@O45_204_82_103_XREMCC[.]exe[.]1

Sharing

Copy URL Twitter E-mail

General

Target

@O45_204_82_103_XREMCC.exe.1
Size

1.5MB
MD5

50699f8a9828ae6d19e481e906391e1f
SHA1

432f9e66bbbb1a8be51e3ab8a3e903aa8a96db39
SHA256

04aad94a951c080383f2ad712f0f27bad46327c039960c1573cf02af1974d2d3
SHA512

6b70e9f155ecc9d11b2f6ab4d71c5f9102518c32148393362838e19d5468365b7203c06d60ecb20a126b051e952b439180b4b057f2bc4cb725128d2637b168ff
SSDEEP

24576:VpCPHKEHa10rCwCgWE9rBhh7ZGyjyFkhakMzKmFb:VpCPHKEm0mwCgFrfh7UyjnhakMzKs

Score

1^/10

Malware Config

Signatures

Files

@O45_204_82_103_XREMCC.exe.1
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:38:77:eb:0f:97:ad:81:b9:3a:75:d8:fe:0d:78:52:58:f7:09:36:f4:3e:d2:fc:67:f8:d0:26:5e:a8:1a:65
Signer

Actual PE Digest

29:38:77:eb:0f:97:ad:81:b9:3a:75:d8:fe:0d:78:52:58:f7:09:36:f4:3e:d2:fc:67:f8:d0:26:5e:a8:1a:65

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 908KB - Virtual size: 907KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 571KB - Virtual size: 571KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

29:38:77:eb:0f:97:ad:81:b9:3a:75:d8:fe:0d:78:52:58:f7:09:36:f4:3e:d2:fc:67:f8:d0:26:5e:a8:1a:65Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 908KB - Virtual size: 907KB

.rsrc Size: 571KB - Virtual size: 571KB

.reloc Size: 512B - Virtual size: 12B

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

29:38:77:eb:0f:97:ad:81:b9:3a:75:d8:fe:0d:78:52:58:f7:09:36:f4:3e:d2:fc:67:f8:d0:26:5e:a8:1a:65
Signer

.text
Size: 908KB - Virtual size: 907KB

.rsrc
Size: 571KB - Virtual size: 571KB

.reloc
Size: 512B - Virtual size: 12B