c6_notepad@304557844@[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

c6_notepad@[email protected]
Size

4.8MB
MD5

0bb9b00e1aa6975334aea503c7781206
SHA1

55d6b3fad730e656cc75376d59d7e4304fbae76d
SHA256

7e271c039c4a81136a3fff7796a0bb14cdd676ca3095a3521b14f23d56d7a171
SHA512

f59dc1f9057387ffb8137660a1dba5877d9b170877f1535ccc6192822030311bd1b9c098c5d091a4e324856a6a283c07daf164a3761d9d1f748286a8f5a73d56
SSDEEP

98304:3FQHXyfbo+zUxGXT+G8bHq0yxf1CPL8pZr2kqic25WpOWmo5GiBNJMFB:3yXyfbocUxGXaG8bH4cPL8pZr2kqir5z

Score

1^/10

Malware Config

Signatures

Files

c6_notepad@[email protected]
.exe windows:5 windows x86 arch:x86

0716fba5565042e56be1e5302c0f0d30

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/01/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:3a:02:3f:9c:39:79:ad:96:67:fd:35:8d:f0:f8:60
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

13/09/2022, 00:00

Not After

12/09/2025, 23:59

Subject

SERIALNUMBER=91350203MA31JK140Q,CN=Xiamen liuxiaoyun Network Technology Co.\, Ltd,O=Xiamen liuxiaoyun Network Technology Co.\, Ltd,L=厦门市,ST=福建省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6b996e9878ce58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e7a68fe5bbbae79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

8c:13:eb:da:cb:21:39:64:e1:69:d6:76:af:34:e6:6d:e4:09:18:f3:fb:a0:a6:65:3c:8f:01:47:44:db:fc:15
Signer

Actual PE Digest

8c:13:eb:da:cb:21:39:64:e1:69:d6:76:af:34:e6:6d:e4:09:18:f3:fb:a0:a6:65:3c:8f:01:47:44:db:fc:15

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW
SHSetValueW

kernel32

GetCurrentDirectoryW
GetACP
MulDiv
SetFilePointer
SystemTimeToFileTime
LocalFileTimeToFileTime
GetLocalTime
InterlockedIncrement
InterlockedDecrement
SetEndOfFile
WriteConsoleW
GetTimeZoneInformation
PeekNamedPipe
FileTimeToLocalFileTime
FlushFileBuffers
UnregisterWaitEx
InitializeSListHead
ReleaseSemaphore
FreeLibraryAndExitThread
GetThreadTimes
VirtualProtect
VirtualFree
VirtualAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
SetFilePointerEx
ReadConsoleW
GetOEMCP
IsValidCodePage
GetConsoleMode
GetConsoleCP
GetFileType
GetStdHandle
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
CreateSemaphoreW
QueryPerformanceCounter
TerminateProcess
CreateEventW
UnhandledExceptionFilter
GetCPInfo
LoadLibraryExW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
CreateTimerQueue
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetThreadPriority
CreateThread
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
SetEvent
RtlUnwind
AreFileApisANSI
GetModuleHandleExW
IsProcessorFeaturePresent
HeapReAlloc
EncodePointer
GetExitCodeThread
DuplicateHandle
GetSystemTimeAsFileTime
GetStringTypeW
OutputDebugStringW
IsDebuggerPresent
MoveFileExA
GetEnvironmentVariableA
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrcmpiW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
HeapFree
GetProcessHeap
CreateFileA
GetFileSize
VerifyVersionInfoA
FormatMessageW
ExitThread
HeapAlloc
GetVolumeInformationA
GetComputerNameW
GetVersionExW
LocalFree
FreeLibrary
GetProcAddress
LoadLibraryW
GlobalFree
Sleep
GetDynamicTimeZoneInformation
CopyFileW
GetFileAttributesW
lstrcpynW
MoveFileA
lstrcpyW
lstrlenW
MultiByteToWideChar
GetLocaleInfoW
GetFileInformationByHandle
DeleteFileW
GetFileAttributesExW
GetFileSizeEx
GetTempPathW
CreateFileW
ReadFile
WriteFile
SetFileTime
CreateDirectoryW
GetDriveTypeW
GetFullPathNameW
WideCharToMultiByte
GetCommandLineW
SetUnhandledExceptionFilter
WaitForSingleObject
SetLastError
CreateProcessW
CreateMutexW
FreeResource
CloseHandle
GetCurrentProcessId
GlobalUnlock
GlobalLock
GlobalAlloc
ExitProcess
SizeofResource
LockResource
LoadResource
GetModuleHandleW
FindResourceW
VerifyVersionInfoW
VerSetConditionMask
FindClose
FindNextFileW
FindFirstFileW
SetProcessPriorityBoost
GetCurrentThread
SetThreadPriority
GetCurrentProcess
SetPriorityClass
GetEnvironmentVariableW
GetShortPathNameW
GetModuleFileNameW
GetCurrentThreadId
GetTickCount
DeleteCriticalSection
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
SetEnvironmentVariableA
GetStartupInfoW

user32

SetCaretPos
SetTimer
KillTimer
PostMessageW
GetParent
RegisterWindowMessageW
SetWindowTextW
ShowWindow
SendMessageW
GetCursorPos
MessageBoxW
PostQuitMessage
OpenClipboard
EmptyClipboard
CloseClipboard
SetClipboardData
FindWindowW
SetWindowLongW
GetWindowLongW
MoveWindow
wsprintfW
GetMessageW
TranslateMessage
DispatchMessageW
CreateWindowExW
IsWindow
DestroyWindow
SetWindowPos
IsWindowVisible
IsIconic
IsZoomed
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetWindowRect
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
UnionRect
OffsetRect
IsRectEmpty
PtInRect
GetWindow
LoadImageW
MapVirtualKeyExW
GetKeyNameTextW
LoadCursorW
DefWindowProcW
GetKeyboardLayout
GetGUIThreadInfo
MonitorFromWindow
GetMonitorInfoW
CallWindowProcW
RegisterClassW
RegisterClassExW
InflateRect
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
UpdateWindow
SetForegroundWindow
UpdateLayeredWindow
IsWindowEnabled
GetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
CreatePopupMenu
DestroyMenu
EnableMenuItem
SetCursor
AppendMenuW
SetWindowRgn
TrackPopupMenu
InvalidateRgn
CreateAcceleratorTableW
DrawTextA
wsprintfA
GetWindowTextLengthW
GetWindowTextW
EqualRect
ClientToScreen
GetCaretPos
CreateCaret
ShowCaret
HideCaret
GetCaretBlinkTime

gdi32

GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateDIBSection
PtInRegion
CreateRectRgn
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
LineTo
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
TextOutW
GdiFlush
CreatePatternBrush
GetTextExtentPointA
SetBitmapBits
SelectClipRgn
GetBitmapBits

advapi32

RegQueryValueExW
RegCloseKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW

shell32

DragQueryFileW
SHOpenFolderAndSelectItems
ShellExecuteA
ShellExecuteW
CommandLineToArgvW
ord155
ShellExecuteExW
SHChangeNotify
SHGetFolderPathW
ord190

ole32

CoInitializeEx
DoDragDrop
OleUninitialize
OleDuplicateData
ReleaseStgMedium
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
OleInitialize
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

gdiplus

GdipSetInterpolationMode
GdiplusShutdown
GdipAlloc
GdipFree
GdipCreatePath
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipDeletePath
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
ord1
GdipAddPathLine
GdiplusStartup

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

winmm

mciSendCommandW

iphlpapi

GetAdaptersInfo

ws2_32

freeaddrinfo
gethostbyname
getaddrinfo
ioctlsocket
listen
htonl
accept
select
__WSAFDIsSet
WSACleanup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
send
recv
closesocket
WSAStartup
gethostname
WSAGetLastError

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Exports

Exports

?CloseZipU@@YAKPAUHZIP__@@@Z
?FindZipItem@@YAKPAUHZIP__@@PB_W_NPAHPAUZIPENTRY@@@Z
?FormatZipMessageU@@YAIKPA_WI@Z
?GetZipItem@@YAKPAUHZIP__@@HPAUZIPENTRY@@@Z
?IsZipHandleU@@YA_NPAUHZIP__@@@Z
?OpenZip@@YAPAUHZIP__@@PAXIPBD@Z
?OpenZip@@YAPAUHZIP__@@PB_WPBD@Z
?OpenZipHandle@@YAPAUHZIP__@@PAXPBD@Z
?SetUnzipBaseDir@@YAKPAUHZIP__@@PB_W@Z
?UnzipItem@@YAKPAUHZIP__@@HPAXI@Z
?UnzipItem@@YAKPAUHZIP__@@HPB_W@Z
?UnzipItemHandle@@YAKPAUHZIP__@@HPAX@Z
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_version
curl_version_info

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 328KB - Virtual size: 327KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0716fba5565042e56be1e5302c0f0d30

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:3a:02:3f:9c:39:79:ad:96:67:fd:35:8d:f0:f8:60Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

8c:13:eb:da:cb:21:39:64:e1:69:d6:76:af:34:e6:6d:e4:09:18:f3:fb:a0:a6:65:3c:8f:01:47:44:db:fc:15Signer

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

gdiplus

imm32

winmm

iphlpapi

ws2_32

crypt32

version

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 328KB - Virtual size: 327KB

.data Size: 36KB - Virtual size: 65KB

.tls Size: 512B - Virtual size: 17B

.rsrc Size: 3.0MB - Virtual size: 3.0MB

.reloc Size: 73KB - Virtual size: 73KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:3a:02:3f:9c:39:79:ad:96:67:fd:35:8d:f0:f8:60
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

8c:13:eb:da:cb:21:39:64:e1:69:d6:76:af:34:e6:6d:e4:09:18:f3:fb:a0:a6:65:3c:8f:01:47:44:db:fc:15
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 328KB - Virtual size: 327KB

.data
Size: 36KB - Virtual size: 65KB

.tls
Size: 512B - Virtual size: 17B

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

.reloc
Size: 73KB - Virtual size: 73KB