c4737ddb142ea7c3dccd51f7c6cd6b45ed24ca95794b2afc020ed51685c102dd

Sharing

Copy URL

Twitter E-mail

General

Target

c4737ddb142ea7c3dccd51f7c6cd6b45ed24ca95794b2afc020ed51685c102dd
Size

5.4MB
MD5

1b6acb693da33c201cdcf261bccb8d9d
SHA1

b407eb6d9b74cf06630a028fb234ed679ae4c992
SHA256

c4737ddb142ea7c3dccd51f7c6cd6b45ed24ca95794b2afc020ed51685c102dd
SHA512

74b18f75d5f9236b6e3d42cb41b8872142362334cb45cc46e8100778e192b0158177ae059dec130fde6cdc492336f62322a703b7c9982f6f8b6ffdc64dd5db1c
SSDEEP

98304:xr7Qaz7xEpMA4Q7usmDRmyzfpPGtWVyRp1nNiWt4Du8:xXQaz7xEaXsmDR3YtsE94a8

Score

1^/10

Malware Config

Signatures

Files

c4737ddb142ea7c3dccd51f7c6cd6b45ed24ca95794b2afc020ed51685c102dd
.dll windows:5 windows x86 arch:x86

40999cd243754bedec43cf963fc814c9

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:28:96:11:07:88:b1:29:82:5f:b1:d1:f6:ba:ac:a3
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

29-04-2022 00:00

Not After

01-05-2024 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:33:dd:d5:e7:cd:13:7f:4a:a6:1d:f4:55:2f:ae:62:17:34:37:a0:d7:4d:61:7e:6f:c6:69:59:ec:67:b5:e8
Signer

Actual PE Digest

e0:33:dd:d5:e7:cd:13:7f:4a:a6:1d:f4:55:2f:ae:62:17:34:37:a0:d7:4d:61:7e:6f:c6:69:59:ec:67:b5:e8

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Jenkins\workspace\ccd-app\main\native\win32\build\msvs_win32_x86\Release\x86\sym\ProductsAppBL\ProductsAppBL\AppsPanelBL.pdb

Imports

kernel32

FindNextFileW
GetCurrentProcess
RemoveDirectoryW
GetModuleFileNameW
GetTempPathW
FindClose
WaitForSingleObject
OpenProcess
SetFileAttributesW
CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
Process32NextW
DeleteFileW
Process32FirstW
LoadLibraryW
GetProcAddress
CreateProcessW
FreeLibrary
CopyFileW
WideCharToMultiByte
GetExitCodeProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrlenW
GetSystemDirectoryW
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
CreateMutexW
GetFileAttributesW
GetCurrentThreadId
FindFirstFileW
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DecodePointer
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LocalFree
LockFileEx
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionAndSpinCount
GetExitCodeThread
CreateThread
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetTimeZoneInformation
LCMapStringW
FlushFileBuffers
UnmapViewOfFile
CloseHandle
GetLastError
CreateFileW
InitializeCriticalSectionEx
SetFilePointerEx
GetConsoleOutputCP
TerminateProcess
GetConsoleMode
CompareStringW
ReadConsoleW
GetTimeFormatW
DeleteCriticalSection
QueryProcessCycleTime
GetDateFormatW
FindFirstFileExW
ExitProcess
GetModuleHandleExW
GetLocaleInfoW
IsValidCodePage
RtlUnwind
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
FreeLibraryAndExitThread
DeleteFileA
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
WriteFile
InterlockedFlushSList
InterlockedPushEntrySList

user32

GetWindowThreadProcessId
AllowSetForegroundWindow
GetActiveWindow
GetShellWindow
EnumWindows
GetDC
GetDesktopWindow
ReleaseDC

gdi32

GetDeviceCaps

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
GetUserNameW

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetFolderPathW
SHGetKnownFolderPath
SHGetFolderLocation
ShellExecuteW
SHGetPathFromIDListW
ord680

ole32

StringFromGUID2
CoCreateGuid
CoInitialize
CoUninitialize

msi

ord70
ord205

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

winhttp

WinHttpQueryOption
WinHttpReceiveResponse
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpSetCredentials
WinHttpSendRequest
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser

psapi

GetProcessMemoryInfo

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

shlwapi

PathFindFileNameW
PathIsDirectoryW
PathFileExistsA
PathIsRootW
PathAppendW
PathIsSystemFolderW
PathFileExistsW
UrlIsW
PathRemoveFileSpecW
SHGetValueW

api-ms-win-core-libraryloader-l1-2-0

LoadStringA
GetModuleHandleW

oleaut32

VariantClear
SysAllocStringByteLen
VariantChangeType
SafeArrayUnaccessData
SysAllocStringLen
SafeArrayCreateVector
SafeArrayDestroy
VariantInit
SysFreeString
SysStringLen
SysAllocString
SafeArrayAccessData
SysStringByteLen

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-1-0

GetFileSizeEx

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemFree

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalAlloc
GlobalAlloc

api-ms-win-security-base-l1-1-0

EqualSid
RevertToSelf
FreeSid
ImpersonateLoggedOnUser
AllocateAndInitializeSid
GetTokenInformation
DuplicateTokenEx

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-processthreads-l1-1-0

ProcessIdToSessionId
GetStartupInfoW
SuspendThread
GetCurrentThread

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW

api-ms-win-core-synch-l1-1-0

CreateEventW
SetEvent
ResetEvent

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

crypt32

CertGetIssuerCertificateFromStore
CertGetNameStringW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-localization-l1-2-0

GetCPInfo
LCMapStringA
LCMapStringEx
GetUserDefaultLangID

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-namedpipe-l1-1-0

ConnectNamedPipe
CreateNamedPipeW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
SetLastError
SetUnhandledExceptionFilter

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-realtime-l1-1-0

QueryThreadCycleTime

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-localization-ansi-l1-1-0

GetStringTypeExA

Exports

Exports

finalize
initialize
processMessage

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 880KB - Virtual size: 879KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 204KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40999cd243754bedec43cf963fc814c9

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:28:96:11:07:88:b1:29:82:5f:b1:d1:f6:ba:ac:a3Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

e0:33:dd:d5:e7:cd:13:7f:4a:a6:1d:f4:55:2f:ae:62:17:34:37:a0:d7:4d:61:7e:6f:c6:69:59:ec:67:b5:e8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

msi

version

winhttp

psapi

wtsapi32

shlwapi

api-ms-win-core-libraryloader-l1-2-0

oleaut32

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

crypt32

api-ms-win-core-synch-l1-2-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-realtime-l1-1-0

wintrust

api-ms-win-core-debug-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-localization-ansi-l1-1-0

Exports

Exports

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.rdata Size: 880KB - Virtual size: 879KB

.data Size: 41KB - Virtual size: 55KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 204KB - Virtual size: 203KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:28:96:11:07:88:b1:29:82:5f:b1:d1:f6:ba:ac:a3
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

e0:33:dd:d5:e7:cd:13:7f:4a:a6:1d:f4:55:2f:ae:62:17:34:37:a0:d7:4d:61:7e:6f:c6:69:59:ec:67:b5:e8
Signer

.text
Size: 4.2MB - Virtual size: 4.2MB

.rdata
Size: 880KB - Virtual size: 879KB

.data
Size: 41KB - Virtual size: 55KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 204KB - Virtual size: 203KB