ilasm[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ilasm.exe
Size

289KB
MD5

f7ea88eb86ca772cdcd686940550cea9
SHA1

f853dc058ff441c0a6232e67c86deb3182a77abd
SHA256

3a606481bd44d51cb29348b4535096a4c0f07a576c71dff289732e0083875f86
SHA512

a01b886262bdbaa99e4d2226d297cd64f68e0dc0d6179f4b8fac55019ceed0b177a770614f793dc9751e4db46b0533b08ebd5553e1359bddc2dc63b9800df046
SSDEEP

6144:UDEKlZshDYTPO5IwZLzTBA5N5LSaxl/M2DKQpOaoF:Utt7O5IwXWN5eoDKQwaq

Score

1^/10

Malware Config

Signatures

Files

ilasm.exe
.exe windows:6 windows x86

0b5c4898c90b69f69dcff91a859a84cb

Code Sign

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/03/2016, 19:21

Not After

30/06/2017, 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:ce:3c:22:9e:62:7a:3c:e6:b6:f1:d4:b8:d6:86:5f:da:04:32:67:16:b1:c2:06:fe:ce:66:39:c6:b8:83:ef
Signer

Actual PE Digest

8f:ce:3c:22:9e:62:7a:3c:e6:b6:f1:d4:b8:d6:86:5f:da:04:32:67:16:b1:c2:06:fe:ce:66:39:c6:b8:83:ef

Digest Algorithm

sha256

PE Digest Matches

true

0a:99:30:4a:0e:81:c9:68:a6:c2:bb:75:69:6a:1a:bd:4f:8f:23:e0
Signer

Actual PE Digest

0a:99:30:4a:0e:81:c9:68:a6:c2:bb:75:69:6a:1a:bd:4f:8f:23:e0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
IsTextUnicode
EventWrite

kernel32

SetEnvironmentVariableW
GetEnvironmentVariableW
GetBinaryTypeA
DeleteFileW
SearchPathW
GetStdHandle
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcessId
LocalFree
GetACP
FormatMessageW
GetCPInfo
TlsFree
TlsAlloc
GetConsoleOutputCP
DeleteCriticalSection
VirtualProtect
CreateEventW
CreateSemaphoreW
ResetEvent
EnterCriticalSection
VirtualAlloc
RaiseException
ReleaseSemaphore
HeapValidate
HeapCreate
LeaveCriticalSection
HeapDestroy
TlsSetValue
InitializeCriticalSection
VirtualFree
WaitForSingleObjectEx
SleepEx
SetEvent
VirtualQuery
TlsGetValue
CreateMutexW
GetModuleFileNameW
GetProcessHeap
HeapFree
HeapAlloc
HeapSetInformation
GetFullPathNameW
ReadFile
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
SetLastError
CreateFileW
GetTickCount
WideCharToMultiByte
SwitchToThread
LoadLibraryExW
FreeLibrary
QueryPerformanceCounter
IsProcessorFeaturePresent
DecodePointer
GetProcAddress
EncodePointer
GetLastError
MultiByteToWideChar
ReleaseMutex

msvcr120_clr0400

memset
_CxxThrowException
__CxxFrameHandler3
memcmp
memcpy
_except_handler4_common
_invoke_watson
__crtSetUnhandledExceptionFilter
??1type_info@@UAE@XZ
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
__winitenv
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_vsnwprintf_s
_errno
malloc
free
_vsnprintf_s
isspace
wcstod
strtod
_mbsinc
memmove
_purecall
swscanf_s
_wcsicmp
_stricmp
exit
wcschr
_vsnwprintf
fwrite
_wfopen_s
fclose
fread
fopen_s
atoi
wcsrchr
iswupper
iswdigit
iswxdigit
strchr
wcscat_s
printf
strrchr
wcsstr
sprintf_s
strcat_s
strcpy_s
__iob_func
fprintf
wcscpy_s
wcsncpy_s
_controlfp_s

fusion

CreateAssemblyNameObject
CreateAssemblyEnum

mscoree

GetRequestedRuntimeInfo
LoadLibraryShim

ole32

CoCreateGuid
CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

SysFreeString
SetErrorInfo
SysAllocString

user32

LoadStringW

Sections

.text
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b5c4898c90b69f69dcff91a859a84cb

Code Sign

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9bCertificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

8f:ce:3c:22:9e:62:7a:3c:e6:b6:f1:d4:b8:d6:86:5f:da:04:32:67:16:b1:c2:06:fe:ce:66:39:c6:b8:83:efSigner

0a:99:30:4a:0e:81:c9:68:a6:c2:bb:75:69:6a:1a:bd:4f:8f:23:e0Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcr120_clr0400

fusion

mscoree

ole32

oleaut32

user32

Sections

.text Size: 240KB - Virtual size: 240KB

.data Size: 11KB - Virtual size: 3.1MB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 15KB

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

8f:ce:3c:22:9e:62:7a:3c:e6:b6:f1:d4:b8:d6:86:5f:da:04:32:67:16:b1:c2:06:fe:ce:66:39:c6:b8:83:ef
Signer

0a:99:30:4a:0e:81:c9:68:a6:c2:bb:75:69:6a:1a:bd:4f:8f:23:e0
Signer

.text
Size: 240KB - Virtual size: 240KB

.data
Size: 11KB - Virtual size: 3.1MB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 15KB