ab242cb098e1823ae67844c4b471e247f00edfa09e77568d2a159c377e8bcd14

Sharing

Copy URL Twitter E-mail

General

Target

ab242cb098e1823ae67844c4b471e247f00edfa09e77568d2a159c377e8bcd14
Size

112.3MB
MD5

279e6d95e0793e5d66dea9815a7ed0a2
SHA1

dda13962f3f114c1f12339f2bc442e49f34f561f
SHA256

ab242cb098e1823ae67844c4b471e247f00edfa09e77568d2a159c377e8bcd14
SHA512

ca6242dcaf59c9d28bcac4f35764eb52c7ce13af46c6490ef4302fe950d7df404af099007bf391661e3750733e534b0a5bb119e2b908000ed30b2eb745b91369
SSDEEP

786432:G0hpsmj4OyT9mtDO058BbNwEeR+GdBDM+Tx1+wpkYq8mu3XJgUEbFZ7jvbuV9:G0XsmjPyZmtDFz9XReuJMbXY9

Score

1^/10

Malware Config

Signatures

Files

ab242cb098e1823ae67844c4b471e247f00edfa09e77568d2a159c377e8bcd14
.dll windows:6 windows x86 arch:x86

8155ff71c61cc7fd2548f59565fc151c

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:32

Not After

01/09/2022, 18:32

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:bc:3c:84:69:23:17:cd:a4:6d:92:29:29:fb:9e:22:f0:1f:bb:db:1f:ee:13:c2:4b:fe:91:ba:ef:0f:75:ea
Signer

Actual PE Digest

59:bc:3c:84:69:23:17:cd:a4:6d:92:29:29:fb:9e:22:f0:1f:bb:db:1f:ee:13:c2:4b:fe:91:ba:ef:0f:75:ea

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\native\net5.0-Windows_NT-Release-x86\clrcompression\Release\clrcompression.pdb

Imports

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free

api-ms-win-crt-math-l1-1-0

log2

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_execute_onexit_table
_cexit
_configure_narrow_argv
exit
abort
_initialize_narrow_environment
_seh_filter_dll
_initterm
_initterm_e
terminate

api-ms-win-crt-string-l1-1-0

wcsncmp

Exports

Exports

BrotliDecoderCreateInstance
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderDestroyInstance
BrotliDecoderErrorString
BrotliDecoderGetErrorCode
BrotliDecoderHasMoreOutput
BrotliDecoderIsFinished
BrotliDecoderIsUsed
BrotliDecoderSetParameter
BrotliDecoderTakeOutput
BrotliDecoderVersion
BrotliEncoderCompress
BrotliEncoderCompressStream
BrotliEncoderCreateInstance
BrotliEncoderDestroyInstance
BrotliEncoderHasMoreOutput
BrotliEncoderIsFinished
BrotliEncoderMaxCompressedSize
BrotliEncoderSetParameter
BrotliEncoderTakeOutput
BrotliEncoderVersion
BrotliGetDictionary
BrotliSetDictionaryData
CompressionNative_Crc32
CompressionNative_Deflate
CompressionNative_DeflateEnd
CompressionNative_DeflateInit2_
CompressionNative_Inflate
CompressionNative_InflateEnd
CompressionNative_InflateInit2_

Sections

.text
Size: 245KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 458KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8155ff71c61cc7fd2548f59565fc151c

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

59:bc:3c:84:69:23:17:cd:a4:6d:92:29:29:fb:9e:22:f0:1f:bb:db:1f:ee:13:c2:4b:fe:91:ba:ef:0f:75:eaSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 245KB - Virtual size: 244KB

.rdata Size: 458KB - Virtual size: 457KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

59:bc:3c:84:69:23:17:cd:a4:6d:92:29:29:fb:9e:22:f0:1f:bb:db:1f:ee:13:c2:4b:fe:91:ba:ef:0f:75:ea
Signer

.text
Size: 245KB - Virtual size: 244KB

.rdata
Size: 458KB - Virtual size: 457KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB