2W
WNetGetLastErrorW
WNetGetConnectionW
WNetOpenEnumW
WNetEnumResourceW

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetVersion
DllRegisterServer
DllUnregisterServer
RunEditor
RunPassGen
RunShellWindowsWatcher

Sections

.text
Size: 14.7MB - Virtual size: 14.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8.2MB - Virtual size: 8.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 847KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 585KB - Virtual size: 584KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7.3MB - Virtual size: 7.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 272KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5cbe53301d8efb9a9e93148ce94a5581

Code Sign

53:ff:64:c3:c5:82:1d:e7:5d:b0:c7:95:be:01:d3:60Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msimg32

wtsapi32

oleacc

ws2_32

wininet

secur32

iphlpapi

mpr

rpcrt4

comdlg32

Exports

Exports

Sections

.text Size: 14.7MB - Virtual size: 14.7MB

.rdata Size: 8.2MB - Virtual size: 8.2MB

.data Size: 847KB - Virtual size: 1.4MB

.pdata Size: 585KB - Virtual size: 584KB

.rsrc Size: 7.3MB - Virtual size: 7.3MB

.reloc Size: 272KB - Virtual size: 272KB

53:ff:64:c3:c5:82:1d:e7:5d:b0:c7:95:be:01:d3:60
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

.text
Size: 14.7MB - Virtual size: 14.7MB

.rdata
Size: 8.2MB - Virtual size: 8.2MB

.data
Size: 847KB - Virtual size: 1.4MB

.pdata
Size: 585KB - Virtual size: 584KB

.rsrc
Size: 7.3MB - Virtual size: 7.3MB

.reloc
Size: 272KB - Virtual size: 272KB