35e8a78087e59fd1d34b79440145c9abd1c8e4d7ae3bf60bcc81b3a45d96a2cb

Sharing

Copy URL Twitter E-mail

General

Target

35e8a78087e59fd1d34b79440145c9abd1c8e4d7ae3bf60bcc81b3a45d96a2cb
Size

2.4MB
MD5

eb9cbe60607ca65ace376ecbd9c161c9
SHA1

9b18993a573b5e00397fa077cf2c83e3493747e1
SHA256

35e8a78087e59fd1d34b79440145c9abd1c8e4d7ae3bf60bcc81b3a45d96a2cb
SHA512

abc48f3dfb67d979ca4dbb5086696b6c8a23b95c49e4cf9bfbdb675e5ff8fd9ca4620fb4cf280eaa3e77dc16364fdbe46f41190010a3671b23997f00268f1ba8
SSDEEP

49152:dvqN4qqA0ANeVgLRi4IjZY2FJ/34/fhh2:8FsKLRTOY2Fd30f6

Score

1^/10

Malware Config

Signatures

Files

35e8a78087e59fd1d34b79440145c9abd1c8e4d7ae3bf60bcc81b3a45d96a2cb
.dll windows:6 windows x64 arch:x64

0c0c583dbc00d4d5ff2fa2bc0b5432d7

Code Sign

23:cd:9a:f0:15:6d:26:02
Certificate

Issuer

CN=AAF Optimus RSA-384 Code Signing CA,O=AAF Optimus,ST=Rio de Janeiro,C=BR,1.2.840.113549.1.9.1=#0c13616c616e66696e6f7479406c6976652e636f6d

Not Before

30/08/2023, 00:00

Not After

28/08/2025, 23:59

Subject

CN=AAF Optimus,O=AAF Optimus,ST=Rio de Janeiro,C=BR,1.2.840.113549.1.9.1=#0c14616c616e66696e6f747940676d61696c2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

4a:a3:38:19:70:c6:02:f7
Certificate

Issuer

CN=AAF Optimus RSA-384 Root Certificate Authority,O=AAF Optimus,ST=Rio de Janeiro,C=BR,1.2.840.113549.1.9.1=#0c13616c616e66696e6f7479406c6976652e636f6d

Not Before

10/07/2018, 00:00

Not After

30/07/2026, 23:59

Subject

CN=AAF Optimus RSA-384 Code Signing CA,O=AAF Optimus,ST=Rio de Janeiro,C=BR,1.2.840.113549.1.9.1=#0c13616c616e66696e6f7479406c6976652e636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

TlsFree
TerminateProcess
GetCurrentProcessId
TlsSetValue
GetCurrentThreadId
GetCurrentProcess
TlsGetValue
TlsAlloc

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetProcAddress

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
DeleteCriticalSection

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initterm_e
_initialize_onexit_table
_cexit
terminate
_initialize_narrow_environment
_configure_narrow_argv
_initterm
_seh_filter_dll

api-ms-win-crt-heap-l1-1-0

free
calloc

api-ms-win-crt-string-l1-1-0

wcsncmp

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c0c583dbc00d4d5ff2fa2bc0b5432d7

Code Sign

23:cd:9a:f0:15:6d:26:02Certificate

Extended Key Usages

4a:a3:38:19:70:c6:02:f7Certificate

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 816B

.rsrc Size: 2.4MB - Virtual size: 2.4MB

.reloc Size: 512B - Virtual size: 236B

23:cd:9a:f0:15:6d:26:02
Certificate

4a:a3:38:19:70:c6:02:f7
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 816B

.rsrc
Size: 2.4MB - Virtual size: 2.4MB

.reloc
Size: 512B - Virtual size: 236B