04f62994de2aa620040a1e3d0e1533b45588f29492b19865f5fed998b2454f8e

Sharing

Copy URL Twitter E-mail

General

Target

04f62994de2aa620040a1e3d0e1533b45588f29492b19865f5fed998b2454f8e
Size

2.8MB
MD5

6bbefb378b116bc3d95882390d6651a8
SHA1

a2674ef6e73788e67e8b521262ae3ea4f98ebfa2
SHA256

04f62994de2aa620040a1e3d0e1533b45588f29492b19865f5fed998b2454f8e
SHA512

d6cc650e46a663e64c4b8231fc33c918d361a46085a56815272c3e1c63e765a744108b8e54ffba59b228b2641b239abb9f49781de1078da958d4ba91118b095e
SSDEEP

49152:W2gWECCA4Bte6e9N60oVr0WJ+RdJUt32kHQyx4m7vuzYTUD8XOdjDKdefVUMC:W2gDCSte6UsDoZR/U928QyxdCYTFaNVU

Score

1^/10

Malware Config

Signatures

Files

04f62994de2aa620040a1e3d0e1533b45588f29492b19865f5fed998b2454f8e
.exe windows:6 windows x86 arch:x86

ec1705b6ad330f25047022c193a20ab8

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f1:c2:c6:4e:42:92:57:ab:c6:99:d7:bb:66:5f:e5:57:b3:40:5f:41:04:5d:60:06:32:b8:35:91:72:1b:e5:70
Signer

Actual PE Digest

f1:c2:c6:4e:42:92:57:ab:c6:99:d7:bb:66:5f:e5:57:b3:40:5f:41:04:5d:60:06:32:b8:35:91:72:1b:e5:70

Digest Algorithm

sha256

PE Digest Matches

true

6c:27:72:1d:d6:f9:0a:b6:5c:2d:76:50:56:00:b2:f4:ce:a8:b3:89
Signer

Actual PE Digest

6c:27:72:1d:d6:f9:0a:b6:5c:2d:76:50:56:00:b2:f4:ce:a8:b3:89

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualQueryEx
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetSystemTimeAsFileTime
CreateProcessW
CopyFileW
SetEndOfFile
GetDateFormatW
GetModuleHandleW
CreateThread
SetEvent
Sleep
CreateEventW
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcess
GetCurrentThread
GetVersionExW
GetProcessHeap
MapViewOfFile
CreateFileMappingW
DecodePointer
WriteConsoleW
HeapSize
GetTimeZoneInformation
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
SystemTimeToFileTime
ReadProcessMemory
SetStdHandle
GetConsoleOutputCP
FlushFileBuffers
LCMapStringW
CompareStringW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetConsoleCtrlHandler
GetCommandLineW
GetCommandLineA
LoadLibraryExW
EncodePointer
RaiseException
FindResourceW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryA
FreeLibrary
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
VirtualAlloc
TerminateProcess
K32GetProcessImageFileNameW
GetVersionExA
ExpandEnvironmentStringsA
GetComputerNameA
GetCurrentThreadId
ExitProcess
IsDebuggerPresent
GetSystemTime
GetFullPathNameW
GetCurrentProcessId
DuplicateHandle
OpenProcess
OpenFileMappingW
GetLongPathNameW
SizeofResource
LockResource
GetCurrentDirectoryW
GetSystemInfo
GetFileSizeEx
MoveFileExW
GetFileSize
GetFileInformationByHandle
HeapAlloc
SetFilePointer
GetTickCount
GetProcAddress
LoadLibraryW
SetFilePointerEx
CompareFileTime
FindClose
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
GetFileAttributesW
DeleteFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
WriteFile
CloseHandle
UnmapViewOfFile
WideCharToMultiByte
GetLocalTime
OutputDebugStringW
MultiByteToWideChar
CreateFileW
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReadFile
GetLastError
HeapFree
DeleteFiber
SwitchToFiber
QueryPerformanceCounter
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetFileType
GetEnvironmentVariableW
GetStdHandle
LoadResource
SetFileAttributesW
FormatMessageW
GetSystemDirectoryW
GetTempPathW
GetComputerNameW
GetDriveTypeW
RtlUnwind
GetLogicalDrives
SetLastError
HeapReAlloc
FindFirstFileExW

user32

ReleaseDC
SetWindowPos
LoadIconW
SetWindowTextW
GetClientRect
LoadImageW
ClientToScreen
GetParent
SetWindowLongW
SetClassLongW
GetWindowLongW
GetFocus
GetWindowThreadProcessId
PostMessageW
DrawTextExW
KillTimer
ShowWindow
GetProcessWindowStation
GetUserObjectInformationW
DialogBoxParamW
EndDialog
EnumWindows
CharUpperA
GetDC
GetDlgItem
GetWindowTextW
GetClassNameW
CharLowerBuffW
MessageBoxW
IsCharAlphaNumericW
SetFocus
GetWindowRect
CharUpperBuffW
SystemParametersInfoW
IsCharAlphaW
SetDlgItemTextW
GetDlgCtrlID
MoveWindow
FindWindowW
CheckDlgButton
CreateCursor
LoadCursorW
FillRect
GetWindow
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsWindow
GetDesktopWindow
GetAsyncKeyState
EnableWindow
GetSystemMetrics
GetWindowTextLengthW
SetTimer
IsDlgButtonChecked
InvalidateRect
CallWindowProcW
DestroyIcon
SetCursor
LoadStringW
IsWindowVisible
GetDlgItemTextW
SendMessageW

gdi32

SetBkMode
TextOutW
SetTextColor
GetStockObject
GetTextExtentPoint32W
DeleteObject
GetObjectW
SelectObject
CreateFontIndirectW
GetDeviceCaps

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

GetUserNameW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CloseEventLog
ReadEventLogW
OpenEventLogW
CryptAcquireContextW
RegQueryValueExA
GetUserNameA
GetCurrentHwProfileW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegDeleteValueW
GetTokenInformation
FreeSid
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
DuplicateToken
OpenProcessToken
OpenThreadToken
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyExW
CryptDecrypt
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptEnumProvidersW

shell32

SHBrowseForFolderW
DragAcceptFiles
DragQueryFileW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathA
SHGetPathFromIDListW
SHGetFileInfoW
SHGetMalloc
SHGetFolderPathW
ShellExecuteW

ole32

CoCreateInstance
CLSIDFromProgID
CoGetClassObject
CoInitialize

oleaut32

SysFreeString
SysAllocString

ntdll

NtEnumerateValueKey
NtSetInformationFile

comctl32

PropertySheetW
ord17
CreatePropertySheetPageW

shlwapi

PathFindFileNameW

crypt32

CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore

ws2_32

socket
setsockopt
connect
closesocket
WSASetLastError
send
recv
getnameinfo
freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
ntohs
getsockopt
ioctlsocket
shutdown

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

mpr

WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.gcode
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 596KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 159KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec1705b6ad330f25047022c193a20ab8

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ffCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ffCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

f1:c2:c6:4e:42:92:57:ab:c6:99:d7:bb:66:5f:e5:57:b3:40:5f:41:04:5d:60:06:32:b8:35:91:72:1b:e5:70Signer

6c:27:72:1d:d6:f9:0a:b6:5c:2d:76:50:56:00:b2:f4:ce:a8:b3:89Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

ntdll

comctl32

shlwapi

crypt32

ws2_32

version

mpr

bcrypt

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.gcode Size: 5KB - Virtual size: 4KB

.rdata Size: 596KB - Virtual size: 596KB

.data Size: 159KB - Virtual size: 176KB

.gdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 288KB - Virtual size: 287KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

f1:c2:c6:4e:42:92:57:ab:c6:99:d7:bb:66:5f:e5:57:b3:40:5f:41:04:5d:60:06:32:b8:35:91:72:1b:e5:70
Signer

6c:27:72:1d:d6:f9:0a:b6:5c:2d:76:50:56:00:b2:f4:ce:a8:b3:89
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.gcode
Size: 5KB - Virtual size: 4KB

.rdata
Size: 596KB - Virtual size: 596KB

.data
Size: 159KB - Virtual size: 176KB

.gdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 288KB - Virtual size: 287KB