c40b0d62dbd4eacae87cdd79d0f4cc20_exe32[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

c40b0d62dbd4eacae87cdd79d0f4cc20_exe32.exe
Size

2.4MB
MD5

c40b0d62dbd4eacae87cdd79d0f4cc20
SHA1

a79304a73d919bdf8da05bf106eb2e85202c0cfe
SHA256

4fb9dc73fe4183c3e0a4d586ec106105f9183acc9de162f018f6c7ec9ec92292
SHA512

57a2e94c5187ce4d97b68c52453a8c1bf9012d4bd0029688b50a61f2f55f69b11a3382489ffeb0f971f5ce69870f2710946fc5ed58ac871d146cf7a64d949f55
SSDEEP

49152:ow1JGnZF9/9y2mb2guAyXpzqyiUPIvzL/u72TA:ow1JGnZX102VXBYvzL/u5

Score

1^/10

Malware Config

Signatures

Files

c40b0d62dbd4eacae87cdd79d0f4cc20_exe32.exe
.exe windows:6 windows x86

01f088a8021eddf0440966893f15310c

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:6b:c7:a9:46:49:bc:64:d8:79:c5:47:a2:63:64:ed
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

21/06/2023, 00:00

Not After

20/06/2024, 23:59

Subject

SERIALNUMBER=202237692H,CN=SINGHEAR PTE.LTD.,O=SINGHEAR PTE.LTD.,L=SINGAPORE,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:6b:c7:a9:46:49:bc:64:d8:79:c5:47:a2:63:64:ed
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

21/06/2023, 00:00

Not After

20/06/2024, 23:59

Subject

SERIALNUMBER=202237692H,CN=SINGHEAR PTE.LTD.,O=SINGHEAR PTE.LTD.,L=SINGAPORE,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9f:f6:ee:2c:0d:cc:87:da:85:2e:b3:e4:da:82:35:52:97:9b:55:bc:b0:31:f4:6e:81:b1:4f:06:a8:b4:2e
Signer

Actual PE Digest

01:9f:f6:ee:2c:0d:cc:87:da:85:2e:b3:e4:da:82:35:52:97:9b:55:bc:b0:31:f4:6e:81:b1:4f:06:a8:b4:2e

Digest Algorithm

sha256

PE Digest Matches

true

82:c6:1b:73:f2:d1:55:fb:48:e6:0a:20:21:b5:c1:4e:6b:90:54:74
Signer

Actual PE Digest

82:c6:1b:73:f2:d1:55:fb:48:e6:0a:20:21:b5:c1:4e:6b:90:54:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

getpeername
recvfrom
inet_ntop
inet_pton
setsockopt
htonl
socket
listen
sendto
closesocket
htons
accept
inet_addr
send
recv
freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
ntohs
getsockopt
getsockname
ioctlsocket
bind
WSAPoll
gethostbyname
inet_ntoa
connect
WSASetLastError

iphlpapi

IcmpCreateFile
IcmpSendEcho2
IcmpCloseHandle

shlwapi

PathAddBackslashA
PathRemoveFileSpecA

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

kernel32

GetDateFormatW
GetConsoleCP
GetFullPathNameW
GetLocalTime
GetLastError
DeleteFileA
SetEvent
WaitForSingleObject
CreateEventA
Sleep
CreateThread
WinExec
GetTickCount
CloseHandle
GetExitCodeProcess
OpenProcess
GetModuleFileNameA
FindFirstFileW
FindNextFileW
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
FindClose
GetVersionExW
CreateEventW
LoadLibraryW
GetProcAddress
GetCurrentProcessId
FreeLibrary
FlushFileBuffers
GetModuleHandleExW
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetTimeFormatW
GetFileType
WriteFile
GetModuleHandleW
MultiByteToWideChar
SwitchToFiber
DeleteFiber
CreateFiber
WideCharToMultiByte
GetSystemTime
SystemTimeToFileTime
QueryPerformanceCounter
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryA
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
QueryPerformanceFrequency
GetCurrentThread
GetThreadTimes
FormatMessageA
InitializeCriticalSection
GetACP
HeapReAlloc
ExitThread
SetFilePointerEx
GetFileAttributesExW
GetCurrentDirectoryW
SetStdHandle
HeapSize
DeleteFileW
GetProcessHeap
SetEndOfFile
FindFirstFileExA
FindNextFileA
IsValidCodePage
IsValidLocale
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetUserDefaultLCID
GetEnvironmentVariableW
EnumSystemLocalesW
HeapFree
HeapAlloc
GetTimeZoneInformation
WriteConsoleW
SetConsoleCtrlHandler
ExitProcess
ReadFile
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
CreateFileW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
TryEnterCriticalSection
EncodePointer
DecodePointer
RaiseException
DuplicateHandle
WaitForSingleObjectEx
QueueUserWorkItem
IsProcessorFeaturePresent
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
ResetEvent
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore

user32

MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW

advapi32

DeregisterEventSource
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW

dnsapi

DnsQuery_A
DnsFree

bcrypt

BCryptGenRandom

ntdll

RtlUnwind

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 537KB - Virtual size: 537KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01f088a8021eddf0440966893f15310c

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0e:6b:c7:a9:46:49:bc:64:d8:79:c5:47:a2:63:64:edCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0e:6b:c7:a9:46:49:bc:64:d8:79:c5:47:a2:63:64:edCertificate

Extended Key Usages

Key Usages

01:9f:f6:ee:2c:0d:cc:87:da:85:2e:b3:e4:da:82:35:52:97:9b:55:bc:b0:31:f4:6e:81:b1:4f:06:a8:b4:2eSigner

82:c6:1b:73:f2:d1:55:fb:48:e6:0a:20:21:b5:c1:4e:6b:90:54:74Signer

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

iphlpapi

shlwapi

crypt32

kernel32

user32

advapi32

dnsapi

bcrypt

ntdll

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 537KB - Virtual size: 537KB

.data Size: 31KB - Virtual size: 48KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0e:6b:c7:a9:46:49:bc:64:d8:79:c5:47:a2:63:64:ed
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0e:6b:c7:a9:46:49:bc:64:d8:79:c5:47:a2:63:64:ed
Certificate

01:9f:f6:ee:2c:0d:cc:87:da:85:2e:b3:e4:da:82:35:52:97:9b:55:bc:b0:31:f4:6e:81:b1:4f:06:a8:b4:2e
Signer

82:c6:1b:73:f2:d1:55:fb:48:e6:0a:20:21:b5:c1:4e:6b:90:54:74
Signer

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 537KB - Virtual size: 537KB

.data
Size: 31KB - Virtual size: 48KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB