Unconfirmed 757120.crdownload
- SHA256 300c090861a547a4c211b15b9f45d6dcb976128c21b78b6c38d1cf4c5d998e12
Password
infected
Overview
overview
10Static
static
7Unconfirme...20.zip
windows11-21h2-x64
1Coll.zip
windows11-21h2-x64
1APT29miniduke.dll
windows11-21h2-x64
3CozyBearImplant.exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3ImplantCozy.exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3MinidukeAPT29.dll
windows11-21h2-x64
3Nov2018New!/.ds_store
windows11-21h2-x64
3Nov2018New...es.dll
windows11-21h2-x64
10Nov2018New...ty.txt
windows11-21h2-x64
3Nov2018New...01.zip
windows11-21h2-x64
1ds7002.lnk
windows11-21h2-x64
10Nov2018New...02.lnk
windows11-21h2-x64
10Nov2018New...02.zip
windows11-21h2-x64
1ds7002.pdf
windows11-21h2-x64
1SeaDaddyIm...2).exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3SeaDaddyImplant.exe
windows11-21h2-x64
7out.exe
windows11-21h2-x64
3TrojanCozyBear.exe
windows11-21h2-x64
8atiagentCozyBear.dll
windows11-21h2-x64
1Behavioral task
behavioral1
Sample
Unconfirmed 757120.zip
Resource
win11-20240221-en
windows11-21h2-x64
8 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Coll.zip
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral3
Sample
APT29miniduke.dll
Resource
win11-20240221-en
windows11-21h2-x64
2 signatures
1800 seconds
Behavioral task
behavioral4
Sample
CozyBearImplant.exe
Resource
win11-20240221-en
windows11-21h2-x64
1 signatures
1800 seconds
Behavioral task
behavioral5
Sample
out.exe
Resource
win11-20240221-en
windows11-21h2-x64
1 signatures
1800 seconds
Behavioral task
behavioral6
Sample
ImplantCozy.exe
Resource
win11-20240221-en
windows11-21h2-x64
1 signatures
1800 seconds
Behavioral task
behavioral7
Sample
out.exe
Resource
win11-20240221-en
windows11-21h2-x64
1 signatures
1800 seconds
Behavioral task
behavioral8
Sample
MinidukeAPT29.dll
Resource
win11-20240221-en
windows11-21h2-x64
2 signatures
1800 seconds
Behavioral task
behavioral9
Sample
Nov2018New!/.ds_store
Resource
win11-20240221-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral10
Sample
Nov2018New!/AudioSes.dll
Resource
win11-20240221-en
windows11-21h2-x64
2 signatures
1800 seconds
Behavioral task
behavioral11
Sample
Nov2018New!/CozybearNov2018Activity.txt
Resource
win11-20240221-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral12
Sample
Nov2018New!/ds7001.zip
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral13
Sample
ds7002.lnk
Resource
win11-20240221-en
windows11-21h2-x64
12 signatures
1800 seconds
Behavioral task
behavioral14
Sample
Nov2018New!/ds7002.lnk
Resource
win11-20240221-en
windows11-21h2-x64
12 signatures
1800 seconds
Behavioral task
behavioral15
Sample
Nov2018New!/ds7002.zip
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral16
Sample
ds7002.pdf
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
1800 seconds
Behavioral task
behavioral17
Sample
SeaDaddyImplant (2).exe
Resource
win11-20240221-en
windows11-21h2-x64
1 signatures
1800 seconds
Behavioral task
behavioral18
Sample
out.exe
Resource
win11-20240221-en
windows11-21h2-x64
1 signatures
1800 seconds
Behavioral task
behavioral19
Sample
SeaDaddyImplant.exe
Resource
win11-20240221-en
windows11-21h2-x64
1 signatures
1800 seconds
Behavioral task
behavioral20
Sample
out.exe
Resource
win11-20240221-en
windows11-21h2-x64
1 signatures
1800 seconds
Behavioral task
behavioral21
Sample
TrojanCozyBear.exe
Resource
win11-20240221-en
windows11-21h2-x64
11 signatures
1800 seconds
Behavioral task
behavioral22
Sample
atiagentCozyBear.dll
Resource
win11-20240221-en
windows11-21h2-x64
1 signatures
1800 seconds
General
- Target Unconfirmed 757120.crdownload
- Size 13.0MB
- Sample240227-lpd3kade66
- SHA256 300c090861a547a4c211b15b9f45d6dcb976128c21b78b6c38d1cf4c5d998e12
- MD5 e049fd6d80d9285d156cdf5785a6e28e
- SHA1 24752be3d70d5a36280da5b7ecf5b5b77039ac8e
- SHA512 31915051a03611c7b00b0c25225cb905322e777c9aa3ebc600206c5bc6665cd407d61a66925b4d5c82ec350d503b7f0c99df2c3d62411e226ebcc73c3aceea56
- SSDEEP 393216:z7H+xsXvuVGEj5n0ITbPvXSKMMxeeeA5VjfLv:XexYvukEBjSeZeAvv
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack002/CozyBearImplant.bin upx static1/unpack002/ImplantCozy.bin upx static1/unpack002/SeaDaddyImplant (2).bin upx static1/unpack002/SeaDaddyImplant.bin upx - PDF contains JavaScript
Detects presence of JavaScript in PDF files.
- Unsigned PE 11 IoCs
Checks for missing Authenticode signature.
resource unpack002/APT29miniduke.bin unpack002/CozyBearImplant.bin unpack003/out.upx unpack002/ImplantCozy.bin unpack004/out.upx unpack002/MinidukeAPT29.bin unpack002/Nov2018New!/AudioSes.dll unpack002/SeaDaddyImplant (2).bin unpack008/out.upx unpack002/SeaDaddyImplant.bin unpack009/out.upx
File Explorer
-
Unconfirmed 757120.crdownload.zip 13.0MB
-
Coll.CozyBear.zip 12.8MB
-
APT29miniduke.bin.dll 140KB
-
CozyBearImplant.bin.exe 3.0MB
-
out.upx.exe 2.4MB
-
ImplantCozy.bin.exe 3.0MB
-
out.upx.exe 2.4MB
-
MinidukeAPT29.bin.dll 140KB
-
Nov2018New!/.DS_Store6KB
-
Nov2018New!/AudioSes.dll.dll 287KB
-
Nov2018New!/CozybearNov2018Activity.txt148B
-
Nov2018New!/ds7001.zip.zip 228KB
-
ds7002.lnk.lnk 392KB
-
Nov2018New!/ds7002.bin.lnk 392KB
-
Nov2018New!/ds7002.zip.zip 54KB
-
ds7002.pdf.pdf 85KB
-
SeaDaddyImplant (2).bin.exe 3.0MB
-
out.upx.exe 2.4MB
-
SeaDaddyImplant.bin.exe 3.0MB
-
out.upx.exe 2.4MB
-
TrojanCozyBear.bin.exe 330KB
-
atiagentCozyBear.bin.dll 52KB
Coll.CozyBear
- SHA256 fdef234179cd467f728ae51dbb206f1577bc2d73834d105e51a824063f4926c0
- MD5 126e79f6a1959f16c79550b4d955d4dd
- SHA1 99737418dc14520489f4627c767939b0b38dd9f0
- SHA512 e0b1c07489ec18c278e04f0e5236fe0f65dcaf99993a11ec0f3c2636acb952a9b89b5e5a9ddbf2a72169d2a40e47d26253a6b31a1071e94bdd5332c941d5e0a7
- SSDEEP 393216:95ymIGUXU+gb/WzHzrfoycUNULjPwqIxx1hcVmyqMzh8zvUH2YA:95ymIrq/mwyc4U/4xfgmyF9KLJ
- MD5 SHA1 SHA512 SSDEEP
Password
infected
APT29miniduke.bin
- IMPHASH fe3c30d5f4b15cb9aa537c37348cef8e
- SHA256 dd215d76bcfd72ebcfb50ccfeb9fb1703af4bbf4821de225009f43fc4e08e432
- MD5 f08ef840f59cbd4c4695e36ef3eaa9d7
- SHA1 68d3673953dc1e3b6273931572f425402c0ecb1c
- SHA512 9b00ed01389965266ba957109ec46e01f039103986a479c447ad7ab898349f4fe6453204e3813031e276e2da1953a91e9a27dda88402dcaf90ddc201ee0c7718
- SSDEEP 3072:fkumgrfr9NPhDZDEa4qRfOkE7qdjKvoE:MyrfrrhNEufOLi2b
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
52370
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
InterlockedExchange
GetProcAddress
CloseHandle
CreateThread
GetModuleHandleA
GetTickCount
GetLastError
GetTempFileNameW
GetFileSize
CreateDirectoryW
WriteFile
ReadFile
GetModuleFileNameW
CreateFileW
DeleteFileW
GetSystemDirectoryW
LoadLibraryW
MultiByteToWideChar
LoadLibraryA
ExpandEnvironmentStringsW
WriteConsoleW
SetStdHandle
HeapReAlloc
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
LCMapStringW
RtlUnwind
GetModuleHandleW
FreeLibrary
Sleep
GetVolumeInformationW
SetErrorMode
EnterCriticalSection
LeaveCriticalSection
HeapSize
GetCurrentProcessId
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetStdHandle
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
ExitProcess
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
FlushFileBuffers
user32
DefWindowProcW
DispatchMessageW
wsprintfW
DestroyWindow
PostMessageW
TranslateMessage
GetWindowLongW
PeekMessageW
SetWindowLongW
SetWindowPos
CreateWindowExW
RegisterClassW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
shell32
SHGetFolderPathW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
ADB_Add
ADB_Cleanup
ADB_Init
ADB_Load
ADB_Release
ADB_Remove
ADB_Setup
DllMain
Name
.text
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=38, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=93, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=106, id=1, productName=Unmarked objects,
count=44, id=175, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
CozyBearImplant.bin
- SHA256 b101cd29e18a515753409ae86ce68a4cedbe0d640d385eb24b9bbb69cf8186ae
- MD5 ce227ae503e166b77bf46b6c8f5ee4da
- SHA1 cb872edd1f532c10d0167c99530a65c4d4532a1e
- SHA512 529a7c357ba6588482dff00d6d8c245e4c8b97c23ad1f48e1542406c24c6a72f3e1f02752e2ed3cbb904880f3f7dfbab66d9d50ec24ecc3373aba4c334e397b8
- SSDEEP 49152:CCQAYCdp0wNvATRFt03zOavcye0Tiw4qaF8VqGBoGEDyiUmbM7qV3Q7VNb2+f2XU:6CzITRFtyOaE4iqlBcU6MMQPTf2UaESG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
2566640
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=150, version=20413,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=91, id=1, productName=Unmarked objects,
count=25, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
out.upx
- SHA256 d0e083c0154681050e66820be0f2bd64ce764536afb068200a4455ef8fd9d81d
- MD5 e8bc46b4b03cd9d132849cd0047e7f54
- SHA1 0ff34ebde7edc5038d80f3d4b84a93a68cd7849b
- SHA512 b43ca74add4645eb37d1f68ee1cd2b23df7291107bbfc0744c771283bb8f5a3de5dc4e7e64b9b50c0d32ed3eac1f42622a091e9bd62d158b2553740537f0f3c2
- SSDEEP 49152:+kSX6jb5rHEDLBPDu0SVM+RfRYhaTH3IP4H4yn0MdAPYKCW/UL947:7S+x0X4fzYQHR0MdbroK94
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
11361
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=91, id=1, productName=Unmarked objects,
count=25, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
ImplantCozy.bin
- SHA256 6c1bce76f4d2358656132b6b1d471571820688ccdbaca0d86d0ca082b9390536
- MD5 004b55a66b3a86a1ce0a0b9b69b95976
- SHA1 e2b98c594961aae731b0ccee5f9607080ec57197
- SHA512 30ad634e6491bed01cdb7ca448d03094c568a99f786e1d82702d304df041a76b8c062248840c9d7d5572a44a4d47d2a6024a35ff528ad56302273baf2627d308
- SSDEEP 49152:ACQAYCdp0wNvATRFt03zOavcye0mz0c3khqt6L2jOwiQAbM7qV3Q7VNb2+f2XEa5:YCzITRFtyOaEz0q6PS8MMQPTf2UaESjz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
2587360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=150, version=20413,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=91, id=1, productName=Unmarked objects,
count=25, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
out.upx
- SHA256 845f4f84ff1e4dc1e06a9d9996c2758551a41ba0eaff37be920d48512b359a46
- MD5 3c573f4b2567c1ede2be12acc79b9f9b
- SHA1 e518fa185cfadf9893b2993df84d149088fc502a
- SHA512 f7eabdc6341570ac60d7150ac980118bd3d57d90a31f17bfe014101ca797855ec163b98a03f177e210c1d3b5bf00e54494d15d0727c1fef218e016f8683baff5
- SSDEEP 49152:8kSX6jb5rHEDLBPDu0SVM+RfRYhaTH3IP4H4yn0MdAPYKCW/UL948:tS+x0X4fzYQHR0MdbroK94
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
11361
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=91, id=1, productName=Unmarked objects,
count=25, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
MinidukeAPT29.bin
- IMPHASH fe3c30d5f4b15cb9aa537c37348cef8e
- SHA256 c485cbcd5b21db8029654bd47879f086feed41492aebed33a9afe9d73f5069e7
- MD5 887489b27f6e7053ec2702dc8ba51af7
- SHA1 79176c5ad3aeca542f9043657bacf55368a63106
- SHA512 2a5961a14851ada815319f16af0f44d27c35dfdee041a73e7da985a085964a1fb5cae08e8f40c41436800a137f284d945a3e5bfd04a46c37703daec3820988a1
- SSDEEP 3072:fkumgrfr9NPhDZDEa4qRfOkE7qdjKdcE:MyrfrrhNEufOLi2l
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
52370
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
InterlockedExchange
GetProcAddress
CloseHandle
CreateThread
GetModuleHandleA
GetTickCount
GetLastError
GetTempFileNameW
GetFileSize
CreateDirectoryW
WriteFile
ReadFile
GetModuleFileNameW
CreateFileW
DeleteFileW
GetSystemDirectoryW
LoadLibraryW
MultiByteToWideChar
LoadLibraryA
ExpandEnvironmentStringsW
WriteConsoleW
SetStdHandle
HeapReAlloc
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
LCMapStringW
RtlUnwind
GetModuleHandleW
FreeLibrary
Sleep
GetVolumeInformationW
SetErrorMode
EnterCriticalSection
LeaveCriticalSection
HeapSize
GetCurrentProcessId
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetStdHandle
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
ExitProcess
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
FlushFileBuffers
user32
DefWindowProcW
DispatchMessageW
wsprintfW
DestroyWindow
PostMessageW
TranslateMessage
GetWindowLongW
PeekMessageW
SetWindowLongW
SetWindowPos
CreateWindowExW
RegisterClassW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
shell32
SHGetFolderPathW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
ADB_Add
ADB_Cleanup
ADB_Init
ADB_Load
ADB_Release
ADB_Remove
ADB_Setup
DllMain
Name
.text
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=38, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=93, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=106, id=1, productName=Unmarked objects,
count=44, id=175, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Nov2018New!/.DS_Store
- SHA256 d65165279105ca6773180500688df4bdc69a2c7b771752f0a46ef120b7fd8ec3
- MD5 194577a7e20bdcc7afbb718f502c134c
- SHA1 df2fbeb1400acda0909a32c1cf6bf492f1121e07
- SHA512 58941214a8334331e52114aab851fc3d8d5da5dd14983f933da8735c24b0ddcac134e8f13692553199c4d9a14a4b3188b62878a30b9d696edda1204666b60837
- SSDEEP 6:VWAlXN6XkEslX/9ldlXSPnrtHP8//kHLEk0/ulXSPnrtHP8//k:QAXN9EEX/HnXw6XMLEk0/qXw6X
- MD5 SHA1 SHA512 SSDEEP
Nov2018New!/AudioSes.dll
- IMPHASH 3bd6975e0677b610f43ed93a5724d417
- SHA256 b77ff307ea74a3ab41c92036aea4a049b3c2e69b12a857d26910e535544dfb05
- MD5 16bbc967a8b6a365871a05c74a4f345b
- SHA1 9858d5cb2a6614be3c48e33911bf9f7978b441bf
- SHA512 68c75c95ee27fd704088dcf381378a2cd32b396a2e405be4e4f8058cf099d88c9f22c9b9a14eaec45880a2b7ae02226f1277020470aadbc153e8dd3168711f99
- SSDEEP 6144:S7qE85unM8ajZScS8a+ZhcZBaHTT2Q+dFwQG/:Sz8kM8ClMomdwn/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualAlloc
VirtualFree
LoadLibraryA
GetProcAddress
FindResourceA
LoadResource
Sleep
PointFunctionCall
Name
.text
Size
1024B
Virtual Size
921B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
247B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
69B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
283KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
10B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Nov2018New!/CozybearNov2018Activity.txt
- SHA256 07a1d57137b3a7bea66f2f599c95aaf7765e24bcbbefcaf6f7885381d92ded89
- MD5 7e134e9fb8c0da4f3a838774739bece7
- SHA1 7f63feac5c0f4e1611d048a4e34e962b9cfa7ac9
- SHA512 b423cf6eb818845bfd9ae1b3f40efbf217c99821e593e2be13c44618af70a141f4850a12d4bec7b656e3f2b77fcd16c72d2bb970e5e16de4be19c382a6499610
- MD5 SHA1 SHA512
Nov2018New!/ds7001.zip
- SHA256 e2945268c976f8dc33ba9a8d1a804f00cff46aabc01cd3196651322a71863b87
- MD5 3fccf531ff0ae6fedd7c586774b17a2d
- SHA1 cd92f19d3ad4ec50f6d19652af010fe07dca55e1
- SHA512 a67bb72a0ba4b0c27b6a89671bc2cdb871f0c2f420a0a92949ef0d92c9a816e27d48edddced05b793fef2ca4128d2dd69a8fd03300913719802bf39efaec8b84
- SSDEEP 3072:n/1lnc4HECJi42LG3ziivBT4sHXH13X//pxR+b+oIIGLGYcLtGpg6lhhTPueR5d9:nnc4HECJp2GzfRFfwI6cpf9Puwv9
- MD5 SHA1 SHA512 SSDEEP
ds7002.lnk
- SHA256 2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c
- MD5 6ed0020b0851fb71d5b0076f4ee95f3c
- SHA1 e431261c63f94a174a1308defccc674dabbe3609
- SHA512 2a0b04791ab102b6d1760c5f0940969318562f444a5864ebf270f568cc8f6283630ca76377a9fc75691b67e7c459ab10782a2deb439fa9981a2f94bb208232f3
- SSDEEP 6144:4DRFp0LpCYvaVrWb8Fo3L+pOEypzzw0xKtF0JMGaGSNVFOWceCa:4DGFwrvFs+UEIZxUOMG9SUNe1
- MD5 SHA1 SHA512 SSDEEP
Nov2018New!/ds7002.bin
- SHA256 2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c
- MD5 6ed0020b0851fb71d5b0076f4ee95f3c
- SHA1 e431261c63f94a174a1308defccc674dabbe3609
- SHA512 2a0b04791ab102b6d1760c5f0940969318562f444a5864ebf270f568cc8f6283630ca76377a9fc75691b67e7c459ab10782a2deb439fa9981a2f94bb208232f3
- SSDEEP 6144:4DRFp0LpCYvaVrWb8Fo3L+pOEypzzw0xKtF0JMGaGSNVFOWceCa:4DGFwrvFs+UEIZxUOMG9SUNe1
- MD5 SHA1 SHA512 SSDEEP
Nov2018New!/ds7002.zip
- SHA256 1cc77858e5f3513a051a8cf2895891eebe52fdd604017b55030fed0d63cf3faf
- MD5 658c6fe38f95995fa8dc8f6cfe41df7b
- SHA1 7468c9affa3affb003591b2e2ccee3df0b29ecda
- SHA512 429c0f5d9245794809a97462b609301cff05584c3d767b91d44e4481f1437df10b6b53d70cde6e2a044637c0b1ffa2cd3c36ccff621cab822f727099d493941f
- SSDEEP 1536:6YwmgfgCkL6IsoqOY1NXROuDqwIpsnqXW8XsqXcz3:zvEgCM6Is51S42SIXlcT
- MD5 SHA1 SHA512 SSDEEP
ds7002.pdf
- SHA256 b1c811d3f0e930b0096a9e785f730ba4d92458bd6dcfbdff4cf7a1e247ef20d1
- MD5 313f4808aa2a2073005d219bc68971cd
- SHA1 053fb60530e884851eb8b6aebbec4570ec788d4a
- SHA512 1d983f3c659eb3dfac3fe280e7cb3c6e25264752c11ff7d2ab232ffbf30b659a3d61bdf3773ec32caa09de716a3c439dea0d77dab5cb9e07d0e6ec43a0b1a68d
- SSDEEP 1536:D9yCD0gevyGyXKSsoqOY1NXRsBYMKtT63VA5nVpjF4t:D9tDdiIPs51AvkbnM
- MD5 SHA1 SHA512 SSDEEP
SeaDaddyImplant (2).bin
- SHA256 6c1bce76f4d2358656132b6b1d471571820688ccdbaca0d86d0ca082b9390536
- MD5 004b55a66b3a86a1ce0a0b9b69b95976
- SHA1 e2b98c594961aae731b0ccee5f9607080ec57197
- SHA512 30ad634e6491bed01cdb7ca448d03094c568a99f786e1d82702d304df041a76b8c062248840c9d7d5572a44a4d47d2a6024a35ff528ad56302273baf2627d308
- SSDEEP 49152:ACQAYCdp0wNvATRFt03zOavcye0mz0c3khqt6L2jOwiQAbM7qV3Q7VNb2+f2XEa5:YCzITRFtyOaEz0q6PS8MMQPTf2UaESjz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
2587360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=150, version=20413,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=91, id=1, productName=Unmarked objects,
count=25, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
out.upx
- SHA256 845f4f84ff1e4dc1e06a9d9996c2758551a41ba0eaff37be920d48512b359a46
- MD5 3c573f4b2567c1ede2be12acc79b9f9b
- SHA1 e518fa185cfadf9893b2993df84d149088fc502a
- SHA512 f7eabdc6341570ac60d7150ac980118bd3d57d90a31f17bfe014101ca797855ec163b98a03f177e210c1d3b5bf00e54494d15d0727c1fef218e016f8683baff5
- SSDEEP 49152:8kSX6jb5rHEDLBPDu0SVM+RfRYhaTH3IP4H4yn0MdAPYKCW/UL948:tS+x0X4fzYQHR0MdbroK94
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
11361
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=91, id=1, productName=Unmarked objects,
count=25, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
SeaDaddyImplant.bin
- SHA256 b101cd29e18a515753409ae86ce68a4cedbe0d640d385eb24b9bbb69cf8186ae
- MD5 ce227ae503e166b77bf46b6c8f5ee4da
- SHA1 cb872edd1f532c10d0167c99530a65c4d4532a1e
- SHA512 529a7c357ba6588482dff00d6d8c245e4c8b97c23ad1f48e1542406c24c6a72f3e1f02752e2ed3cbb904880f3f7dfbab66d9d50ec24ecc3373aba4c334e397b8
- SSDEEP 49152:CCQAYCdp0wNvATRFt03zOavcye0Tiw4qaF8VqGBoGEDyiUmbM7qV3Q7VNb2+f2XU:6CzITRFtyOaE4iqlBcU6MMQPTf2UaESG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
2566640
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=150, version=20413,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=91, id=1, productName=Unmarked objects,
count=25, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
out.upx
- SHA256 d0e083c0154681050e66820be0f2bd64ce764536afb068200a4455ef8fd9d81d
- MD5 e8bc46b4b03cd9d132849cd0047e7f54
- SHA1 0ff34ebde7edc5038d80f3d4b84a93a68cd7849b
- SHA512 b43ca74add4645eb37d1f68ee1cd2b23df7291107bbfc0744c771283bb8f5a3de5dc4e7e64b9b50c0d32ed3eac1f42622a091e9bd62d158b2553740537f0f3c2
- SSDEEP 49152:+kSX6jb5rHEDLBPDu0SVM+RfRYhaTH3IP4H4yn0MdAPYKCW/UL947:7S+x0X4fzYQHR0MdbroK94
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
11361
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=91, id=1, productName=Unmarked objects,
count=25, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
TrojanCozyBear.bin
- IMPHASH 2695b09a1edda655e0df4b2ef196f37a
- SHA256 01468b1d3e089985a4ed255b6594d24863cfd94a647329c631e4f4e52759f8a9
- MD5 3d3363598f87c78826c859077606e514
- SHA1 8b357ff017df3ed882b278d0dbbdf129235d123d
- SHA512 11a9b8dc666877695a7ea0683c83d057b7539fae7e445250d71fd34fdc557df946b4938bf419ddbdc5f4439f3d828ddb4d83d3a9f7f18cb92454da6fdfd99b24
- SSDEEP 6144:ul5gIO0ZQWhRE0pPuZR4JKeZHBC9FP0/wLi6xVraC/KSNv:ul5gIO0ZQWE08z40e/CDs/+dxQC/l
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
1b:14:7f:b0:a2:17:d8:5d:dc:2c:c7:2c:d4:7e:9c:0b:83:0a:1c:58
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Advanced Micro Devices\, Inc.
Chains
Feb 23, 2024
Subject
CN=Advanced Micro Devices\, Inc.
Serial Number
74:65:f7:35:98:f3:ec:9d:44:ae:2b:54:17:4c:be:4f
Issuer
CN=Advanced Micro Devices\, Inc.
Timespan
Jul 2, 2014 - Dec 31, 2039
Minor OS version
1
Major OS version
5
Entry point
9718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
HeapFree
GetProcessHeap
GetModuleFileNameW
GetSystemDirectoryW
CopyFileW
GetCurrentProcessId
FindResourceW
LoadResource
GetModuleHandleW
SizeofResource
LockResource
VirtualProtect
CloseHandle
CreateFileA
SetFilePointer
CreateDirectoryW
WriteFile
GetFileAttributesW
CreateFileW
MultiByteToWideChar
GetProcAddress
LoadLibraryA
lstrlenA
WideCharToMultiByte
LocalFree
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
EncodePointer
LoadLibraryW
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
HeapReAlloc
GetStringTypeW
LCMapStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers
HeapAlloc
ExpandEnvironmentStringsW
CreatePipe
GetLastError
ReadFile
GetVersionExW
WaitForSingleObject
SetHandleInformation
InterlockedDecrement
CreateProcessW
SetUnhandledExceptionFilter
SetErrorMode
Sleep
IsDebuggerPresent
ExitProcess
user32
wsprintfW
advapi32
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
CryptReleaseContext
CryptAcquireContextW
ole32
CoInitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
oleaut32
SysAllocString
VariantClear
SysFreeString
SysStringLen
VariantInit
shlwapi
PathQuoteSpacesW
PathFileExistsW
PathAddBackslashW
StrStrIW
Name
.text
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
215KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=110, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=48, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=142, id=1, productName=Unmarked objects,
count=15, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
atiagentCozyBear.bin
- IMPHASH 4fcca208e21237d4a38b26f2461938ce
- SHA256 43cd9ef6904c35c6854bf59d99731a05048af9e870261064a255db0181930fad
- MD5 452ee2968ec82c7e30c21c828b330c17
- SHA1 00384c359e2931fb922b034fca2707e1b2a25396
- SHA512 bef788d69d8d75579cbf6499b4c2aec7c413cc56fea2a51efc4dc7742f52648fff3b64b78b3d8544d81ee473472521d352f931b56564a88031c5116444b65926
- SSDEEP 768:5mXbwhMxIYGvy6uqgFuO4IGL1VjOfTaEG9hH36PDMOKqBR4kkJmnjEDXbTvG:uOWIYG66xO4TLHOGjHqhf4kJ9
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
67:3d:aa:9c:92:9e:31:ef:c0:40:91:b8:38:92:8f:04:37:1c:4c:60
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Advanced Micro Devices\, Inc.
Chains
Feb 23, 2024
Subject
CN=Advanced Micro Devices\, Inc.
Serial Number
45:f2:55:cd:72:90:ff:8f:47:3b:79:43:fd:ef:72:23
Issuer
CN=Advanced Micro Devices\, Inc.
Timespan
Aug 20, 2014 - Dec 31, 2039
Minor OS version
1
Major OS version
5
Entry point
14849
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
HeapAlloc
GetLastError
HeapFree
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
ExpandEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetModuleFileNameW
RtlUnwind
HeapSize
HeapReAlloc
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
CreateFileW
FlushFileBuffers
CreateThread
CloseHandle
GetProcAddress
Sleep
LoadLibraryW
CreateProcessW
GetEnvironmentStringsW
GetFullPathNameW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=88, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=31, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=5, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,