GEARView[.]exe[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

GEARView.exe.7z
Size

24.2MB
MD5

704799edbe70f2f9ecae308917ab7201
SHA1

b8aa9edd1e3fab98c713ad712d22e8b905e34cd2
SHA256

74006d6067e6af1e534ba9895d21997ec9813e3d794603451f585374ed440ca6
SHA512

3eb47d514df6420c4b99d6dcfd491e5992d13b5a7352ffed25f4a052efd27f1f11e70ae4e27358bc32d6d61de9666d258b1aa1d8f4532e49ab07ea171f5dbdcb
SSDEEP

786432:VQelsIwlCM2jCDuS4lVV880y6tB0K37s5FpLN0u:1lsIoCYuS4lkfyoB0I7s7pB

Score

1^/10

Malware Config

Signatures

Files

GEARView.exe.7z
.7z

Password: infected
GEARView.exe
.exe windows:6 windows x64 arch:x64

b45408465410e69c955a96d2259342cc

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:c0:2e:5b:f9:83:90:c2:7b:23:15:ab:3a:cc:ce:ad
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/02/2021, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Hyland Software\, Inc.,OU=PACSGEAR,O=Hyland Software\, Inc.,L=Westlake,ST=Ohio,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:bb:55:eb:42:9c:2e:43:b5:44:08:f3:ec:e6:a0:62:d5:4c:a7:14:a7:c9:75:52:7d:e4:f2:5d:b9:e0:ac:0a
Signer

Actual PE Digest

1d:bb:55:eb:42:9c:2e:43:b5:44:08:f3:ec:e6:a0:62:d5:4c:a7:14:a7:c9:75:52:7d:e4:f2:5d:b9:e0:ac:0a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
GetModuleHandleW
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
OpenProcess
GetLastError
DuplicateHandle
GetCommandLineW
OpenFileMappingW
MapViewOfFile
SetEvent
UnmapViewOfFile
CloseHandle
GetVersionExW
GetSystemInfo
VirtualQuery
GetCommandLineA
CreateFileW
CreateFileMappingW
GetFileSizeEx
VirtualAlloc
VirtualFree
LoadLibraryW
ExitProcess
GetModuleHandleA
RtlAddFunctionTable

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xcpad
Size: - Virtual size: 1.0MB

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

b45408465410e69c955a96d2259342cc

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

07:c0:2e:5b:f9:83:90:c2:7b:23:15:ab:3a:cc:ce:adCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

1d:bb:55:eb:42:9c:2e:43:b5:44:08:f3:ec:e6:a0:62:d5:4c:a7:14:a7:c9:75:52:7d:e4:f2:5d:b9:e0:ac:0aSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 20KB - Virtual size: 20KB

.data Size: - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 420B

.idata Size: 1KB - Virtual size: 5KB

.xcpad Size: - Virtual size: 1.0MB

.rsrc Size: 106KB - Virtual size: 106KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

07:c0:2e:5b:f9:83:90:c2:7b:23:15:ab:3a:cc:ce:ad
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

1d:bb:55:eb:42:9c:2e:43:b5:44:08:f3:ec:e6:a0:62:d5:4c:a7:14:a7:c9:75:52:7d:e4:f2:5d:b9:e0:ac:0a
Signer

.text
Size: 20KB - Virtual size: 20KB

.data
Size: - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 420B

.idata
Size: 1KB - Virtual size: 5KB

.xcpad
Size: - Virtual size: 1.0MB

.rsrc
Size: 106KB - Virtual size: 106KB