81ed47a991b51ac416d56e87a29a9e1e[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

81ed47a991b51ac416d56e87a29a9e1e.bin
Size

4.4MB
MD5

6cf93d12833263026396667784477cfa
SHA1

07b26ae6d7a5c561032fdcca3c866bd0ba27191a
SHA256

decbcf05edc76dd31fbf2e2eefb16305e4086c0b0d8df47e5d4631433e9387f5
SHA512

c47362537a0bbe60a4cab74a0fb6c5d8bb293551732cbb3bddd946521d3ba7be26f96a93422b1d1804bf8c73ee1db16de2b5f1ca0329ee6eb084db27e7e5a382
SSDEEP

98304:NmlyqrxFJuNxjBjEZlG+oPclRdJDSTUSwn3IMIlE8DwbF0X5:NqYTyycl4TUSwn3IMDY5

Score

1^/10

Malware Config

Signatures

Files

81ed47a991b51ac416d56e87a29a9e1e.bin
.zip

Password: infected
ead72d1eb42fc44e002ff76e006620db8308a34c3dd728df0fc26905b149ae29.exe
.exe windows:6 windows x86 arch:x86

Password: infected

6ea02e00483c90b3f210e2d517ab619a

Code Sign

1b:97:95:8a:61:90:30:4e:a6:f0:83:46:8c:0d:0b:a0
Certificate

Issuer

CN=ActiveReports RDF document API,OU=Active,O=GrapeCity Inc. All rights reserved,L=%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%,ST=CH,C=CH

Not Before

10-12-2023 16:10

Not After

26-09-2025 00:00

Subject

CN=ActiveReports RDF document API,OU=Active,O=GrapeCity Inc. All rights reserved,L=%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%%-±×-%,ST=CH,C=CH

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:88:a8:85:9d:5a:c0:7d:f5:ee:67:94:0c:b0:31:50:67:87:a4:33:e6:96:8a:d1:4a:d2:e6:64:f2:76:40:e5
Signer

Actual PE Digest

b4:88:a8:85:9d:5a:c0:7d:f5:ee:67:94:0c:b0:31:50:67:87:a4:33:e6:96:8a:d1:4a:d2:e6:64:f2:76:40:e5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

GetSystemMetrics

gdi32

CreateCompatibleBitmap

advapi32

RegCloseKey

shell32

SHGetFolderPathA

wininet

HttpOpenRequestA

gdiplus

GdiplusStartup

ws2_32

closesocket

Sections

.MPRESS1
Size: 4.4MB - Virtual size: 11.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

6ea02e00483c90b3f210e2d517ab619a

Code Sign

1b:97:95:8a:61:90:30:4e:a6:f0:83:46:8c:0d:0b:a0Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

b4:88:a8:85:9d:5a:c0:7d:f5:ee:67:94:0c:b0:31:50:67:87:a4:33:e6:96:8a:d1:4a:d2:e6:64:f2:76:40:e5Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

wininet

gdiplus

ws2_32

Sections

.MPRESS1 Size: 4.4MB - Virtual size: 11.8MB

.MPRESS2 Size: 3KB - Virtual size: 3KB

.rsrc Size: 15KB - Virtual size: 15KB

1b:97:95:8a:61:90:30:4e:a6:f0:83:46:8c:0d:0b:a0
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

b4:88:a8:85:9d:5a:c0:7d:f5:ee:67:94:0c:b0:31:50:67:87:a4:33:e6:96:8a:d1:4a:d2:e6:64:f2:76:40:e5
Signer

.MPRESS1
Size: 4.4MB - Virtual size: 11.8MB

.MPRESS2
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 15KB - Virtual size: 15KB