f113097aff2174d48590e69ef656bbe6536d191af9e019c860e7d1596518ae57

Sharing

Copy URL

Twitter E-mail

General

Target

f113097aff2174d48590e69ef656bbe6536d191af9e019c860e7d1596518ae57
Size

111KB
MD5

2dbf882292ad56e48b1a1e2c618f60e8
SHA1

b17ddde04bb3961c7f0fead9752e1c41d2077ec2
SHA256

f113097aff2174d48590e69ef656bbe6536d191af9e019c860e7d1596518ae57
SHA512

fa78f8eedc851da8c1b5ed14ff9d05db110d2767a8db0507020a4f2699dd3329c48bbdff34b2c993b360b6c0755a039efbfc7d658c268ecd61bde4b7b366dda7
SSDEEP

3072:iBy7QwP3prGhVV1aoacccGklB3+aLPMuxL:wykw/wn3a+lD

Score

1^/10

Malware Config

Signatures

Files

f113097aff2174d48590e69ef656bbe6536d191af9e019c860e7d1596518ae57
.dll windows:6 windows x64 arch:x64

63018e72c9c23e1809518a21e8214f7a

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:bc:00:7a:21:03:d8:5e:c8:27:07:10:64:b8:8b:e3
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

03-01-2023 00:00

Not After

11-09-2024 23:59

Subject

CN=International Business Machines Corporation,OU=IBM CCSS,O=International Business Machines Corporation,L=Armonk,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:89:71:eb:13:7d:69:e3:e2:a6:c2:6b:0f:7d:c4:11:89:b8:8b:93:cd:f9:39:b6:b3:40:89:a5:fb:3e:43:df
Signer

Actual PE Digest

90:89:71:eb:13:7d:69:e3:e2:a6:c2:6b:0f:7d:c4:11:89:b8:8b:93:cd:f9:39:b6:b3:40:89:a5:fb:3e:43:df

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\cygwin\home\foreman\sandbox\jcl-bin\jdk\objs\libnet\net.pdb

Imports

ws2_32

WSACleanup
WSASendDisconnect
getprotobyname
getnameinfo
freeaddrinfo
getaddrinfo
WSAEventSelect
WSACreateEvent
WSAStartup
gethostname
gethostbyname
gethostbyaddr
ntohl
htons
htonl
ioctlsocket
getsockopt
__WSAFDIsSet
WSAIoctl
WSAGetLastError
WSASetLastError
setsockopt
ntohs
getsockname
WSACloseEvent

jvm

JVM_CurrentTimeMillis
JVM_InitializeSocketLibrary
jio_snprintf

java

JCL_Shutdown
JCL_Listen
JCL_Accept
JCL_Send
JCL_Select
JCL_Socket
JNU_ThrowNullPointerException
JNU_NewStringPlatform
JNU_GetStringPlatformChars
JNU_ReleaseStringPlatformChars
JCL_Bind
JDK_LoadSystemLibrary
JCL_Recv
getErrorString
JNU_ThrowByNameWithMessageAndLastError
JCL_SendTo
JCL_Close
JNU_ThrowOutOfMemoryError
JNU_ThrowByName
JNU_ThrowByNameWithLastError
JCL_RecvFrom
JCL_Connect

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

dbgwrapper80

dbgCalloc
dbgFree
dbgRealloc
dbgMalloc

kernel32

LeaveCriticalSection
InitializeCriticalSection
GetOverlappedResult
MultiByteToWideChar
GetProcAddress
VerifyVersionInfoW
FormatMessageA
TlsFree
GetVersionExA
Sleep
SetHandleInformation
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
GetModuleHandleW
GetLastError
LocalAlloc
TlsAlloc
TlsGetValue
VerSetConditionMask
TlsSetValue
LocalFree
EnterCriticalSection
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
RaiseException

vcruntime140

strstr
memset
memcpy
__C_specific_handler
__std_type_info_destroy_list
strchr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsscanf
__stdio_common_vsnprintf_s

api-ms-win-crt-string-l1-1-0

isspace
strcpy
strncpy_s
strtok
strncmp
strlen
strcat
wcscpy
strncpy
strcmp
wcslen

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_initterm
_errno
_seh_filter_dll

api-ms-win-crt-convert-l1-1-0

atoi

Exports

Exports

JNI_OnLoad
JNI_OnUnload
Java_com_ibm_net_SocketUtils_configureKeepAlive
Java_java_net_DatagramPacket_init
Java_java_net_DualStackPlainDatagramSocketImpl_dataAvailable
Java_java_net_DualStackPlainDatagramSocketImpl_initIDs
Java_java_net_DualStackPlainDatagramSocketImpl_socketBind
Java_java_net_DualStackPlainDatagramSocketImpl_socketClose
Java_java_net_DualStackPlainDatagramSocketImpl_socketConnect
Java_java_net_DualStackPlainDatagramSocketImpl_socketCreate
Java_java_net_DualStackPlainDatagramSocketImpl_socketDisconnect
Java_java_net_DualStackPlainDatagramSocketImpl_socketGetIntOption
Java_java_net_DualStackPlainDatagramSocketImpl_socketLocalAddress
Java_java_net_DualStackPlainDatagramSocketImpl_socketLocalPort
Java_java_net_DualStackPlainDatagramSocketImpl_socketReceiveOrPeekData
Java_java_net_DualStackPlainDatagramSocketImpl_socketSend
Java_java_net_DualStackPlainDatagramSocketImpl_socketSetIntOption
Java_java_net_DualStackPlainSocketImpl_accept0
Java_java_net_DualStackPlainSocketImpl_available0
Java_java_net_DualStackPlainSocketImpl_bind0
Java_java_net_DualStackPlainSocketImpl_close0
Java_java_net_DualStackPlainSocketImpl_configureBlocking
Java_java_net_DualStackPlainSocketImpl_connect0
Java_java_net_DualStackPlainSocketImpl_getIntOption
Java_java_net_DualStackPlainSocketImpl_initIDs
Java_java_net_DualStackPlainSocketImpl_listen0
Java_java_net_DualStackPlainSocketImpl_localAddress
Java_java_net_DualStackPlainSocketImpl_localPort0
Java_java_net_DualStackPlainSocketImpl_sendOOB
Java_java_net_DualStackPlainSocketImpl_setIntOption
Java_java_net_DualStackPlainSocketImpl_shutdown0
Java_java_net_DualStackPlainSocketImpl_socket0
Java_java_net_DualStackPlainSocketImpl_waitForConnect
Java_java_net_DualStackPlainSocketImpl_waitForNewConnection
Java_java_net_Inet4AddressImpl_getHostByAddr
Java_java_net_Inet4AddressImpl_getLocalHostName
Java_java_net_Inet4AddressImpl_isReachable0
Java_java_net_Inet4AddressImpl_lookupAllHostAddr
Java_java_net_Inet4Address_init
Java_java_net_Inet6AddressImpl_getHostByAddr
Java_java_net_Inet6AddressImpl_getLocalHostName
Java_java_net_Inet6AddressImpl_isReachable0
Java_java_net_Inet6AddressImpl_lookupAllHostAddr
Java_java_net_Inet6Address_init
Java_java_net_InetAddressImplFactory_isIPv6Supported
Java_java_net_InetAddress_init
Java_java_net_NetworkInterface_getAll
Java_java_net_NetworkInterface_getAll_XP
Java_java_net_NetworkInterface_getByIndex0
Java_java_net_NetworkInterface_getByIndex0_XP
Java_java_net_NetworkInterface_getByInetAddress0
Java_java_net_NetworkInterface_getByInetAddress0_XP
Java_java_net_NetworkInterface_getByName0
Java_java_net_NetworkInterface_getByName0_XP
Java_java_net_NetworkInterface_getMTU0
Java_java_net_NetworkInterface_getMTU0_XP
Java_java_net_NetworkInterface_getMacAddr0
Java_java_net_NetworkInterface_getMacAddr0_XP
Java_java_net_NetworkInterface_init
Java_java_net_NetworkInterface_isLoopback0
Java_java_net_NetworkInterface_isLoopback0_XP
Java_java_net_NetworkInterface_isP2P0
Java_java_net_NetworkInterface_isP2P0_XP
Java_java_net_NetworkInterface_isUp0
Java_java_net_NetworkInterface_isUp0_XP
Java_java_net_NetworkInterface_supportsMulticast0
Java_java_net_NetworkInterface_supportsMulticast0_XP
Java_java_net_SocketInputStream_init
Java_java_net_SocketInputStream_socketRead0
Java_java_net_SocketOutputStream_init
Java_java_net_SocketOutputStream_socketWrite0
Java_java_net_TwoStacksPlainDatagramSocketImpl_bind0
Java_java_net_TwoStacksPlainDatagramSocketImpl_connect0
Java_java_net_TwoStacksPlainDatagramSocketImpl_dataAvailable
Java_java_net_TwoStacksPlainDatagramSocketImpl_datagramSocketClose
Java_java_net_TwoStacksPlainDatagramSocketImpl_datagramSocketCreate
Java_java_net_TwoStacksPlainDatagramSocketImpl_disconnect0
Java_java_net_TwoStacksPlainDatagramSocketImpl_getTTL
Java_java_net_TwoStacksPlainDatagramSocketImpl_getTimeToLive
Java_java_net_TwoStacksPlainDatagramSocketImpl_init
Java_java_net_TwoStacksPlainDatagramSocketImpl_join
Java_java_net_TwoStacksPlainDatagramSocketImpl_leave
Java_java_net_TwoStacksPlainDatagramSocketImpl_peek
Java_java_net_TwoStacksPlainDatagramSocketImpl_peekData
Java_java_net_TwoStacksPlainDatagramSocketImpl_receive0
Java_java_net_TwoStacksPlainDatagramSocketImpl_send
Java_java_net_TwoStacksPlainDatagramSocketImpl_setTTL
Java_java_net_TwoStacksPlainDatagramSocketImpl_setTimeToLive
Java_java_net_TwoStacksPlainDatagramSocketImpl_socketGetOption
Java_java_net_TwoStacksPlainDatagramSocketImpl_socketLocalAddress
Java_java_net_TwoStacksPlainDatagramSocketImpl_socketNativeSetOption
Java_java_net_TwoStacksPlainSocketImpl_initProto
Java_java_net_TwoStacksPlainSocketImpl_socketAccept
Java_java_net_TwoStacksPlainSocketImpl_socketAvailable
Java_java_net_TwoStacksPlainSocketImpl_socketBind
Java_java_net_TwoStacksPlainSocketImpl_socketClose0
Java_java_net_TwoStacksPlainSocketImpl_socketConnect
Java_java_net_TwoStacksPlainSocketImpl_socketCreate
Java_java_net_TwoStacksPlainSocketImpl_socketGetOption
Java_java_net_TwoStacksPlainSocketImpl_socketListen
Java_java_net_TwoStacksPlainSocketImpl_socketNativeSetOption
Java_java_net_TwoStacksPlainSocketImpl_socketSendUrgentData
Java_java_net_TwoStacksPlainSocketImpl_socketShutdown
Java_sun_net_ExtendedOptionsImpl_flowSupported
Java_sun_net_ExtendedOptionsImpl_getFlowOption
Java_sun_net_ExtendedOptionsImpl_init
Java_sun_net_ExtendedOptionsImpl_setFlowOption
Java_sun_net_PortConfig_getLower0
Java_sun_net_PortConfig_getUpper0
Java_sun_net_dns_ResolverConfigurationImpl_init0
Java_sun_net_dns_ResolverConfigurationImpl_loadDNSconfig0
Java_sun_net_dns_ResolverConfigurationImpl_notifyAddrChange0
Java_sun_net_spi_DefaultProxySelector_getSystemProxy
Java_sun_net_spi_DefaultProxySelector_init
Java_sun_net_www_protocol_http_ntlm_NTLMAuthSequence_getCredentialsHandle
Java_sun_net_www_protocol_http_ntlm_NTLMAuthSequence_getNextToken
Java_sun_net_www_protocol_http_ntlm_NTLMAuthSequence_initFirst
Java_sun_net_www_protocol_http_ntlm_NTLMAuthentication_isTrustedSite0
Java_sun_net_www_protocol_http_ntlm_NTLMAuthentication_isTrustedSiteAvailable0
NET_Bind
NET_BindV6
NET_EnableFastTcpLoopback
NET_GetPortFromSockaddr
NET_GetSockOpt
NET_InetAddressToSockaddr
NET_MapSocketOption
NET_MapSocketOptionV6
NET_SetSockOpt
NET_SockaddrEqualsInetAddress
NET_SockaddrToInetAddress
NET_SocketClose
NET_ThrowNew
NET_Timeout
NET_Timeout2
NET_WinBind
ipv6_available
isOs400

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63018e72c9c23e1809518a21e8214f7a

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

04:bc:00:7a:21:03:d8:5e:c8:27:07:10:64:b8:8b:e3Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

90:89:71:eb:13:7d:69:e3:e2:a6:c2:6b:0f:7d:c4:11:89:b8:8b:93:cd:f9:39:b6:b3:40:89:a5:fb:3e:43:dfSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

jvm

java

advapi32

dbgwrapper80

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 65KB - Virtual size: 65KB

.rdata Size: 27KB - Virtual size: 26KB

.data Size: 3KB - Virtual size: 6KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 904B

.reloc Size: 512B - Virtual size: 228B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:bc:00:7a:21:03:d8:5e:c8:27:07:10:64:b8:8b:e3
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

90:89:71:eb:13:7d:69:e3:e2:a6:c2:6b:0f:7d:c4:11:89:b8:8b:93:cd:f9:39:b6:b3:40:89:a5:fb:3e:43:df
Signer

.text
Size: 65KB - Virtual size: 65KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 3KB - Virtual size: 6KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 904B

.reloc
Size: 512B - Virtual size: 228B