60e059b04039da27eb388283f551155d784138c52ea5fc6c0117d71e39bd433b

Sharing

Copy URL Twitter E-mail

General

Target

60e059b04039da27eb388283f551155d784138c52ea5fc6c0117d71e39bd433b
Size

2.4MB
MD5

168357d78793c66ac70e0afbd95de77f
SHA1

afef47bd3d5e3f1b2aae63bb46950efef6e2ee0f
SHA256

60e059b04039da27eb388283f551155d784138c52ea5fc6c0117d71e39bd433b
SHA512

fc99b8c809e69d08e7c6c9a49775fbad5a672b4a7f88164badaf4abc35f545fecf2868183a7cc76e691d1039f0a44b7b9d82caa576ab59512846e8accdc3d18c
SSDEEP

49152:oJq+QX9aeioj7jvQDfI3HUbled6AHRktIGnhmmRMzm5SBXSDibu:o1QiTAHRktIGhmm/Yk

Score

1^/10

Malware Config

Signatures

Files

60e059b04039da27eb388283f551155d784138c52ea5fc6c0117d71e39bd433b
.dll windows:5 windows x86 arch:x86

30b7be5188b478babb1b2f1c3d858671

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:03:43:da:68:34:f4:51:3c:e9:a1:a5:80:9e:5e:a5
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/11/2022, 00:00

Not After

06/11/2023, 23:59

Subject

SERIALNUMBER=110111-1138985,CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130b53656f6e676e616d2d7369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:d9:1f:a3:06:00:d6:04:8a:3d:75:b1:73:10:0d:65:3a:8b:f1:ff:9d:10:a1:ae:ea:88:07:1a:c7:93:27:02
Signer

Actual PE Digest

3b:d9:1f:a3:06:00:d6:04:8a:3d:75:b1:73:10:0d:65:3a:8b:f1:ff:9d:10:a1:ae:ea:88:07:1a:c7:93:27:02

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\ais\ahni2\master-50\build\git\AIS\ahni2\Build\NT32Release.vc90\AhnI2.pdb

Imports

kernel32

InterlockedExchange
InterlockedIncrement
GetCurrentProcess
DeleteFileW
RemoveDirectoryW
GetModuleHandleW
FindFirstFileW
FindNextFileW
FindClose
GetVersion
CreateFileW
WriteFile
CloseHandle
CreateDirectoryW
GetDateFormatW
lstrcmpiW
GetModuleFileNameW
GetLocalTime
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentProcessId
GetLastError
SetConsoleMode
GetConsoleMode
ReadConsoleW
ReadConsoleA
GetEnvironmentVariableW
GetACP
GetStdHandle
GetFileType
GetSystemDirectoryA
LoadLibraryA
FormatMessageA
InterlockedExchangeAdd
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
VirtualAlloc
VirtualFree
GetVersionExW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetTickCount
MoveFileW
GetWindowsDirectoryW
CreateMutexW
ReleaseMutex
WaitForSingleObject
GetSystemTimeAsFileTime
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
SetLastError
SetFilePointer
SetEndOfFile
GetFileSize
ReadFile

advapi32

CryptReleaseContext
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CryptGenRandom
RegDeleteValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegCloseKey
RegQueryValueExW
RegEnumValueW
CryptDestroyHash

msvcr90

wcsncmp
fprintf
fputs
isdigit
tolower
wcscpy
_lrotr
_stat64i32
getenv
_gmtime64_s
strspn
strcspn
raise
_exit
wcsstr
fopen
sprintf_s
strncpy_s
strtoul
strcpy_s
strcat_s
sscanf
isspace
__iob_func
strncmp
strtol
__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_commit
_get_osfhandle
_write
_read
_lseek
_close
?_wsopen@@YAHPB_WHHH@Z
_msize
_time64
malloc
wcschr
_ismbblead
_wtoi
strpbrk
_mbspbrk
strerror_s
strcpy
fgets
_setmode
setvbuf
fflush
strchr
_mbschr
_strnicmp
_mbsnbicmp
realloc
free
_errno
_vsnprintf
signal
??3@YAXPAX@Z
memcpy
_vsnwprintf
wcsrchr
memset
__CxxFrameHandler3
wcslen
calloc
memcmp
atoi
strlen
strcmp
fseek
fread
fclose
_wfopen
_gmtime64
ferror
feof
fwrite
ftell
strncpy
strrchr
_fileno
_waccess_s
_ftelli64
_fseeki64
_lrotl
strstr
_strupr_s
memmove
qsort
memchr

ws2_32

inet_ntoa
ntohs
WSASetLastError
htonl
getservbyname
htons
inet_addr
WSAGetLastError
gethostbyname
gethostbyaddr
getservbyport
getsockopt
WSAStartup
WSACleanup
ioctlsocket
shutdown
send
recv
closesocket
setsockopt
connect
socket
select

user32

MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
CharNextA
CharPrevA

Exports

Exports

AB7FC8EE888E4a9b8E35ECA228EC5A00
AI210F4C7D9
AI2189606B6
AI22570F53F
AI23795C1FF
AI23F75C85E
AI244B9D58C
AI264E8E65A
AI27533E519
AI280A6E132
AI29B2A45A0
AI2A0C12D74
AI2B225DE6D
AI2B59ED73B
AI2B5A29E3C
AI2B5E58553
AI2BAA2C0CD
AI2C0124906
AI2C477D343
AI2C4821643
AI2C69D3464
AI2CB8999E8
AI2CD92D838
AI2CEB8F5F0
AI2CFCF49D1
AI2D05A71A7
AI2D3B051E6
AI2D496A3BC
AI2D8E8DBBF
AI2DA5A542D
AI2E0A2B5D6
AI2E15457F4
AI2E18F4D40
AI2E5DE6421
AI2E8D56B09
AI2EB0BA897
AI2ED186BB0
AI2EFD4CAFB
AI2F1DF75F6
AI2F87F6EB6
AI2FE12C6B7
AhnInst2_AddUpdateProduct
AhnInst2_ConcealSerial
AhnInst2_DeleteUserInfo
AhnInst2_DeleteUserInfoEx
AhnInst2_EnDeSecData
AhnInst2_GetDaysLeft
AhnInst2_GetInstallVersion
AhnInst2_GetLastError
AhnInst2_GetSecProfileInt
AhnInst2_GetSecProfileString
AhnInst2_GetTDaysLeft
AhnInst2_GetTValidDuration
AhnInst2_GetUserInfo
AhnInst2_GetUserInfoEx
AhnInst2_GetUserInfoExBin
AhnInst2_GetUserInfoExBin2
AhnInst2_InvalidSerialNum
AhnInst2_IsT
AhnInst2_IsTOver
AhnInst2_OpUserInfo
AhnInst2_RebuildSerial
AhnInst2_RemoveUpdateProduct
AhnInst2_SecFree
AhnInst2_SecMalloc
AhnInst2_SetUserInfo
AhnInst2_SetUserInfoEx
AhnInst2_SetUserInfoExAny
AhnInst2_SetUserInfoExBin
AhnInst2_UpdateUserInfo
AhnInst2_WriteSecProfileInt
AhnInst2_WriteSecProfileString
B225DE6D05014699BAFC8CE606B98DBB
B59ED73BD6B741b4802B2CF74D935321
B5A29E3CDC2646d89725907A991873F1
B5E5855371F24b5c9B048AC3DE04E698
C0124906261A439dB786CAC5F06AB3C2
C477D3439BC941f495D4F5BC47031514
C482164330234317905C01E0DDA7C6D4
CD92D8388ED54b1eBA25CC8BBD3DAFA1
CFCF49D171E04332B1DB2C888E2BA493
D05A71A757FC4a899570684E653202A1
D3B051E6A9744f82AE52D94DBD9AE682
D496A3BCBEF64bb8B57FB799C904A8D4
D8E8DBBFC12A43e8AE414991B5BAFA0F
DA5A542DF4D4426c8D198DEC34B534BA
E0A2B5D66F2142818CC3AE1AE276F7E9
E15457F40FAF4a379EA42E30EDA8AD9A
E18F4D40197441579261E01089C9B46A
E5DE64217CAD44679A2915ED82C825B9
E8D56B09B05149da97647CDD469DBDB0
EB0BA897D99E4602A321FF11A517ACB2
ED186BB0295A4ca2A0E38BCDCE4AFEED
EFD4CAFBA52C417aB0655ECDB5540B2F
F1DF75F654DF4637A6AEEC64AC4D0F13
F87F6EB694AA4705AFF1B2333CA3E173
FE12C6B73FC44d31BD0635841EFB25A7

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 473KB - Virtual size: 473KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

30b7be5188b478babb1b2f1c3d858671

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

06:03:43:da:68:34:f4:51:3c:e9:a1:a5:80:9e:5e:a5Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

3b:d9:1f:a3:06:00:d6:04:8a:3d:75:b1:73:10:0d:65:3a:8b:f1:ff:9d:10:a1:ae:ea:88:07:1a:c7:93:27:02Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

msvcr90

ws2_32

user32

Exports

Exports

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 473KB - Virtual size: 473KB

.data Size: 9KB - Virtual size: 16KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 84KB - Virtual size: 83KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

06:03:43:da:68:34:f4:51:3c:e9:a1:a5:80:9e:5e:a5
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

3b:d9:1f:a3:06:00:d6:04:8a:3d:75:b1:73:10:0d:65:3a:8b:f1:ff:9d:10:a1:ae:ea:88:07:1a:c7:93:27:02
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 473KB - Virtual size: 473KB

.data
Size: 9KB - Virtual size: 16KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 84KB - Virtual size: 83KB