iscanruntime[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

iscanruntime.exe
Size

2.5MB
MD5

8ff3eeac7c0327b39bc90bc34f26ebdb
SHA1

7f533541bdd0d72256bff15c7c5feb5f57e09cb8
SHA256

d082b9ab3805890902f739b168f5e13df81ebf195ba7939260cac508f40a8037
SHA512

7034bbe03caff6fb227e0fa3532b57c3e5eaa19620da308d23df99496edc6f4b8a34eb9b1c80575be11e91a948329068ca21d11e85163fcdfb72bca729e789be
SSDEEP

49152:EQE5zALM7Wgh++V5sw87YdjQ/0D3dPYkzDBAgTU8GfL8Cij:Ev5zALDgw+Ts4YkzDBAtICM

Score

1^/10

Malware Config

Signatures

Files

iscanruntime.exe
.exe windows:5 windows x86 arch:x86

2b58a9df4483c221f50af2bcf0d6d20b

Code Sign

01:10:3c:ab:55:cb:01:90:72:31:76:6b:7d:f7:ae:bc
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-03-2021 00:00

Not After

29-03-2024 23:59

Subject

CN=N-ABLE TECHNOLOGIES LTD,O=N-ABLE TECHNOLOGIES LTD,L=Dundee,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11-05-2022 00:00

Not After

10-08-2033 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:2e:ac:f6:53:d8:e5:02:a4:a5:b0:ca:1d:17:91:32:56:55:f6:e8:11:0c:4f:57:34:76:cc:80:c4:6b:d8:bf
Signer

Actual PE Digest

46:2e:ac:f6:53:d8:e5:02:a4:a5:b0:ca:1d:17:91:32:56:55:f6:e8:11:0c:4f:57:34:76:cc:80:c4:6b:d8:bf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetConsoleCtrlHandler
SetEvent
GetLastError
FormatMessageA
LocalFree
Sleep
CreateFileA
LockFileEx
UnlockFileEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
FreeLibrary
GetProcAddress
LoadLibraryA
CreateProcessA
CreateSemaphoreA
ReleaseSemaphore
LocalSize
LocalAlloc
lstrlenA
MultiByteToWideChar
DuplicateHandle
GetCurrentProcess
lstrcpyW
lstrcmpA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetThreadContext
RtlCaptureContext
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
VirtualQueryEx
InitializeCriticalSection
LoadLibraryW
TerminateThread
LeaveCriticalSection
CreateFileW
EnterCriticalSection
OpenThread
CreateSemaphoreW
GetProcessId
DeleteCriticalSection
GetCurrentThreadId
SuspendThread
ResumeThread
CreateThread
WaitNamedPipeW
WriteFile
TransactNamedPipe
ResetEvent
SetNamedPipeHandleState
WaitForMultipleObjects
GetCurrentProcessId
UnregisterWait
CreateMutexW
ConnectNamedPipe
CreateNamedPipeW
ReadFile
GetOverlappedResult
DisconnectNamedPipe
RegisterWaitForSingleObject
CreateEventW
ReleaseMutex
UnregisterWaitEx
GetProcessTimes
OpenProcess
ReadProcessMemory
GetSystemTime
WideCharToMultiByte
GetNativeSystemInfo
GetModuleHandleA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
SetLastError
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
SleepEx
GetTickCount
ExpandEnvironmentStringsA
PeekNamedPipe
GetFileType
GetStdHandle
GetFileSizeEx
GetVersion
GlobalMemoryStatus
FlushConsoleInputBuffer
SetEndOfFile
SetFilePointerEx
FindClose
RemoveDirectoryW
DeleteFileW
DeviceIoControl
GetFullPathNameW
GetFileAttributesW
CreateDirectoryExW
CopyFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFileInformationByHandle
GetFileAttributesExW
GetFileTime
SetFileTime
SetFileAttributesW
MoveFileExW
GetDiskFreeSpaceExW
FindFirstFileW
FindNextFileW
FormatMessageW
GetEnvironmentVariableW
CreateDirectoryW
GetWindowsDirectoryW
GetModuleHandleW
AreFileApisANSI
InterlockedCompareExchange
HeapFree
GetProcessHeap
TlsAlloc
TlsFree
TlsGetValue
SetWaitableTimer
WaitForMultipleObjectsEx
CreateWaitableTimerA
OpenEventA
InterlockedExchange
TlsSetValue
HeapAlloc
GetLogicalProcessorInformation
InterlockedExchangeAdd
GetLocaleInfoA
EnumSystemLocalesA
IsDBCSLeadByteEx
IsValidCodePage
GetLocaleInfoW
GetDateFormatW
GetTimeFormatW
GetCurrencyFormatW
CompareStringW
LCMapStringW
FoldStringW
GetStringTypeW
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetCommandLineA
HeapSetInformation
DeleteFileA
CreateDirectoryA
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
ExitProcess
SetFilePointer
HeapReAlloc
GetDriveTypeA
FindFirstFileExA
ExitThread
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetCPInfo
GetTimeFormatA
GetDateFormatA
IsProcessorFeaturePresent
GetModuleFileNameW
GetCurrentThread
HeapCreate
HeapDestroy
HeapSize
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
FatalAppExitA
GetConsoleCP
FlushFileBuffers
GetACP
GetOEMCP
SetStdHandle
GetFullPathNameA
GetTimeZoneInformation
GetUserDefaultLCID
IsValidLocale
WriteConsoleW
GetDriveTypeW
SetEnvironmentVariableA
GetSystemInfo
CloseHandle
GetVersionExA
CreateEventA
GetFileAttributesA

advapi32

DeregisterEventSource
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptGetHashParam
CryptHashData
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptCreateHash
CryptDestroyKey
CryptEncrypt
CryptImportKey
GetUserNameA
ReportEventA
RegisterEventSourceA

wininet

HttpOpenRequestW
InternetQueryDataAvailable
InternetCrackUrlW
InternetReadFile
InternetConnectW
HttpSendRequestW
InternetSetOptionW
HttpAddRequestHeadersW
InternetCloseHandle
InternetOpenW
HttpQueryInfoW

wintrust

WinVerifyTrust

crypt32

CryptStringToBinaryA
CertOpenStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertGetCertificateChain
CertGetNameStringA
CryptDecodeObject
CertFreeCertificateContext
CryptMsgClose
CertCloseStore
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CertCreateCertificateChainEngine

ws2_32

WSACleanup
gethostbyname
WSAGetLastError
gethostname
WSAStartup
WSASetLastError
__WSAFDIsSet
select
socket
closesocket
send
recv
WSAIoctl
setsockopt
getsockname
ntohs
bind
htons
getsockopt
getpeername
connect
freeaddrinfo
getaddrinfo
accept
listen
htonl
sendto
recvfrom
ioctlsocket
ntohl
WSAAddressToStringA

netapi32

NetWkstaGetInfo
NetApiBufferFree

iphlpapi

GetIpAddrTable
GetIfEntry
GetAdaptersAddresses

psapi

GetProcessMemoryInfo

normaliz

IdnToAscii
IdnToUnicode

user32

MessageBoxA
MessageBoxW
GetDesktopWindow
GetSystemMetrics
GetUserObjectInformationW
GetProcessWindowStation

gdi32

SelectObject
GetObjectA
DeleteObject
BitBlt
GetBitmapBits
DeleteDC
CreateCompatibleBitmap
CreateDCA
GetDeviceCaps
CreateCompatibleDC

wldap32

ord46
ord41
ord22
ord143
ord211
ord45
ord60
ord27
ord301
ord217
ord79
ord35
ord32
ord200
ord30
ord26
ord50
ord33

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 379KB - Virtual size: 378KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b58a9df4483c221f50af2bcf0d6d20b

Code Sign

01:10:3c:ab:55:cb:01:90:72:31:76:6b:7d:f7:ae:bcCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

46:2e:ac:f6:53:d8:e5:02:a4:a5:b0:ca:1d:17:91:32:56:55:f6:e8:11:0c:4f:57:34:76:cc:80:c4:6b:d8:bfSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

wininet

wintrust

crypt32

ws2_32

netapi32

iphlpapi

psapi

normaliz

user32

gdi32

wldap32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 379KB - Virtual size: 378KB

.data Size: 39KB - Virtual size: 56KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 101KB - Virtual size: 100KB

01:10:3c:ab:55:cb:01:90:72:31:76:6b:7d:f7:ae:bc
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

46:2e:ac:f6:53:d8:e5:02:a4:a5:b0:ca:1d:17:91:32:56:55:f6:e8:11:0c:4f:57:34:76:cc:80:c4:6b:d8:bf
Signer

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 379KB - Virtual size: 378KB

.data
Size: 39KB - Virtual size: 56KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 101KB - Virtual size: 100KB