b9b8b4058e0cf7e9a9f8aac516026a587b84ce1612c244f3720de336d634f383[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b9b8b4058e0cf7e9a9f8aac516026a587b84ce1612c244f3720de336d634f383.exe
Size

3.2MB
MD5

476d61fb5829b8fcff52b5266a5e9e9d
SHA1

7fde65c50ab513d960a288508feba2dcdbb7db49
SHA256

b9b8b4058e0cf7e9a9f8aac516026a587b84ce1612c244f3720de336d634f383
SHA512

6003a603a6a6e1082552cee10f5dd84f411a06239907e10662e625a1e4b082d380845e05edd2c5d0a604904f54ff606269465d86a3b39f50db68581fc4bfbd92
SSDEEP

49152:3KbTVJvo4btIJs7VOYuhCWWavsgtTahDKLLi+/2spvAaFiLZeeY2N742F5HW0B0/:ELbn7VO5IHaU6+hDIasGaoE52N8XF9H

Score

1^/10

Malware Config

Signatures

Files

b9b8b4058e0cf7e9a9f8aac516026a587b84ce1612c244f3720de336d634f383.exe
.exe windows:6 windows x86 arch:x86

e918c2c508ed6e8c1544377c51944180

Code Sign

82:54:57:31:f2:93:bb:42:af:7d:7a:81:7c:09:28:ec
Certificate

Issuer

CN=TP-wifi OLD City,OU=TP limited Company,O=(2NDRB941-TC),L=˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß,ST=NL,C=model

Not Before

15/02/2024, 07:07

Not After

13/11/2025, 00:00

Subject

CN=TP-wifi OLD City,OU=TP limited Company,O=(2NDRB941-TC),L=˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß˜ß^—ß]˜ß^—à]˜ß^˜à]—ß^—ß^˜à]—ß^—à]˜ß]˜ß]—à^˜ß^—à^—à^—à^—ß]—à]—à^—à^—ß]—ß]—ß^˜ß]—à^˜ß^—ß^—à^˜à]—à^—ß^˜ß]—ß]˜ß^—à^—ß^˜ß]—ß]˜à^—à^—ß]˜à]˜à^—à^˜à]—à]—à^—à]˜ß]—ß^—à]˜à^˜ß]˜à^˜à]˜ß]—ß^—à^—à]—ß^˜ß]—à]˜ß]—à^˜ß^—ß]—à]˜ß]—ß^—ß]˜à]—à^—à]—ß]—à]˜à]—à]—ß]˜à^—ß]—à^˜ß^—à^˜ß]˜ß]—ß^˜à]—ß^˜ß]˜à^˜à]—à^—ß]—ß,ST=NL,C=model

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:82:1a:e4:29:53:a9:77:8b:95:a1:74:cd:26:3a:4d:a6:da:08:f7:83:c0:52:68:b2:37:ac:5e:d9:9d:e1:a1
Signer

Actual PE Digest

41:82:1a:e4:29:53:a9:77:8b:95:a1:74:cd:26:3a:4d:a6:da:08:f7:83:c0:52:68:b2:37:ac:5e:d9:9d:e1:a1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

wsprintfA

gdi32

CreateCompatibleBitmap

advapi32

CredEnumerateA

shell32

ShellExecuteA

ole32

CoInitializeEx

ws2_32

WSAStartup

crypt32

CryptUnprotectData

shlwapi

PathFindExtensionA

gdiplus

GdiplusStartup

setupapi

SetupDiEnumDeviceInterfaces

ntdll

RtlUnicodeStringToAnsiString

Sections

.text
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

“ßV��
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

“ßV��
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

“ßV��
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 260KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e918c2c508ed6e8c1544377c51944180

Code Sign

82:54:57:31:f2:93:bb:42:af:7d:7a:81:7c:09:28:ecCertificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

41:82:1a:e4:29:53:a9:77:8b:95:a1:74:cd:26:3a:4d:a6:da:08:f7:83:c0:52:68:b2:37:ac:5e:d9:9d:e1:a1Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

ws2_32

crypt32

shlwapi

gdiplus

setupapi

ntdll

Sections

.text Size: - Virtual size: 1.0MB

.rdata Size: - Virtual size: 154KB

.data Size: - Virtual size: 13KB

“ßV�� Size: - Virtual size: 1.1MB

“ßV�� Size: 1KB - Virtual size: 1KB

“ßV�� Size: 2.9MB - Virtual size: 2.9MB

.reloc Size: 7KB - Virtual size: 6KB

.rsrc Size: 260KB - Virtual size: 1.2MB

82:54:57:31:f2:93:bb:42:af:7d:7a:81:7c:09:28:ec
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

41:82:1a:e4:29:53:a9:77:8b:95:a1:74:cd:26:3a:4d:a6:da:08:f7:83:c0:52:68:b2:37:ac:5e:d9:9d:e1:a1
Signer

.text
Size: - Virtual size: 1.0MB

.rdata
Size: - Virtual size: 154KB

.data
Size: - Virtual size: 13KB

“ßV��
Size: - Virtual size: 1.1MB

“ßV��
Size: 1KB - Virtual size: 1KB

“ßV��
Size: 2.9MB - Virtual size: 2.9MB

.reloc
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 260KB - Virtual size: 1.2MB