c3aaf13e00b2fa20b47d40d2a3a761e9

Sharing

Copy URL Twitter E-mail

General

Target

c3aaf13e00b2fa20b47d40d2a3a761e9
Size

2.9MB
MD5

c3aaf13e00b2fa20b47d40d2a3a761e9
SHA1

a5e6edb17f2fb8b3818e70475aa644ca1589e672
SHA256

e4e17547eda5ad55ec2da710928f2c766c369ef5612f73a18d5049d53dd882f4
SHA512

48e9fd927ded8b2b855ac2628a05154e9fac264c1cc450ed3be33d45ca5449f17a57e81f2d8fa89cbcabf61171c1f9b53619aa9484b31ba97ed78a5f273cafbd
SSDEEP

49152:CrR+n6HfwpFlN8V6Mkcj12PF1XmtBALZQynwu576ZtTBPo54:0+04pFT8tLMN1XoZAwrDQ54

Score

1^/10

Malware Config

Signatures

Files

c3aaf13e00b2fa20b47d40d2a3a761e9
.exe windows:5 windows x86 arch:x86

96778352d99ca84b52328b0725ee1935

Code Sign

7f:2e:ac:50:c0:6d:29:9a:49:ca:f5:d3:49:1c:67:6a
Certificate

Issuer

CN=Acer Nitro 5 AN515-45 [AN515-45-R44U] (NH.QBRER.007)

Not Before

17/06/2021, 17:20

Not After

18/06/2031, 17:20

Subject

CN=Acer Nitro 5 AN515-45 [AN515-45-R44U] (NH.QBRER.007)

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

66:f2:26:57:2a:21:bb:8b:5a:e4:b3:7e:52:37:80:02:49:90:ce:6d:e4:c9:c4:37:66:30:30:84:cd:49:6e:9d
Signer

Actual PE Digest

66:f2:26:57:2a:21:bb:8b:5a:e4:b3:7e:52:37:80:02:49:90:ce:6d:e4:c9:c4:37:66:30:30:84:cd:49:6e:9d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

GetDesktopWindow

advapi32

GetUserNameA

shell32

SHFileOperationA

shlwapi

PathMatchSpecW

psapi

GetModuleFileNameExA

wininet

DeleteUrlCacheEntry

gdiplus

GdipGetImageEncodersSize

Sections

.MPRESS1
Size: 2.8MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

96778352d99ca84b52328b0725ee1935

Code Sign

7f:2e:ac:50:c0:6d:29:9a:49:ca:f5:d3:49:1c:67:6aCertificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

66:f2:26:57:2a:21:bb:8b:5a:e4:b3:7e:52:37:80:02:49:90:ce:6d:e4:c9:c4:37:66:30:30:84:cd:49:6e:9dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

shlwapi

psapi

wininet

gdiplus

Sections

.MPRESS1 Size: 2.8MB - Virtual size: 5.6MB

.MPRESS2 Size: 3KB - Virtual size: 3KB

.rsrc Size: 102KB - Virtual size: 101KB

7f:2e:ac:50:c0:6d:29:9a:49:ca:f5:d3:49:1c:67:6a
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

66:f2:26:57:2a:21:bb:8b:5a:e4:b3:7e:52:37:80:02:49:90:ce:6d:e4:c9:c4:37:66:30:30:84:cd:49:6e:9d
Signer

.MPRESS1
Size: 2.8MB - Virtual size: 5.6MB

.MPRESS2
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 102KB - Virtual size: 101KB