173a1a6538e7a7f7061a70b87e6b9b8271593e877885c1c043745d867274338d

Sharing

Copy URL

Twitter E-mail

General

Target

173a1a6538e7a7f7061a70b87e6b9b8271593e877885c1c043745d867274338d
Size

4.1MB
MD5

2aa2fe469000bb76a38dfaf0601f3935
SHA1

34802bc34a5b98afd4322ad3609d2b61e8e0364c
SHA256

173a1a6538e7a7f7061a70b87e6b9b8271593e877885c1c043745d867274338d
SHA512

ee81180b7ef7f047bb21d7f3a15fe5dbfc24a826aff4742f2ab9aaa103888de4cbec5ccedf7506a9a613907af68419ce0c8bd2bc4ebdee9e4e3312ac070da646
SSDEEP

98304:1901Gs0mxnXjsFJJwlUsAywdGh7h7tTbfgYPRCPkT0PX3:1HEXoFJJaNA8NTDgYPRCPk43

Score

1^/10

Malware Config

Signatures

Files

173a1a6538e7a7f7061a70b87e6b9b8271593e877885c1c043745d867274338d
.exe windows:5 windows x86 arch:x86

34c4161f659e591de8a4c6e215c7a951

Code Sign

eb:68:67:1a:05:0f:f8:99:70:f1:ac:db:a8:5c:af:62
Certificate

Issuer

CN=522303292b2005041027200a5d5d12051031230d161c143d24542553452740323d28,POSTALCODE=10820,ST=0b1c1115005f5c4e061704171b0617160407045b0c1704+ST=0b1c1115494a5c11101704105c1f07410b17550d0e1c0c5a070a090e025212541c510f17091909155406121d141b0850180d0a16140e53100100171b1d12055b0c0b0a070b

Not Before

17/02/2024, 17:40

Not After

16/02/2025, 17:40

Subject

CN=522303292b2005041027200a5d5d12051031230d161c143d24542553452740323d28,POSTALCODE=10820,ST=0b1c1115005f5c4e061704171b0617160407045b0c1704+ST=0b1c1115494a5c11101704105c1f07410b17550d0e1c0c5a070a090e025212541c510f17091909155406121d141b0850180d0a16140e53100100171b1d12055b0c0b0a070b

38:ec:5f:e2:e7:83:50:89:e1:02:2b:9a:9f:f4:a8:f6:27:bc:33:e8:ae:9c:fa:79:a6:da:1f:19:3b:cf:72:45
Signer

Actual PE Digest

38:ec:5f:e2:e7:83:50:89:e1:02:2b:9a:9f:f4:a8:f6:27:bc:33:e8:ae:9c:fa:79:a6:da:1f:19:3b:cf:72:45

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\rajepe\sadizohokazu\wiwuyoxoku-vanawif.pdb

Imports

kernel32

InterlockedDecrement
QueryDosDeviceA
InterlockedCompareExchange
AddConsoleAliasW
GetComputerNameW
CreateDirectoryExA
GetFileAttributesExA
GetTickCount
GetConsoleTitleA
GlobalAlloc
GetSystemDirectoryW
GlobalFindAtomA
LoadLibraryW
GetLocaleInfoW
AssignProcessToJobObject
GetSystemPowerStatus
GetConsoleAliasExesLengthW
GetConsoleAliasW
WriteConsoleW
GlobalDeleteAtom
SetLastError
GetProcAddress
VirtualAlloc
HeapSize
RemoveDirectoryA
SetComputerNameA
LoadLibraryA
GetFileType
GetNumberFormatW
SetFileApisToANSI
EnumResourceTypesW
GetModuleHandleA
CreateWaitableTimerW
VirtualProtect
GetCurrentProcessId
GetVolumeInformationW
CreateFileA
GetTempFileNameW
GetComputerNameA
GetModuleHandleW
Sleep
ExitProcess
GetCommandLineA
GetStartupInfoA
MultiByteToWideChar
GetLastError
ReadFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
DeleteCriticalSection
HeapFree
SetFilePointer
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
WriteFile
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
RtlUnwind
HeapAlloc
HeapReAlloc
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CloseHandle
WriteConsoleA
GetConsoleOutputCP

user32

EnableWindow
CharUpperBuffW

advapi32

DeregisterEventSource
AreAllAccessesGranted

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34c4161f659e591de8a4c6e215c7a951

Code Sign

eb:68:67:1a:05:0f:f8:99:70:f1:ac:db:a8:5c:af:62Certificate

38:ec:5f:e2:e7:83:50:89:e1:02:2b:9a:9f:f4:a8:f6:27:bc:33:e8:ae:9c:fa:79:a6:da:1f:19:3b:cf:72:45Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Sections

.text Size: 4.0MB - Virtual size: 4.0MB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 21KB - Virtual size: 73KB

.rsrc Size: 48KB - Virtual size: 5.0MB

eb:68:67:1a:05:0f:f8:99:70:f1:ac:db:a8:5c:af:62
Certificate

38:ec:5f:e2:e7:83:50:89:e1:02:2b:9a:9f:f4:a8:f6:27:bc:33:e8:ae:9c:fa:79:a6:da:1f:19:3b:cf:72:45
Signer

.text
Size: 4.0MB - Virtual size: 4.0MB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 21KB - Virtual size: 73KB

.rsrc
Size: 48KB - Virtual size: 5.0MB