c41566e17471f98cde94b665480e949b854c0e6a97ef3989aca6daaa051ee89a

Sharing

Copy URL Twitter E-mail

General

Target

c41566e17471f98cde94b665480e949b854c0e6a97ef3989aca6daaa051ee89a
Size

481KB
MD5

1bc4dc0937d5588a6628e6ba97fab1af
SHA1

0126bee6014ea737970fdfb1442f67b4474694c5
SHA256

c41566e17471f98cde94b665480e949b854c0e6a97ef3989aca6daaa051ee89a
SHA512

1f9fe81f36bbe65152a1b793e07aa0469a3a1a32617b347ae280dc27f947c61de14e290dd26eeec85f0edd74130eb0a2da0a9673b3a4ffdfc54614bb0f4e204c
SSDEEP

6144:TnDTY5xi183qrsq8e14z8+cUHyYnwgYvSwSXccEqUmjvtxvkuzF2LDlDEcf:3uw1BsqdUHyOvYvSwSZEqnzvkuOf

Score

1^/10

Malware Config

Signatures

Files

c41566e17471f98cde94b665480e949b854c0e6a97ef3989aca6daaa051ee89a
.exe windows:6 windows x86 arch:x86

ce73b0653f542b947e80dd60bb4b1c52

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:fe:70:cd:7b:a9:e2:fe:aa:24:00:14:5c:d3:c0:95:5e:c1:a1:be:59:0a:ce:73:22:30:7c:d4:c1:2d:6b:3c
Signer

Actual PE Digest

7a:fe:70:cd:7b:a9:e2:fe:aa:24:00:14:5c:d3:c0:95:5e:c1:a1:be:59:0a:ce:73:22:30:7c:d4:c1:2d:6b:3c

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsAlloc
InitOnceComplete
TlsFree
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
GetProcAddress
MultiByteToWideChar
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
GetCurrentProcessId
ReleaseMutex
GetEnvironmentVariableW
GetTempPathW
GetFileInformationByHandle
InitOnceBeginInitialize
GetFullPathNameW
SetFilePointerEx
FindNextFileW
CreateThread
InitializeSListHead
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
GetModuleHandleA
IsDebuggerPresent
UnhandledExceptionFilter
Process32NextW
GetFileInformationByHandleEx
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
K32GetModuleFileNameExW
OpenProcess
FormatMessageW
MoveFileExW
CreateFileW
SetFileInformationByHandle
WaitForSingleObject
FindFirstFileW
SetUnhandledExceptionFilter
GetModuleHandleW
SwitchToThread
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
HeapReAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetCurrentThread
TlsSetValue
TlsGetValue
GetModuleFileNameW
GetCommandLineW
GetCurrentThreadId
Sleep
GetLastError
SetLastError
HeapAlloc
GetProcessHeap
CloseHandle
DuplicateHandle
HeapFree
CreateMutexA
FindClose
IsProcessorFeaturePresent

user32

ShutdownBlockReasonCreate
MessageBoxW
SendDlgItemMessageW
GetDesktopWindow
GetWindowRect
SetWindowPos
ShutdownBlockReasonDestroy
ShowWindow
DialogBoxParamW
PostThreadMessageW

bcrypt

BCryptGenRandom

ntdll

RtlNtStatusToDosError
NtReadFile
NtWriteFile
NtCreateFile

advapi32

SystemFunction036

vcruntime140

_except_handler4_common
__current_exception_context
__current_exception
__CxxFrameHandler3
memmove
memset
memcmp
memcpy

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
_crt_atexit
__p___argv
_controlfp_s
terminate
_cexit
_c_exit
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_register_onexit_function

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce73b0653f542b947e80dd60bb4b1c52

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4dCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

7a:fe:70:cd:7b:a9:e2:fe:aa:24:00:14:5c:d3:c0:95:5e:c1:a1:be:59:0a:ce:73:22:30:7c:d4:c1:2d:6b:3cSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

bcrypt

ntdll

advapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 340KB - Virtual size: 339KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 11KB - Virtual size: 14KB

.rsrc Size: 52KB - Virtual size: 52KB

.reloc Size: 18KB - Virtual size: 17KB

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

7a:fe:70:cd:7b:a9:e2:fe:aa:24:00:14:5c:d3:c0:95:5e:c1:a1:be:59:0a:ce:73:22:30:7c:d4:c1:2d:6b:3c
Signer

.text
Size: 340KB - Virtual size: 339KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 11KB - Virtual size: 14KB

.rsrc
Size: 52KB - Virtual size: 52KB

.reloc
Size: 18KB - Virtual size: 17KB