c085f5978c9a6c6efad9057b5dbbed005278765b951291eece23b07db69af6c6

Sharing

Copy URL

Twitter E-mail

General

Target

c085f5978c9a6c6efad9057b5dbbed005278765b951291eece23b07db69af6c6
Size

4.3MB
MD5

27861cd9652cb9e714b324948e16eb71
SHA1

d04195e0c5d2a1374f9f3db7aa8eaad2d56f62db
SHA256

c085f5978c9a6c6efad9057b5dbbed005278765b951291eece23b07db69af6c6
SHA512

adebdd82758586957dce0c2bf653eb9cfcc5f1c2be828a50b334dec94a598d0c646acde98d89cc9fe002d2d508cc6f46e5ddb26d3114d75291d61cffa17c7c0f
SSDEEP

49152:l8HvqGutBGTvFd6r43tkhX4ECTCoCLCr0bbfrbfO4xOh5Pgvy+7dFTOhyPlmsV5/:kh/Wi8zJy4qems4mZTsnm

Score

1^/10

Malware Config

Signatures

Files

c085f5978c9a6c6efad9057b5dbbed005278765b951291eece23b07db69af6c6
.dll windows:6 windows x64 arch:x64

fe8777a9ad52f71d2d8e506d576ead24

Code Sign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2
Certificate

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Not Before

23/03/2022, 00:00

Not After

16/03/2025, 23:59

Subject

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

25/05/2021, 00:00

Not After

24/05/2036, 23:59

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19/11/2020, 20:32

Not After

19/11/2035, 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:2f:28:35:21:b5:92:0b:e0:fa:00:00:00:00:00:2f
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

15/06/2023, 19:38

Not After

14/06/2024, 19:38

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:4E89-9666-FFE7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

16/04/2020, 18:36

Not After

16/04/2045, 18:44

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:cd:04:28:d7:a3:29:cb:d6:59:a6:00:00:00:00:cd:04
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

23/01/2024, 11:39

Not After

26/01/2024, 11:39

Subject

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:cd:04:28:d7:a3:29:cb:d6:59:a6:00:00:00:00:cd:04
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

23/01/2024, 11:39

Not After

26/01/2024, 11:39

Subject

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Not Before

13/04/2021, 17:31

Not After

13/04/2026, 17:31

Subject

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

01/04/2021, 20:05

Not After

01/04/2036, 20:15

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19/11/2020, 20:32

Not After

19/11/2035, 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:27:af:ad:af:67:15:26:b8:e3:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

06/04/2023, 18:44

Not After

04/04/2024, 18:44

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9f:18:c4:4c:be:ba:ac:34:ef:34:60:d5:d0:52:c1:bf:06:ba:77:a7:37:2f:6b:9f:8f:4b:fd:48:a3:05:dd:98
Signer

Actual PE Digest

9f:18:c4:4c:be:ba:ac:34:ef:34:60:d5:d0:52:c1:bf:06:ba:77:a7:37:2f:6b:9f:8f:4b:fd:48:a3:05:dd:98

Digest Algorithm

sha256

PE Digest Matches

true

9f:18:c4:4c:be:ba:ac:34:ef:34:60:d5:d0:52:c1:bf:06:ba:77:a7:37:2f:6b:9f:8f:4b:fd:48:a3:05:dd:98
Signer

Actual PE Digest

9f:18:c4:4c:be:ba:ac:34:ef:34:60:d5:d0:52:c1:bf:06:ba:77:a7:37:2f:6b:9f:8f:4b:fd:48:a3:05:dd:98

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\jenkins\workspace\N_ArwControllerImpl\bin\x64\Release\ArwControllerImpl.pdb

Imports

crypt32

CryptDecodeObjectEx
CertFindCertificateInStore
CryptQueryObject
CryptDecodeObject
CertFreeCertificateContext
CertGetNameStringW
CryptMsgGetParam
CertDuplicateCertificateContext
CertOpenStore
CertCloseStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CryptMsgClose

ws2_32

WSAGetLastError
WSASetLastError
send
recv
WSACleanup
WSAStartup
closesocket

iphlpapi

GetAdaptersInfo

kernel32

GlobalAlloc
GlobalFree
FreeLibrary
GetTickCount
GetSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
FileTimeToSystemTime
SetThreadPriority
FormatMessageW
LocalFree
LocalAlloc
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
GetFileSize
lstrcmpA
GetDriveTypeW
GetSystemWindowsDirectoryW
GetCurrentThreadId
SetEndOfFile
SetLastError
GetModuleHandleA
GetStdHandle
GetCurrentDirectoryW
CreateEventW
GetExitCodeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
ReleaseMutex
CreateMutexW
WaitForMultipleObjects
TerminateProcess
GetStartupInfoW
GetEnvironmentVariableW
SetEnvironmentVariableW
SystemTimeToFileTime
DeleteFiber
GetFileType
QueryPerformanceCounter
ConvertFiberToThread
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
GetFileAttributesExW
GetFileAttributesW
CreateFileW
HeapAlloc
GetProcessHeap
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetLogicalDriveStringsW
Process32NextW
Process32FirstW
HeapFree
GetSystemInfo
GetNativeSystemInfo
IsWow64Process
GetLongPathNameW
GetCurrentProcess
GetModuleFileNameW
FindClose
OutputDebugStringW
GetFileInformationByHandle
WriteFile
ReadFile
FlushFileBuffers
VirtualQueryEx
LoadLibraryW
Module32FirstW
CreateToolhelp32Snapshot
GetCurrentProcessId
CopyFileW
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
QueryDosDeviceW
ExpandEnvironmentStringsW
FindNextFileW
FindFirstFileW
FindVolumeClose
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
GetVolumeInformationW
FindFirstVolumeW
DeleteCriticalSection
DecodePointer
RaiseException
InitializeCriticalSectionEx
GetSystemWow64DirectoryW
CloseHandle
OpenProcess
GetLocalTime
GetWindowsDirectoryW
GetSystemDirectoryW
GetLastError
SwitchToThread
Sleep
LeaveCriticalSection
EnterCriticalSection
ResetEvent
FindFirstFileExW
HeapSize
GetFullPathNameW
SetStdHandle
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetFilePointerEx
GetConsoleCP
SetConsoleCtrlHandler
ExitProcess
PeekNamedPipe
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
RtlPcToFileHeader
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
WaitForSingleObjectEx
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
EncodePointer
GetStringTypeW
IsDebuggerPresent
GetCurrentThread
DeleteFileW
SetEvent
RtlUnwind

user32

GetUserObjectInformationW
GetProcessWindowStation
GetSystemMetrics
MessageBoxW

advapi32

RegCloseKey
IsTextUnicode
OpenThreadToken
AllocateAndInitializeSid
FreeSid
GetExplicitEntriesFromAclW
DeleteAce
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetSecurityInfo
SetSecurityInfo
TreeSetNamedSecurityInfoW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumKeyExW
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
CryptAcquireContextA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextW
CreateWellKnownSid
GetSidSubAuthority
GetSidSubAuthorityCount
AreAllAccessesGranted
MapGenericMask
ConvertStringSidToSidW
ConvertSidToStringSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadAppKeyW
RegLoadKeyW
RegEnumValueW
OpenProcessToken

shell32

SHGetFolderPathW
SHGetKnownFolderPath

ole32

CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize
CoInitializeSecurity
CoSetProxyBlanket

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString
SysStringLen

mpr

WNetGetConnectionW

sfc

SfcIsFileProtected

psapi

GetProcessImageFileNameW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

bcrypt

BCryptGetProperty
BCryptVerifySignature
BCryptDestroyKey
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptImportKeyPair
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCreateHash

authz

AuthzAccessCheck
AuthzFreeResourceManager
AuthzFreeContext
AuthzInitializeResourceManager
AuthzInitializeContextFromSid

netapi32

NetWkstaGetInfo
NetApiBufferFree

wintrust

CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
CryptCATAdminReleaseCatalogContext
WinVerifyTrust

Exports

Exports

AddExclusion
ClearDetectionCounter
ClearExclusions
Create
DBUpdatedEvent
Destroy
GetCurrentState
GetCurrentStatus
GetDetectionCounter
GetEnforceSilentMode
GetExclusion
GetExclusionID
GetLastARWError
GetNumExclusions
HardStartProtection
HardStopProtection
Initialize
IsArwInSilentMode
PerformTestOperation
RemoveExclusion
SetCheckWhiteListCallback
SetCheckWhiteListCallbackV2
SetDetectionCountCallback
SetEnforceSilentMode
SetExclusionNotifyCallback
SetGetWhiteListStatusCallback
SetInstallationTokenCallback
SetLicenseEntitlementFeaturesCallback
SetLicenseState
SetLogCallback
SetMaxLogLevel
SetSendTelemetryDataCallback
SetSendThreatFileToServerCallback
SetStateChangedCallback
SetStatusChangedCallback
SetSubmitToCleanCallback
SetThreatDetectedCallback
SetThreatDetectedCallbackEx
SetThreatDetectedCallbackExV2
SetThreatDetectedCallbackV2
SetUpdatePkgVersionCallback
Shutdown
ShutdownV2
SoftStartProtection
SoftStopProtection
StartProtection
StopProtection
UpdateExclusion

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe8777a9ad52f71d2d8e506d576ead24

Code Sign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2Certificate

Extended Key Usages

Key Usages

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:dbCertificate

Extended Key Usages

Key Usages

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

33:00:00:00:2f:28:35:21:b5:92:0b:e0:fa:00:00:00:00:00:2fCertificate

Extended Key Usages

Key Usages

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99Certificate

Key Usages

33:00:00:cd:04:28:d7:a3:29:cb:d6:59:a6:00:00:00:00:cd:04Certificate

Extended Key Usages

Key Usages

33:00:00:cd:04:28:d7:a3:29:cb:d6:59:a6:00:00:00:00:cd:04Certificate

Extended Key Usages

Key Usages

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04Certificate

Key Usages

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07Certificate

Key Usages

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

33:00:00:00:27:af:ad:af:67:15:26:b8:e3:00:00:00:00:00:27Certificate

Extended Key Usages

Key Usages

9f:18:c4:4c:be:ba:ac:34:ef:34:60:d5:d0:52:c1:bf:06:ba:77:a7:37:2f:6b:9f:8f:4b:fd:48:a3:05:dd:98Signer

9f:18:c4:4c:be:ba:ac:34:ef:34:60:d5:d0:52:c1:bf:06:ba:77:a7:37:2f:6b:9f:8f:4b:fd:48:a3:05:dd:98Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

ws2_32

iphlpapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

mpr

sfc

psapi

version

bcrypt

authz

netapi32

wintrust

Exports

Exports

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 69KB - Virtual size: 90KB

.pdata Size: 130KB - Virtual size: 130KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 36KB - Virtual size: 35KB

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2
Certificate

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Certificate

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

33:00:00:00:2f:28:35:21:b5:92:0b:e0:fa:00:00:00:00:00:2f
Certificate

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

33:00:00:cd:04:28:d7:a3:29:cb:d6:59:a6:00:00:00:00:cd:04
Certificate

33:00:00:cd:04:28:d7:a3:29:cb:d6:59:a6:00:00:00:00:cd:04
Certificate

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04
Certificate

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

33:00:00:00:27:af:ad:af:67:15:26:b8:e3:00:00:00:00:00:27
Certificate

9f:18:c4:4c:be:ba:ac:34:ef:34:60:d5:d0:52:c1:bf:06:ba:77:a7:37:2f:6b:9f:8f:4b:fd:48:a3:05:dd:98
Signer

9f:18:c4:4c:be:ba:ac:34:ef:34:60:d5:d0:52:c1:bf:06:ba:77:a7:37:2f:6b:9f:8f:4b:fd:48:a3:05:dd:98
Signer

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 69KB - Virtual size: 90KB

.pdata
Size: 130KB - Virtual size: 130KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 36KB - Virtual size: 35KB