c0be5e312a0ce95475c45a16f2db9086c6f587d0ca12425509cbcc45ef687bb1

Sharing

Copy URL Twitter E-mail

General

Target

c0be5e312a0ce95475c45a16f2db9086c6f587d0ca12425509cbcc45ef687bb1
Size

587KB
MD5

d367d5cbe14e1389c44162a3e5fbfac7
SHA1

e0c902c1ea2dfaf3ea9fffc8fad3d41473e7575d
SHA256

c0be5e312a0ce95475c45a16f2db9086c6f587d0ca12425509cbcc45ef687bb1
SHA512

e75c75d6e33711529c515418850f2bdbddc8ce8ef6ef3cad8b0646479e918afa94a2d98a298cbcbf218b54736fe29286f19998659bae0811e1f756b5fc53de68
SSDEEP

6144:v+5pHZk/NLHGEMxxOHc077VtXZvd0lQYYliOvsXmohbkgSQxinHXHXH0ZHNl37CV:vMk/1mF0HfByQYYPv+motkOD4th

Score

1^/10

Malware Config

Signatures

Files

c0be5e312a0ce95475c45a16f2db9086c6f587d0ca12425509cbcc45ef687bb1
.dll regsvr32 windows:6 windows x64 arch:x64

4efbbf50ecc6cf865c2a749d216c888b

Code Sign

79:17:2c:22:be:f4:e2:cd
Certificate

Issuer

CN=AAF Optimus RSA-384 Third Party CA,O=AAF Optimus,ST=Rio de Janeiro,C=BR,1.2.840.113549.1.9.1=#0c13616c616e66696e6f7479406c6976652e636f6d

Not Before

15/06/2023, 00:00

Not After

15/06/2026, 23:59

Subject

CN=AAF Optimus Hardware Compatibility Publisher,O=AAF Optimus,ST=Rio de Janeiro,C=BR,1.2.840.113549.1.9.1=#0c14616c616e66696e6f747940676d61696c2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

44:b5:7c:b9:60:c7:e4:22:4f:13:c1:a0:de:28:2d:cb:5f:74:c2:6c:58:c0:da:a1:9b:3d:ab:76:bd:b2:fe:95
Signer

Actual PE Digest

44:b5:7c:b9:60:c7:e4:22:4f:13:c1:a0:de:28:2d:cb:5f:74:c2:6c:58:c0:da:a1:9b:3d:ab:76:bd:b2:fe:95

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

propsys

InitPropVariantFromCLSID

cfgmgr32

CM_Get_Device_ID_ListW
CM_Get_DevNode_Registry_PropertyW
CM_Locate_DevNodeW
CM_Get_Device_ID_List_SizeW

kernel32

MultiByteToWideChar
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexW
FreeLibrary
DecodePointer
EncodePointer
GetThreadLocale
SetThreadLocale
CreateFileW
SetStdHandle
ReadConsoleW
LoadLibraryExW
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
lstrcmpiW
GetProcAddress
GetModuleHandleW
DeleteCriticalSection
GetModuleFileNameW
WriteConsoleW
RtlUnwind
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
IsValidLocale
IsDebuggerPresent
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
GetStringTypeW
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW

user32

CharNextW

advapi32

CryptDecrypt
CryptEncrypt
CryptImportKey
CryptExportKey
CryptGetUserKey
CryptDestroyKey
CryptGenKey
CryptReleaseContext
CryptAcquireContextW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
TraceMessage
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

ole32

CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromString
PropVariantClear
PropVariantCopy
StringFromGUID2
CoUninitialize

oleaut32

LoadRegTypeLi
RegisterTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
LoadTypeLi
SysAllocString
UnRegisterTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 304KB - Virtual size: 303KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4efbbf50ecc6cf865c2a749d216c888b

Code Sign

79:17:2c:22:be:f4:e2:cdCertificate

Extended Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

44:b5:7c:b9:60:c7:e4:22:4f:13:c1:a0:de:28:2d:cb:5f:74:c2:6c:58:c0:da:a1:9b:3d:ab:76:bd:b2:fe:95Signer

Headers

DLL Characteristics

File Characteristics

Imports

propsys

cfgmgr32

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 304KB - Virtual size: 303KB

.rdata Size: 162KB - Virtual size: 161KB

.data Size: 33KB - Virtual size: 40KB

.pdata Size: 17KB - Virtual size: 16KB

.rsrc Size: 56KB - Virtual size: 55KB

.reloc Size: 5KB - Virtual size: 4KB

79:17:2c:22:be:f4:e2:cd
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

44:b5:7c:b9:60:c7:e4:22:4f:13:c1:a0:de:28:2d:cb:5f:74:c2:6c:58:c0:da:a1:9b:3d:ab:76:bd:b2:fe:95
Signer

.text
Size: 304KB - Virtual size: 303KB

.rdata
Size: 162KB - Virtual size: 161KB

.data
Size: 33KB - Virtual size: 40KB

.pdata
Size: 17KB - Virtual size: 16KB

.rsrc
Size: 56KB - Virtual size: 55KB

.reloc
Size: 5KB - Virtual size: 4KB