3e9d088ff4600dea937245c3df63d419b3756209d60115284547eca1cef2b2a1

Sharing

Copy URL Twitter E-mail

General

Target

3e9d088ff4600dea937245c3df63d419b3756209d60115284547eca1cef2b2a1
Size

17KB
MD5

8a97fd41139015849365e767b1b5117b
SHA1

ff9ee79e003cfabbf253ba27f7323b34c8f90203
SHA256

3e9d088ff4600dea937245c3df63d419b3756209d60115284547eca1cef2b2a1
SHA512

8f97d33bd6175247d068261b914e68f2886a3f04a00cf3e1cc90b4e411b33dfc18cc628e8ea73d03cfc5fd3837f2dca17dfc40025569bac64fd4abb3107dd1df
SSDEEP

384:Av9xHG/n4RARwtHuV+UIYif8ZpHzGov+F0AZTQgGi:Y0n4I+lYifiRP+ZsI

Score

1^/10

Malware Config

Signatures

Files

3e9d088ff4600dea937245c3df63d419b3756209d60115284547eca1cef2b2a1
.exe windows:5 windows x86 arch:x86

2eab88f29b7f33e95a4bc2842e904cda

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0d:26:2c:99:1c:e8:12:8e:f2:d1:28:c2:93:d2:c6:0e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11/01/2022, 00:00

Not After

08/02/2025, 23:59

Subject

CN=Beijing Venustech Cybervision Co.\, Ltd.,O=Beijing Venustech Cybervision Co.\, Ltd.,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

12:d2:9d:9d:27:50:43:9d:89:65:72:0d:7a:30:be:11:db:0f:67:1c
Signer

Actual PE Digest

12:d2:9d:9d:27:50:43:9d:89:65:72:0d:7a:30:be:11:db:0f:67:1c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryW
GetProcAddress
OutputDebugStringA
OutputDebugStringW
CreateEventW
GetLastError
WaitForSingleObject
CloseHandle
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

msvcr100

_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_swprintf

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 526B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2eab88f29b7f33e95a4bc2842e904cda

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

0d:26:2c:99:1c:e8:12:8e:f2:d1:28:c2:93:d2:c6:0eCertificate

Extended Key Usages

Key Usages

12:d2:9d:9d:27:50:43:9d:89:65:72:0d:7a:30:be:11:db:0f:67:1cSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr100

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 904B

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 1024B - Virtual size: 526B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

0d:26:2c:99:1c:e8:12:8e:f2:d1:28:c2:93:d2:c6:0e
Certificate

12:d2:9d:9d:27:50:43:9d:89:65:72:0d:7a:30:be:11:db:0f:67:1c
Signer

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 904B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 1024B - Virtual size: 526B