d5b8e3010ea1949510929da5318190e84a981887b2aee1686985423965055cff

Sharing

Copy URL Twitter E-mail

General

Target

d5b8e3010ea1949510929da5318190e84a981887b2aee1686985423965055cff
Size

2.8MB
MD5

80281d45ea0d0ef6ba92bf10dfec2efd
SHA1

fb54a278edcb16068bd58f8f35fad55787e1e107
SHA256

d5b8e3010ea1949510929da5318190e84a981887b2aee1686985423965055cff
SHA512

59a0173bf741efac726ca91a0634c670f7d52585b1b23f1af4564c2309856c2853993dc023a69441851b397264cdee3325508f9cce6f92e72f832faacc2e25fa
SSDEEP

49152:MLsvOInwLB7KKO0HawST/9ZrfmnG2puTpDNZ34jMHg8rjfYpkO47YNuG8kw1MrpN:3vOI8bOKawu/DfT2p2pDj4jMA8fvOrua

Score

1^/10

Malware Config

Signatures

Files

d5b8e3010ea1949510929da5318190e84a981887b2aee1686985423965055cff
.exe windows:6 windows x86 arch:x86

ec1705b6ad330f25047022c193a20ab8

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:ef:52:f5:1d:06:b8:1a:b4:31:3d:31:2e:f9:e5:d5:1d:5c:13:26:1b:b8:54:ee:d0:fa:59:9c:31:01:1d:e7
Signer

Actual PE Digest

80:ef:52:f5:1d:06:b8:1a:b4:31:3d:31:2e:f9:e5:d5:1d:5c:13:26:1b:b8:54:ee:d0:fa:59:9c:31:01:1d:e7

Digest Algorithm

sha256

PE Digest Matches

true

2b:5e:ad:8f:d7:1d:5a:14:7e:7f:1e:0d:40:03:7f:df:b4:2b:a6:1a
Signer

Actual PE Digest

2b:5e:ad:8f:d7:1d:5a:14:7e:7f:1e:0d:40:03:7f:df:b4:2b:a6:1a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualQueryEx
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetSystemTimeAsFileTime
CreateProcessW
CopyFileW
SetEndOfFile
GetDateFormatW
GetModuleHandleW
CreateThread
SetEvent
Sleep
CreateEventW
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcess
GetCurrentThread
GetVersionExW
GetProcessHeap
MapViewOfFile
CreateFileMappingW
DecodePointer
WriteConsoleW
HeapSize
GetTimeZoneInformation
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
SystemTimeToFileTime
ReadProcessMemory
SetStdHandle
GetConsoleOutputCP
FlushFileBuffers
LCMapStringW
CompareStringW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetConsoleCtrlHandler
GetCommandLineW
GetCommandLineA
LoadLibraryExW
EncodePointer
RaiseException
FindResourceW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryA
FreeLibrary
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
VirtualAlloc
TerminateProcess
K32GetProcessImageFileNameW
GetVersionExA
ExpandEnvironmentStringsA
GetComputerNameA
GetCurrentThreadId
ExitProcess
IsDebuggerPresent
GetSystemTime
GetFullPathNameW
GetCurrentProcessId
DuplicateHandle
OpenProcess
OpenFileMappingW
GetLongPathNameW
SizeofResource
LockResource
GetCurrentDirectoryW
GetSystemInfo
GetFileSizeEx
MoveFileExW
GetFileSize
GetFileInformationByHandle
HeapAlloc
SetFilePointer
GetTickCount
GetProcAddress
LoadLibraryW
SetFilePointerEx
CompareFileTime
FindClose
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
GetFileAttributesW
DeleteFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
WriteFile
CloseHandle
UnmapViewOfFile
WideCharToMultiByte
GetLocalTime
OutputDebugStringW
MultiByteToWideChar
CreateFileW
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReadFile
GetLastError
HeapFree
DeleteFiber
SwitchToFiber
QueryPerformanceCounter
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetFileType
GetEnvironmentVariableW
GetStdHandle
LoadResource
SetFileAttributesW
FormatMessageW
GetSystemDirectoryW
GetTempPathW
GetComputerNameW
GetDriveTypeW
RtlUnwind
GetLogicalDrives
SetLastError
HeapReAlloc
FindFirstFileExW

user32

ReleaseDC
SetWindowPos
LoadIconW
SetWindowTextW
GetClientRect
LoadImageW
ClientToScreen
GetParent
SetWindowLongW
SetClassLongW
GetWindowLongW
GetFocus
GetWindowThreadProcessId
PostMessageW
DrawTextExW
KillTimer
ShowWindow
GetProcessWindowStation
GetUserObjectInformationW
DialogBoxParamW
EndDialog
EnumWindows
CharUpperA
GetDC
GetDlgItem
GetWindowTextW
GetClassNameW
CharLowerBuffW
MessageBoxW
IsCharAlphaNumericW
SetFocus
GetWindowRect
CharUpperBuffW
SystemParametersInfoW
IsCharAlphaW
SetDlgItemTextW
GetDlgCtrlID
MoveWindow
FindWindowW
CheckDlgButton
CreateCursor
LoadCursorW
FillRect
GetWindow
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsWindow
GetDesktopWindow
GetAsyncKeyState
EnableWindow
GetSystemMetrics
GetWindowTextLengthW
SetTimer
IsDlgButtonChecked
InvalidateRect
CallWindowProcW
DestroyIcon
SetCursor
LoadStringW
IsWindowVisible
GetDlgItemTextW
SendMessageW

gdi32

SetBkMode
TextOutW
SetTextColor
GetStockObject
GetTextExtentPoint32W
DeleteObject
GetObjectW
SelectObject
CreateFontIndirectW
GetDeviceCaps

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

GetUserNameW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CloseEventLog
ReadEventLogW
OpenEventLogW
CryptAcquireContextW
RegQueryValueExA
GetUserNameA
GetCurrentHwProfileW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegDeleteValueW
GetTokenInformation
FreeSid
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
DuplicateToken
OpenProcessToken
OpenThreadToken
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyExW
CryptDecrypt
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptEnumProvidersW

shell32

SHBrowseForFolderW
DragAcceptFiles
DragQueryFileW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathA
SHGetPathFromIDListW
SHGetFileInfoW
SHGetMalloc
SHGetFolderPathW
ShellExecuteW

ole32

CoCreateInstance
CLSIDFromProgID
CoGetClassObject
CoInitialize

oleaut32

SysFreeString
SysAllocString

ntdll

NtEnumerateValueKey
NtSetInformationFile

comctl32

PropertySheetW
ord17
CreatePropertySheetPageW

shlwapi

PathFindFileNameW

crypt32

CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore

ws2_32

socket
setsockopt
connect
closesocket
WSASetLastError
send
recv
getnameinfo
freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
ntohs
getsockopt
ioctlsocket
shutdown

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

mpr

WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.gcode
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 596KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 159KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec1705b6ad330f25047022c193a20ab8

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ffCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ffCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

80:ef:52:f5:1d:06:b8:1a:b4:31:3d:31:2e:f9:e5:d5:1d:5c:13:26:1b:b8:54:ee:d0:fa:59:9c:31:01:1d:e7Signer

2b:5e:ad:8f:d7:1d:5a:14:7e:7f:1e:0d:40:03:7f:df:b4:2b:a6:1aSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

ntdll

comctl32

shlwapi

crypt32

ws2_32

version

mpr

bcrypt

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.gcode Size: 5KB - Virtual size: 4KB

.rdata Size: 596KB - Virtual size: 596KB

.data Size: 159KB - Virtual size: 176KB

.gdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 288KB - Virtual size: 287KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

80:ef:52:f5:1d:06:b8:1a:b4:31:3d:31:2e:f9:e5:d5:1d:5c:13:26:1b:b8:54:ee:d0:fa:59:9c:31:01:1d:e7
Signer

2b:5e:ad:8f:d7:1d:5a:14:7e:7f:1e:0d:40:03:7f:df:b4:2b:a6:1a
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.gcode
Size: 5KB - Virtual size: 4KB

.rdata
Size: 596KB - Virtual size: 596KB

.data
Size: 159KB - Virtual size: 176KB

.gdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 288KB - Virtual size: 287KB