SecuriteInfo[.]com[.]not-a-virus[.]HEUR[.]Downloader[.]Win32[.]Agent[.]gen[.]2182[.]31472

Sharing

Copy URL

Twitter E-mail

General

Target

SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Agent.gen.2182.31472
Size

287KB
MD5

8284da11168b4dea50ee3159043ba5f9
SHA1

91fd9ccb26fed425a779a3def89a625e5616f844
SHA256

7fa5cd4c23349fc8ee7f9aae22a4cd2d60bfa2c7f70ddcb1bedea98776dc40c8
SHA512

2c159696af761072f77d5a5a7b7fd914d6310f25dc2cdc364e9ca81ea29da81d1b72d9bd3a938b206aa053eea6e53e366007b8e77abea383c4644645d4006ab2
SSDEEP

6144:rEj+CdJn5PuBjB9x8UIxew6ODSqAYrAOQYy6SOjaP:wyCdJn5PuBV9x8PjmpsaP

Score

1^/10

Malware Config

Signatures

Files

SecuriteInfo.com.not-a-virus.HEUR.Downloader.Win32.Agent.gen.2182.31472
.exe windows:6 windows x86 arch:x86

23788615c320bd0d80817496057378a4

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2013 12:00

Not After

15-01-2038 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:16:16:75:19:b2:4b:5b:24:10:b9:01:6d:5e:07:82
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

30-05-2022 00:00

Not After

30-05-2023 23:59

Subject

SERIALNUMBER=91450500MAA7H9NJ04,CN=Guangxi Yunao Network Technology Co.\, Ltd.,O=Guangxi Yunao Network Technology Co.\, Ltd.,L=Beihai,ST=Guangxi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#131642656968616920496e647573747269616c205061726b,1.3.6.1.4.1.311.60.2.1.2=#13074775616e677869,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9e:87:c8:19:73:ff:a8:52:de:bd:71:8a:bf:ed:a8:cf:99:0a:07:a2:75:51:b2:a8:42:2d:67:ea:42:36:c3:aa
Signer

Actual PE Digest

9e:87:c8:19:73:ff:a8:52:de:bd:71:8a:bf:ed:a8:cf:99:0a:07:a2:75:51:b2:a8:42:2d:67:ea:42:36:c3:aa

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetEnvironmentVariableW
WaitForSingleObject
GetACP
MultiByteToWideChar
GetLastError
CloseHandle
CreateProcessW
WideCharToMultiByte
CreateFileW
HeapSize
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
WriteConsoleW

shlwapi

PathAddBackslashW
PathStripPathW
PathAppendW

urlmon

URLDownloadToFileW

winhttp

WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpen
WinHttpSendRequest
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpConnect

Sections

.text
Size: 186KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23788615c320bd0d80817496057378a4

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0d:16:16:75:19:b2:4b:5b:24:10:b9:01:6d:5e:07:82Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

9e:87:c8:19:73:ff:a8:52:de:bd:71:8a:bf:ed:a8:cf:99:0a:07:a2:75:51:b2:a8:42:2d:67:ea:42:36:c3:aaSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shlwapi

urlmon

winhttp

Sections

.text Size: 186KB - Virtual size: 186KB

.rdata Size: 63KB - Virtual size: 62KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 9KB - Virtual size: 8KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:16:16:75:19:b2:4b:5b:24:10:b9:01:6d:5e:07:82
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

9e:87:c8:19:73:ff:a8:52:de:bd:71:8a:bf:ed:a8:cf:99:0a:07:a2:75:51:b2:a8:42:2d:67:ea:42:36:c3:aa
Signer

.text
Size: 186KB - Virtual size: 186KB

.rdata
Size: 63KB - Virtual size: 62KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 9KB - Virtual size: 8KB