be9580f74a02254c28227e1f337218167f9444f830c1cdd39405a21361d53d0b

Sharing

Copy URL Twitter E-mail

General

Target

be9580f74a02254c28227e1f337218167f9444f830c1cdd39405a21361d53d0b
Size

6.9MB
MD5

16ca6917464f0492907b4eb6ce40370f
SHA1

49cacb70020bc72766b1f0ed4eec0b92342c235d
SHA256

be9580f74a02254c28227e1f337218167f9444f830c1cdd39405a21361d53d0b
SHA512

daf72364737f92e86ca6561cacd03b917014cc75ec2eb7c3b8aa5dc14cb89535bb27a05b890de6c12f1e6cb73ebdf8780157ca3e4de5f263b506f530a93f7ccb
SSDEEP

98304:PmB5UKd5F8jwxjPeutO0Lfg9MDsEfpqK6jNbJr/d+a7x/6P6MssjCgpUhQnhWgiU:PmB1dXxjPdO0M2rpEZ//x//VsjeMJ

Score

1^/10

Malware Config

Signatures

Files

be9580f74a02254c28227e1f337218167f9444f830c1cdd39405a21361d53d0b
.exe windows:5 windows x86

450bb1fbb4effde3b036914d2b595d0f

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:b4:34:d4:1f:10:44:2b:ab:40:bb:81:0c:b5:cc:f1
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

07/06/2023, 00:00

Not After

06/06/2024, 23:59

Subject

CN=Intel Corporation,O=Intel Corporation,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

98:3e:b6:4d:9e:b3:5b:4f:40:96:81:db:03:91:3d:75:8b:b1:64:0c:c1:b7:c4:75:b6:62:cb:9b:13:61:89:30
Signer

Actual PE Digest

98:3e:b6:4d:9e:b3:5b:4f:40:96:81:db:03:91:3d:75:8b:b1:64:0c:c1:b7:c4:75:b6:62:cb:9b:13:61:89:30

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
LoadLibraryExW
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
WritePrivateProfileStructW
LocalFileTimeToFileTime
GetCurrentProcessId
SetErrorMode
FlushViewOfFile
CreateMutexW
CreateFileMappingW
FindFirstFileW
InterlockedDecrement
GetModuleFileNameW
VirtualAllocEx
VirtualFreeEx
ReadProcessMemory
CreateIoCompletionPort
GetQueuedCompletionStatus
ResumeThread
CreateProcessW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
CreateRemoteThread
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
HeapAlloc
HeapFree
GetProcessHeap
lstrcatW
GetTempFileNameW
OpenMutexW
GetCurrentThreadId
VirtualProtect
WaitForMultipleObjects
GetSystemTime
InterlockedPopEntrySList
FlushFileBuffers
MultiByteToWideChar
GetDriveTypeW
GetExitCodeProcess
GetFileAttributesW
MoveFileExW
OutputDebugStringW
VirtualAlloc
MoveFileW
SetFileTime
WriteConsoleW
GetFileTime
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetCurrentThread
FreeLibraryAndExitThread
ExitThread
ReadConsoleW
GetConsoleMode
GetConsoleCP
SetStdHandle
GetFileType
lstrcpynW
SetEnvironmentVariableA
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RaiseException
ReplaceFileA
MoveFileA
SetFilePointerEx
RemoveDirectoryA
GetFileAttributesExA
FindNextFileA
FindFirstFileA
CreateDirectoryA
InitializeCriticalSection
AreFileApisANSI
HeapCreate
InterlockedCompareExchange
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
LoadLibraryA
GetVersionExA
HeapReAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSizeEx
SetFileAttributesW
FormatMessageW
SystemTimeToFileTime
FreeEnvironmentStringsW
OutputDebugStringA
GetComputerNameW
GetFullPathNameW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetLongPathNameW
QueryPerformanceFrequency
QueryPerformanceCounter
RemoveDirectoryW
QueryDosDeviceW
LoadLibraryW
GetLogicalDriveStringsW
DuplicateHandle
TerminateThread
FreeLibrary
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFree
LocalAlloc
GetSystemInfo
GetProcAddress
FindFirstFileExW
SetFilePointer
SetEndOfFile
DeleteFileW
ReadFile
GetFileSize
WideCharToMultiByte
DeleteFileA
CreateFileA
WriteFile
SetLastError
GetVolumeInformationW
FindNextFileW
lstrcmpW
FindClose
FormatMessageA
UnmapViewOfFile
SetVolumeLabelW
GetTempPathW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
LCMapStringW
UnregisterWaitEx
QueryDepthSList
ReleaseSemaphore
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
CompareStringW
GetTickCount
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
DecodePointer
EncodePointer
GetStringTypeW
GetNumberFormatW
FindResourceW
SizeofResource
LoadResource
LockResource
GetModuleHandleA
GetLogicalDrives
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
OpenFileMappingW
MapViewOfFile
CreateFileW
DeviceIoControl
TerminateProcess
OpenProcess
GetVersionExW
CreateDirectoryW
CreateEventW
lstrlenW
GetLocalTime
CloseHandle
Sleep
WaitForSingleObject
ResetEvent
SetEvent
GetLastError
CreateThread
SetPriorityClass
SetThreadPriority
GetCurrentProcess
FlushInstructionCache
LoadLibraryExA
CreateTimerQueue
SignalObjectAndWait
SwitchToThread

user32

DefWindowProcW
RegisterClassExW
CreateWindowExW
IsIconic
SetTimer
KillTimer
RegisterWindowMessageW
EnableMenuItem
SetMenuDefaultItem
SetActiveWindow
PtInRect
TrackMouseEvent
SetCapture
GetClipboardData
CloseClipboard
OpenClipboard
SetCursor
GetSystemMetrics
SystemParametersInfoW
ReleaseDC
GetDC
LoadCursorW
GetWindowThreadProcessId
ExitWindowsEx
EmptyClipboard
EnumDisplaySettingsW
EnumDisplayDevicesW
DestroyMenu
GetKeyState
SetForegroundWindow
GetWindowRect
GetCursorPos
GetWindowLongW
SetWindowLongW
ReleaseCapture
ClientToScreen
UnregisterClassW
UpdateLayeredWindow
GetMenuStringW
FindWindowW
DestroyIcon
LoadStringW
wsprintfW
DestroyWindow
mouse_event
ShowCursor
SetCursorPos
GetActiveWindow
ShowWindow
FindWindowExW
SendMessageTimeoutW
GetPropW
GetDesktopWindow
GetSystemMenu
CreatePopupMenu
AppendMenuW
TrackPopupMenu
BeginPaint
EndPaint
SetClipboardData
LoadIconW
SetPropW
DispatchMessageW
TranslateMessage
GetClassNameW
EnumWindows
EnumChildWindows
GetParent
IsWindowVisible
IsWindow
SendMessageW
PeekMessageW
MoveWindow
IsWindowEnabled
EnableWindow
EndDialog
IsZoomed
SetWindowPlacement
GetWindowPlacement
UnregisterHotKey
RegisterHotKey
SetFocus
GetWindow
GetIconInfo
SetWindowPos
PostQuitMessage
GetMessageW
MessageBoxW
PostMessageW

gdi32

CreateCompatibleDC
GetObjectW
DeleteObject
EnumFontFamiliesW
SelectObject
CreateDIBSection
DeleteDC

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

AllocateAndInitializeSid
CryptReleaseContext
CryptAcquireContextA
DuplicateTokenEx
CreateProcessAsUserW
EqualSid
SetTokenInformation
CredEnumerateW
CredDeleteW
CredFree
RegCloseKey
RegCreateKeyW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegSetValueExW
RegEnumKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegOpenKeyW
RegCreateKeyExW
RegEnumKeyExW
OpenEventLogW
CloseEventLog
ClearEventLogW
GetUserNameW
GetTokenInformation
RegSetKeySecurity
RegGetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAce
InitializeAcl
GetLengthSid
FreeSid
CryptGenRandom
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
ConvertStringSidToSidW
RegUnLoadKeyW
RegLoadKeyW
LookupPrivilegeValueW
LookupAccountNameW
AdjustTokenPrivileges
OpenProcessToken
RegDeleteKeyW

shell32

ShellExecuteW
ShellExecuteExW
SHEmptyRecycleBinW
SHBrowseForFolderW
SHFileOperationW
SHGetDesktopFolder
SHGetPathFromIDListW
DragQueryFileW
SHGetFolderPathW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHAddToRecentDocs
ExtractIconExW
SHGetFileInfoW

ole32

StgIsStorageFile
StgOpenStorageEx
CoSetProxyBlanket
CoInitialize
OleRegGetUserType
CLSIDFromString
OleUninitialize
OleInitialize
PropVariantClear
CoTaskMemFree
CreateStreamOnHGlobal
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize

oleaut32

VariantClear
VariantInit
VariantTimeToSystemTime
SysFreeString
SysAllocString

gdiplus

GdipAlloc
GdipFree
GdipCreatePath
GdipDeleteBrush
GdipCreatePathGradientFromPath
GdipDeletePath
GdipCloneBrush
GdipResetPath
GdiplusStartup
GdipSetPenDashStyle
GdipDeletePen
GdipCreatePen1
GdipSetTextRenderingHint
GdipMeasureString
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipClosePathFigure
GdipAddPathPolygonI
GdipGetFontHeightGivenDPI
GdipSetPenDashArray
GdipCreateTexture
GdipCreateSolidFill
GdipCreateLineBrushI
GdipDrawString
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipDeleteFont
GdipCreateRegion
GdipGetImageHeight
GdipDrawImageI
GdipBitmapSetResolution
GdipCreateBitmapFromScan0
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipAddPathRectangleI
GdipAddPathLineI
GdipAddPathArcI
GdipCreateLineBrush
GdipDrawImageRectRectI
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipSetImageAttributesGamma
GdipSetSmoothingMode
GdipSetWorldTransform
GdipTranslateWorldTransform
GdipGetDpiX
GdipGetDpiY
GdipDrawLine
GdipDrawRectangle
GdipGraphicsClear
GdipFillRectangle
GdipFillRectangleI
GdipFillPath
GdipDrawImage
GdipDrawImageRect
GdipDrawImagePointRectI
GdipDrawImageRectRect
GdipSetClipRectI
GdipSetClipPath
GdipSetClipRegion
GdipGetClip
GdipGetRegionBounds
GdipGetRegionScansCount
GdipGetRegionScansI
GdipMeasureCharacterRanges
GdipCloneStringFormat
GdipSetStringFormatTabStops
GdipSetStringFormatMeasurableCharacterRanges
GdipSetPenColor
GdipGetImagePixelFormat
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipSetPathGradientFocusScales
GdipSetPathGradientPresetBlend
GdipGetImageWidth
GdipDeleteRegion
GdipAddPathPieI

sfc

SfcIsFileProtected

ntdll

NtTerminateProcess
NtWriteVirtualMemory

esent

JetMove
JetRetrieveColumn
JetTerm
JetDelete
JetCloseTable
JetCloseDatabase
JetEndSession
JetInit2

wininet

InternetOpenUrlW
InternetReadFileExA
InternetReadFileExW
InternetSetStatusCallbackW
HttpQueryInfoW
InternetCloseHandle
InternetGetConnectedState
DeleteUrlCacheEntryW
FindFirstUrlCacheEntryExW
FindNextUrlCacheEntryExW
FindCloseUrlCache
InternetOpenW
InternetCheckConnectionW

crypt32

CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptQueryObject
CryptMsgClose
CryptDecodeObject
CryptMsgGetParam

netapi32

NetUserEnum
NetApiBufferFree

shlwapi

SHDeleteValueW
SHDeleteKeyW
PathGetDriveNumberW
PathCanonicalizeW
PathIsNetworkPathW
PathFindExtensionW
PathIsRelativeW
SHStrDupW
PathMatchSpecA
PathStripPathW
PathMatchSpecW
PathFileExistsW
PathIsDirectoryW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

comctl32

InitCommonControlsEx

psapi

EnumProcesses
GetModuleFileNameExW
GetProcessImageFileNameW
EnumProcessModules

winmm

timeGetTime

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 820KB - Virtual size: 819KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 107KB - Virtual size: 451KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

450bb1fbb4effde3b036914d2b595d0f

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

d4:b4:34:d4:1f:10:44:2b:ab:40:bb:81:0c:b5:cc:f1Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

98:3e:b6:4d:9e:b3:5b:4f:40:96:81:db:03:91:3d:75:8b:b1:64:0c:c1:b7:c4:75:b6:62:cb:9b:13:61:89:30Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

gdiplus

sfc

ntdll

esent

wininet

crypt32

netapi32

shlwapi

version

comctl32

psapi

winmm

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 820KB - Virtual size: 819KB

.data Size: 107KB - Virtual size: 451KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 3.3MB - Virtual size: 3.3MB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

d4:b4:34:d4:1f:10:44:2b:ab:40:bb:81:0c:b5:cc:f1
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

98:3e:b6:4d:9e:b3:5b:4f:40:96:81:db:03:91:3d:75:8b:b1:64:0c:c1:b7:c4:75:b6:62:cb:9b:13:61:89:30
Signer

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 820KB - Virtual size: 819KB

.data
Size: 107KB - Virtual size: 451KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 3.3MB - Virtual size: 3.3MB