81cd6e1c6e1f9400e31b122dfa2c7acf274192ec560a9d29190a70abd04b20e2

Sharing

Copy URL

Twitter E-mail

General

Target

81cd6e1c6e1f9400e31b122dfa2c7acf274192ec560a9d29190a70abd04b20e2
Size

837KB
MD5

b458e336911f092177a64d07b0bf1c76
SHA1

53c66117a6f17e2d76b7a8a658f1ff0773516081
SHA256

81cd6e1c6e1f9400e31b122dfa2c7acf274192ec560a9d29190a70abd04b20e2
SHA512

2b19cd8e173543449711bbb5f829096688ef688240a68a2021b622ccbdbad53559e171d38b161f71c9585ed58e0871b6fc7d98dc52bd4e36f3435fd11e8621c4
SSDEEP

24576:8II1yp0tk0TdMil1iD5Fk8C1LGF6KXcA9:VS1k0JleFk82CF5d

Score

1^/10

Malware Config

Signatures

Files

81cd6e1c6e1f9400e31b122dfa2c7acf274192ec560a9d29190a70abd04b20e2
.exe windows:6 windows x64

1d47a62ab0b7adbbbb8c411088759e3c

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:f7:70:0c:8c:15:0f:df:fb:de:8a:f6:29:d3:60:0f
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

22-08-2022 00:00

Not After

22-08-2023 23:59

Subject

CN=Kamiesha Mason,O=Kamiesha Mason,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5f:2b:22:1a:31:d0:b5:68:79:68:52:c2:b6:fd:8f:2d:08:ce:58:8c:70:11:61:ec:6c:d4:3a:b9:cb:2c:47:78
Signer

Actual PE Digest

5f:2b:22:1a:31:d0:b5:68:79:68:52:c2:b6:fd:8f:2d:08:ce:58:8c:70:11:61:ec:6c:d4:3a:b9:cb:2c:47:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
QueryPerformanceFrequency
WaitForSingleObjectEx
Sleep
GetExitCodeThread
EncodePointer
DecodePointer
LCMapStringEx
GetProcAddress
GetStringTypeW
GetCPInfo
GetLastError
SleepEx
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
SetUnhandledExceptionFilter
GetTickCount
SetLastError
FormatMessageW
MoveFileExA
GetEnvironmentVariableA
GetStdHandle
GetFileType
WaitForMultipleObjects
VerifyVersionInfoA
CreateFileA
GetFileSizeEx
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
WriteFile
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointerEx
HeapFree
HeapAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapReAlloc
GetTimeZoneInformation
GetFileAttributesExW
SetEndOfFile
GetCurrentDirectoryW
GetFullPathNameW
HeapSize
WriteConsoleW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentProcess
RtlUnwind
VerifyVersionInfoW
CreateProcessW
GetComputerNameW
VerSetConditionMask
CloseHandle
WaitForSingleObject
PeekNamedPipe
CreatePipe
TerminateProcess
ReadFile
GetStartupInfoW
WideCharToMultiByte
LoadLibraryA
MultiByteToWideChar
DeleteFileW

advapi32

CryptHashData
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
GetUserNameW
CryptAcquireContextA
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptImportKey

ws2_32

send
WSACloseEvent
WSACreateEvent
WSAStartup
WSACleanup
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
recv
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
gethostname
ntohl
WSAEnumNetworkEvents

winhttp

WinHttpGetIEProxyConfigForCurrentUser

crypt32

CertEnumCertificatesInStore
CertFindCertificateInStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertFindExtension
CertAddCertificateContextToStore

normaliz

IdnToAscii

wldap32

ord301
ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200

Sections

.text
Size: 622KB - Virtual size: 621KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d47a62ab0b7adbbbb8c411088759e3c

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

d8:f7:70:0c:8c:15:0f:df:fb:de:8a:f6:29:d3:60:0fCertificate

Extended Key Usages

Key Usages

5f:2b:22:1a:31:d0:b5:68:79:68:52:c2:b6:fd:8f:2d:08:ce:58:8c:70:11:61:ec:6c:d4:3a:b9:cb:2c:47:78Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ws2_32

winhttp

crypt32

normaliz

wldap32

Sections

.text Size: 622KB - Virtual size: 621KB

.rdata Size: 167KB - Virtual size: 166KB

.data Size: 8KB - Virtual size: 15KB

.pdata Size: 29KB - Virtual size: 29KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 4KB - Virtual size: 3KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

d8:f7:70:0c:8c:15:0f:df:fb:de:8a:f6:29:d3:60:0f
Certificate

5f:2b:22:1a:31:d0:b5:68:79:68:52:c2:b6:fd:8f:2d:08:ce:58:8c:70:11:61:ec:6c:d4:3a:b9:cb:2c:47:78
Signer

.text
Size: 622KB - Virtual size: 621KB

.rdata
Size: 167KB - Virtual size: 166KB

.data
Size: 8KB - Virtual size: 15KB

.pdata
Size: 29KB - Virtual size: 29KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 3KB