c18a5a8dd0dc6a40b52e437adcb497b62d4acd117fb93b782482f9632d8fd249

Sharing

Copy URL Twitter E-mail

General

Target

c18a5a8dd0dc6a40b52e437adcb497b62d4acd117fb93b782482f9632d8fd249
Size

62KB
MD5

37d164531d7353710cacfcb93473b617
SHA1

4089e0bb73f81e103340324a6cd2d8268efdc63c
SHA256

c18a5a8dd0dc6a40b52e437adcb497b62d4acd117fb93b782482f9632d8fd249
SHA512

751fa35acc463287b3973ddc66d22d57f752d8ada0db9bbbd36552455d5097f52c3dd427d91e6a2033fd252b3f100833bb06c8e6eaaf4bed9bb19a411d459dd9
SSDEEP

768:N77yPCelPFu+g5kWdjYl5WkIu9QPkcct28MK58WD/Gc78mDuO9zUVO:ZQCelTgycjLkIxPkcHvKr8Yz9

Score

1^/10

Malware Config

Signatures

Files

c18a5a8dd0dc6a40b52e437adcb497b62d4acd117fb93b782482f9632d8fd249
.dll windows:4 windows x64 arch:x64

9452936e79719d01158cb64cbe64208e

Code Sign

33:00:00:03:84:d9:68:7d:66:cc:75:4b:a1:00:00:00:00:03:84
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2023, 23:45

Not After

15/09/2024, 23:45

Subject

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cc:69:51:60:cf:d9:44:d4:71:ec:5b:32:52:55:52:a9:ac:db:84:b9:c3:81:4b:ca:3b:be:62:d1:58:e2:14:c7
Signer

Actual PE Digest

cc:69:51:60:cf:d9:44:d4:71:ec:5b:32:52:55:52:a9:ac:db:84:b9:c3:81:4b:ca:3b:be:62:d1:58:e2:14:c7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\git-sdk-64-full\usr\src\MINGW-packages\mingw-w64-openssl\src\build-MINGW64\engines\loader_attic.pdb

Imports

libcrypto-3-x64

BIO_ctrl
BIO_f_buffer
BIO_free
BIO_free_all
BIO_new
BIO_new_file
BIO_pop
BIO_push
BIO_read
BIO_snprintf
BIO_write
BN_CTX_free
BN_CTX_new
BN_bn2lebinpad
BN_free
BN_lebin2bn
BN_mod_exp
BN_new
BN_num_bits
BN_set_flags
BN_set_word
BUF_MEM_free
BUF_MEM_new
CRYPTO_clear_free
CRYPTO_free
CRYPTO_malloc
CRYPTO_secure_clear_free
CRYPTO_set_mem_functions
CRYPTO_strdup
CRYPTO_zalloc
DSA_free
DSA_get0_key
DSA_get0_pqg
DSA_new
DSA_set0_key
DSA_set0_pqg
ENGINE_get_first
ENGINE_get_next
ENGINE_get_pkey_asn1_meths
ENGINE_get_static_state
ENGINE_set_destroy_function
ENGINE_set_finish_function
ENGINE_set_id
ENGINE_set_init_function
ENGINE_set_name
ERR_add_error_data
ERR_clear_last_mark
ERR_get_next_error_library
ERR_load_strings
ERR_new
ERR_peek_error
ERR_peek_last_error
ERR_pop_to_mark
ERR_set_debug
ERR_set_error
ERR_set_mark
ERR_unload_strings
EVP_CIPHER_CTX_free
EVP_CIPHER_CTX_new
EVP_CIPHER_fetch
EVP_CIPHER_free
EVP_DecryptFinal_ex
EVP_DecryptInit_ex
EVP_DecryptUpdate
EVP_DigestFinal_ex
EVP_DigestInit_ex
EVP_DigestUpdate
EVP_EncryptFinal_ex
EVP_EncryptInit_ex
EVP_EncryptUpdate
EVP_MD_CTX_free
EVP_MD_CTX_new
EVP_MD_fetch
EVP_MD_free
EVP_PKCS82PKEY_ex
EVP_PKEY_asn1_find_str
EVP_PKEY_asn1_get0
EVP_PKEY_asn1_get0_info
EVP_PKEY_asn1_get_count
EVP_PKEY_free
EVP_PKEY_get0_DSA
EVP_PKEY_get0_RSA
EVP_PKEY_get_id
EVP_PKEY_is_a
EVP_PKEY_new
EVP_PKEY_set1_DSA
EVP_PKEY_set1_RSA
OPENSSL_DIR_end
OPENSSL_DIR_read
OPENSSL_cleanse
OPENSSL_init_crypto
OPENSSL_sk_new_null
OPENSSL_sk_num
OPENSSL_sk_pop_free
OPENSSL_sk_push
OPENSSL_sk_shift
OPENSSL_sk_value
OPENSSL_strlcat
OPENSSL_strncasecmp
OSSL_STORE_INFO_free
OSSL_STORE_INFO_get0_data
OSSL_STORE_INFO_get_type
OSSL_STORE_INFO_new
OSSL_STORE_INFO_new_CERT
OSSL_STORE_INFO_new_CRL
OSSL_STORE_INFO_new_NAME
OSSL_STORE_INFO_new_PARAMS
OSSL_STORE_INFO_new_PKEY
OSSL_STORE_INFO_new_PUBKEY
OSSL_STORE_LOADER_free
OSSL_STORE_LOADER_new
OSSL_STORE_LOADER_set_attach
OSSL_STORE_LOADER_set_close
OSSL_STORE_LOADER_set_ctrl
OSSL_STORE_LOADER_set_eof
OSSL_STORE_LOADER_set_error
OSSL_STORE_LOADER_set_expect
OSSL_STORE_LOADER_set_find
OSSL_STORE_LOADER_set_load
OSSL_STORE_LOADER_set_open
OSSL_STORE_LOADER_set_open_ex
OSSL_STORE_SEARCH_get0_name
OSSL_STORE_SEARCH_get_type
OSSL_STORE_register_loader
OSSL_STORE_unregister_loader
PEM_def_callback
PEM_do_header
PEM_get_EVP_CIPHER_INFO
PEM_read_bio
PEM_read_bio_ex
PKCS12_free
PKCS12_mac_present
PKCS12_parse
PKCS12_pbe_crypt
PKCS12_verify_mac
PKCS8_PRIV_KEY_INFO_free
RAND_bytes_ex
RSA_bits
RSA_free
RSA_get0_crt_params
RSA_get0_factors
RSA_get0_key
RSA_new
RSA_set0_crt_params
RSA_set0_factors
RSA_set0_key
RSA_size
UI_add_input_string
UI_add_user_data
UI_construct_prompt
UI_free
UI_new
UI_process
UI_set_method
X509_CRL_free
X509_NAME_hash_ex
X509_SIG_free
X509_SIG_get0
X509_free
X509_new_ex
asn1_d2i_read_bio
d2i_KeyParams
d2i_PKCS12
d2i_PKCS8_PRIV_KEY_INFO
d2i_PUBKEY
d2i_PrivateKey_ex
d2i_X509
d2i_X509_AUX
d2i_X509_CRL
d2i_X509_SIG

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__iob_func
_amsg_exit
_errno
_initterm
_lock
_stat64
_unlock
abort
calloc
free
fwrite
realloc
strcmp
strlen
strncmp
strstr
tolower
vfprintf

Exports

Exports

bind_engine
v_check

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 272B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 97B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug
Size: 156B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9452936e79719d01158cb64cbe64208e

Code Sign

33:00:00:03:84:d9:68:7d:66:cc:75:4b:a1:00:00:00:00:03:84Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

cc:69:51:60:cf:d9:44:d4:71:ec:5b:32:52:55:52:a9:ac:db:84:b9:c3:81:4b:ca:3b:be:62:d1:58:e2:14:c7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libcrypto-3-x64

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 33KB

.data Size: 1024B - Virtual size: 768B

.rdata Size: 3KB - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.xdata Size: 1KB - Virtual size: 1KB

.bss Size: - Virtual size: 272B

.edata Size: 512B - Virtual size: 97B

.idata Size: 8KB - Virtual size: 7KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 164B

.debug Size: 156B - Virtual size: 512B

33:00:00:03:84:d9:68:7d:66:cc:75:4b:a1:00:00:00:00:03:84
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

cc:69:51:60:cf:d9:44:d4:71:ec:5b:32:52:55:52:a9:ac:db:84:b9:c3:81:4b:ca:3b:be:62:d1:58:e2:14:c7
Signer

.text
Size: 34KB - Virtual size: 33KB

.data
Size: 1024B - Virtual size: 768B

.rdata
Size: 3KB - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.xdata
Size: 1KB - Virtual size: 1KB

.bss
Size: - Virtual size: 272B

.edata
Size: 512B - Virtual size: 97B

.idata
Size: 8KB - Virtual size: 7KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 164B

.debug
Size: 156B - Virtual size: 512B