Core Temp[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Core Temp.exe
Size

1015KB
MD5

005727aa95c9f4899ea7673b114d91de
SHA1

ad96a46fe68428dc293db99b53a0593b6bc1d786
SHA256

26259a6f290a799eeb1c7c9b311e528c77e458582f9396d4dfc1c69dd2ad6891
SHA512

9e0dbb00b37e957114b7d74663600e041cad88d1940f4f3489e7eb7c347e51e8ede97ef054f5614f32facb5c6364b724a7781fb9047f190614718e8325952577
SSDEEP

12288:IpQFdpMDe+6YIc+O89kebn5vUOy/T56AnrWNz5S9593KIdarsCZgtK:IpQFdSDX6Vc8q9HiNz5IT3VdarsCZgtK

Score

1^/10

Malware Config

Signatures

Files

Core Temp.exe
.exe windows:5 windows x64 arch:x64

6bdb3a5e0aec4758aa1e8f6e9c8c0a93

Code Sign

9a:98:ab:f4:94:19:a8:44:9c:06:f8:5c:19:a5:51:a8
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

18-05-2021 00:00

Not After

17-05-2024 23:59

Subject

CN=ALCPU,O=ALCPU,L=Ramat Gan,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

92:39:e7:51:e3:db:b7:4d:38:dc:a5:c4:98:51:26:79:17:7d:fc:ec:cc:1e:49:ba:fa:48:d1:92:90:4f:e5:26
Signer

Actual PE Digest

92:39:e7:51:e3:db:b7:4d:38:dc:a5:c4:98:51:26:79:17:7d:fc:ec:cc:1e:49:ba:fa:48:d1:92:90:4f:e5:26

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\Programming\CoreTemp\CoreTempDriverRework\x64\Release\Core Temp.pdb

Imports

comctl32

ImageList_AddMasked
ImageList_GetIcon
ImageList_Destroy
ImageList_Create
InitCommonControlsEx

powrprof

SetSuspendState

gdiplus

GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageWidth
GdipSaveImageToFile
GdipDisposeImage
GdipLoadImageFromFile
GdipAlloc
GdipFree

kernel32

DeviceIoControl
FindNextFileW
FreeResource
LockResource
LoadResource
FindResourceW
EnumResourceNamesW
GetUserDefaultUILanguage
QueryPerformanceFrequency
QueryPerformanceCounter
LocalAlloc
lstrcpynW
FreeLibrary
LoadLibraryW
GetFileSize
TerminateThread
SetErrorMode
SetFileAttributesW
RemoveDirectoryW
WaitForMultipleObjects
SetThreadPriority
SetPriorityClass
ReadFile
GetModuleFileNameA
GetVersion
HeapReAlloc
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointer
CloseHandle
GetFileType
SetHandleCount
GetStringTypeW
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
WideCharToMultiByte
HeapCreate
HeapSetInformation
ExitProcess
GetStdHandle
GetTimeZoneInformation
FlsAlloc
GetCurrentThreadId
SetLastError
FlsFree
FlsSetValue
FlsGetValue
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetCommandLineW
DeleteFileA
RtlPcToFileHeader
RaiseException
HeapFree
GetTimeFormatW
HeapAlloc
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
RtlUnwindEx
RtlLookupFunctionEntry
MultiByteToWideChar
FindFirstFileW
FindClose
GetFileSizeEx
GetFullPathNameW
VerSetConditionMask
VerifyVersionInfoW
GetModuleHandleW
GetProcAddress
GetVersionExW
GetLocalTime
GetTickCount
GetModuleFileNameW
Sleep
MulDiv
CreateFileA
CompareStringW
SetEnvironmentVariableW
WriteConsoleW
SetEndOfFile
GetProcessHeap
SetEnvironmentVariableA
GetExitCodeThread
LoadLibraryA
CreateThread
GetCurrentThread
GetCurrentProcess
GetDateFormatW
FormatMessageW
LocalFree
UnmapViewOfFile
CreateMutexW
WaitForSingleObject
CreateFileMappingW
MapViewOfFile
CreateFileW
WriteFile
DeleteFileW
OpenMutexW
GetLastError
EnterCriticalSection
ReleaseMutex
DeleteCriticalSection

user32

LoadMenuW
DrawMenuBar
GetClassNameW
GetMenuItemInfoW
GetMenuStringW
SetMenuItemInfoW
ScreenToClient
GetClassInfoExW
GetDlgCtrlID
GetSysColorBrush
CopyRect
SetFocus
DestroyIcon
MonitorFromPoint
FillRect
LoadStringW
LoadAcceleratorsW
FindWindowW
IsIconic
OffsetRect
MapDialogRect
SetRectEmpty
GetDialogBaseUnits
ReleaseDC
GetDC
GetSystemMetrics
CreateWindowExW
SetWindowPos
CallWindowProcW
GetWindowLongPtrW
GetSysColor
MessageBoxW
MapWindowPoints
GetParent
GetWindowRect
MoveWindow
GetClientRect
GetWindowTextW
SendMessageW
SetCursor
AdjustWindowRectEx
DrawTextExW
ExitWindowsEx
CreateDialogParamW
PostMessageW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
LoadIconW
RegisterClassExW
RegisterWindowMessageA
RegisterWindowMessageW
DefWindowProcW
GetSubMenu
PostQuitMessage
DestroyWindow
DialogBoxParamW
EnableMenuItem
GetMenuState
GetMenu
SetWindowLongW
SetTimer
KillTimer
EnableWindow
GetWindowLongW
EnumChildWindows
SendNotifyMessageW
GetDlgItem
EndDialog
SetWindowLongPtrW
SetWindowTextW
CreatePopupMenu
GetMenuItemCount
InsertMenuItemW
CheckMenuItem
GetCursorPos
TrackPopupMenu
DestroyMenu
SetForegroundWindow
UpdateWindow
LoadBitmapW
InvalidateRect
ShowWindow
LoadCursorW
SystemParametersInfoW

gdi32

CreateCompatibleDC
BitBlt
DeleteObject
DeleteDC
SelectObject
GetTextExtentPoint32W
CreateSolidBrush
SetTextColor
SetBkColor
GetDeviceCaps
CreateBrushIndirect
CreateBitmap
CreateDIBSection
CreateFontIndirectW
CreateFontW
GetTextMetricsW
SetTextAlign
TextOutW

comdlg32

ChooseFontW
ChooseColorW
GetSaveFileNameW
GetOpenFileNameW

advapi32

RegDeleteValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
InitializeSecurityDescriptor
AllocateAndInitializeSid
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExW
RegOpenKeyExW
CloseServiceHandle
DeleteService
ControlService
OpenServiceW
OpenSCManagerW
StartServiceW
CreateServiceW
GetUserNameW
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl

shell32

Shell_NotifyIconW
ExtractIconW
ShellExecuteW

ole32

CoCreateInstance
CoInitialize

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

shlwapi

PathAppendW
PathRemoveFileSpecW
PathIsFileSpecW

ws2_32

socket
connect
WSACleanup
gethostbyname
inet_ntoa
htons
inet_addr
WSAStartup
send
recv
shutdown
closesocket

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo

Sections

.text
Size: 581KB - Virtual size: 580KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bdb3a5e0aec4758aa1e8f6e9c8c0a93

Code Sign

9a:98:ab:f4:94:19:a8:44:9c:06:f8:5c:19:a5:51:a8Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

92:39:e7:51:e3:db:b7:4d:38:dc:a5:c4:98:51:26:79:17:7d:fc:ec:cc:1e:49:ba:fa:48:d1:92:90:4f:e5:26Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

powrprof

gdiplus

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

version

setupapi

Sections

.text Size: 581KB - Virtual size: 580KB

.rdata Size: 172KB - Virtual size: 171KB

.data Size: 14KB - Virtual size: 191KB

.pdata Size: 30KB - Virtual size: 29KB

.rsrc Size: 119KB - Virtual size: 118KB

.reloc Size: 7KB - Virtual size: 6KB

9a:98:ab:f4:94:19:a8:44:9c:06:f8:5c:19:a5:51:a8
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

92:39:e7:51:e3:db:b7:4d:38:dc:a5:c4:98:51:26:79:17:7d:fc:ec:cc:1e:49:ba:fa:48:d1:92:90:4f:e5:26
Signer

.text
Size: 581KB - Virtual size: 580KB

.rdata
Size: 172KB - Virtual size: 171KB

.data
Size: 14KB - Virtual size: 191KB

.pdata
Size: 30KB - Virtual size: 29KB

.rsrc
Size: 119KB - Virtual size: 118KB

.reloc
Size: 7KB - Virtual size: 6KB