f7092de5f32c0df837fa7f947a3424af

Sharing

Copy URL Twitter E-mail

General

Target

f7092de5f32c0df837fa7f947a3424af
Size

29KB
MD5

f7092de5f32c0df837fa7f947a3424af
SHA1

acc8123288c20b1c4ae67ef4f2b4028d9153239c
SHA256

97adb1700858b74f456f5cf681b0421d0be50e3aed1adea3d1b9694295723700
SHA512

f10d5c86a85d3d8be56fb5066fddd0474c71a36f280f475f4e3d6cc939718647f493665c4c9ea00c3d60f22f172019e2082c7090b54f730d02701f1cb3d34164
SSDEEP

384:fNgTN1L4erYZRu8qq4qjcNePF1ZlhPNZ//ILIbkbzdCgyfshGXGfZNG:OOwuR/8Tm17h1ZH3Lgy0hG8NG

Score

1^/10

Malware Config

Signatures

Files

f7092de5f32c0df837fa7f947a3424af
.dll windows:6 windows x64 arch:x64

d217ef27b765ec22286b5aace47f044d

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:5b:8e:00:e1:aa:c4:d3:74:fa:18:54:cd:d0:ee:f8
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/09/2020, 00:00

Not After

25/09/2021, 23:59

Subject

CN=Pelorus LLC,O=Pelorus LLC,POSTALCODE=111024,STREET=Perovskiy proezd\, 35/5\, room 1\, office 9,L=Moskva,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

01/02/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:31:7c:fb:08:88:66:79:53:54:13:a4:de:41:eb:01:d7:98:74:01
Signer

Actual PE Digest

77:31:7c:fb:08:88:66:79:53:54:13:a4:de:41:eb:01:d7:98:74:01

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ole32

CoIsHandlerConnected

kernel32

RtlCaptureContext
TerminateProcess
GetProcAddress
LocalAlloc
ReleaseSemaphore
GetModuleHandleW
VirtualUnlock
IsProcessorFeaturePresent
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess

Exports

Exports

biocpl

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d217ef27b765ec22286b5aace47f044d

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

05:5b:8e:00:e1:aa:c4:d3:74:fa:18:54:cd:d0:ee:f8Certificate

Extended Key Usages

Key Usages

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2dCertificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

77:31:7c:fb:08:88:66:79:53:54:13:a4:de:41:eb:01:d7:98:74:01Signer

Headers

DLL Characteristics

File Characteristics

Imports

ole32

kernel32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 96B

.gfids Size: 512B - Virtual size: 4B

.reloc Size: 512B - Virtual size: 32B

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

05:5b:8e:00:e1:aa:c4:d3:74:fa:18:54:cd:d0:ee:f8
Certificate

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

77:31:7c:fb:08:88:66:79:53:54:13:a4:de:41:eb:01:d7:98:74:01
Signer

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 96B

.gfids
Size: 512B - Virtual size: 4B

.reloc
Size: 512B - Virtual size: 32B