1707964536320-fn cheto[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

1707964536320-fn cheto.zip
Size

256KB
MD5

c5935e6037f6d8d8863dc6c84f97f39d
SHA1

9aa7db7386d502900d0631ac9f77946d7128166c
SHA256

b8841573844ae4beb709eb78d229f4860376db1ea6d030ef11bc68ba55fc4ff3
SHA512

b4451209b12ad2710ff5e2daccd1564ff25ed45b4c6b395cf645c1429ed12b32e38003588783c651d437f362bfec6a01a6b203e185f6481edea13fe9f944ff17
SSDEEP

6144:qBCCYxP3QlmhpY9oEpURzVokJXHcpNMQGkmGLkx:qg7p+WLXHqXGVx

Score

1^/10

Malware Config

Signatures

Files

1707964536320-fn cheto.zip
.zip
fn cheto/RzChromaSDK64_4.dll
.dll windows:6 windows x64 arch:x64

37f8f01ea41a561942b1d53df8fdd2b5

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

10-11-2021 00:00

Not After

09-11-2024 23:59

Subject

CN=Hangil IT Co.\, Ltd,O=Hangil IT Co.\, Ltd,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

58:1a:1c:79:4b:ab:9f:8e:fe:59:ad:06:31:35:a3:49:fa:d2:f6:af
Signer

Actual PE Digest

58:1a:1c:79:4b:ab:9f:8e:fe:59:ad:06:31:35:a3:49:fa:d2:f6:af

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

FindClose
GetModuleHandleA

ntdll

RtlVirtualUnwind

shell32

SHChangeNotifyRegister

advapi32

RegisterEventSourceW

user32

IsChild

Sections

Size: - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fn cheto/fixes.txt

Sharing

General

Malware Config

Signatures

Files

37f8f01ea41a561942b1d53df8fdd2b5

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

58:1a:1c:79:4b:ab:9f:8e:fe:59:ad:06:31:35:a3:49:fa:d2:f6:afSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

shell32

advapi32

user32

Sections

Size: - Virtual size: 157KB

Size: - Virtual size: 49KB

Size: - Virtual size: 18KB

.pdata Size: 5KB - Virtual size: 5KB

Size: - Virtual size: 348B

Size: 103KB - Virtual size: 102KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

58:1a:1c:79:4b:ab:9f:8e:fe:59:ad:06:31:35:a3:49:fa:d2:f6:af
Signer

.pdata
Size: 5KB - Virtual size: 5KB