17d5ced8bd0963f480231bb3061cf571595ee285e9a5648178331396a6b5f7b1

Sharing

Copy URL Twitter E-mail

General

Target

17d5ced8bd0963f480231bb3061cf571595ee285e9a5648178331396a6b5f7b1
Size

2.6MB
MD5

fe4f2d3d05ca7cf56d9f8c5abf43e426
SHA1

01d9b5b960f290bc4c779b91bed1d5a04d8c3426
SHA256

17d5ced8bd0963f480231bb3061cf571595ee285e9a5648178331396a6b5f7b1
SHA512

f289f3623e2facdd238a9d533ad769f0347b0a700a73b35429668defa1ef8ce911ceab3a6769e67261b098d88f2056f09457904f197039fbfb88faad919500d8
SSDEEP

49152:7RVkkrBriQ/I6Xl8PckPLxR/pP/BWszNP:liA8LpP/BtNP

Score

1^/10

Malware Config

Signatures

Files

17d5ced8bd0963f480231bb3061cf571595ee285e9a5648178331396a6b5f7b1
.exe windows:6 windows x64 arch:x64

4cf9cf83e4cc2e148767146b63da4284

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26/07/2022, 00:00

Not After

25/07/2024, 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

26/07/2022, 00:00

Not After

25/07/2024, 23:59

Subject

CN=Michael Maltsev,O=Michael Maltsev,ST=HaMerkaz,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:b5:47:74:5d:ad:50:ec:89:3c:a3:58:0a:14:81:00:e6:71:78:a4:f5:97:92:30:d2:13:08:a0:b3:45:03:fa
Signer

Actual PE Digest

0c:b5:47:74:5d:ad:50:ec:89:3c:a3:58:0a:14:81:00:e6:71:78:a4:f5:97:92:30:d2:13:08:a0:b3:45:03:fa

Digest Algorithm

sha256

PE Digest Matches

false

af:b8:d4:25:d2:49:f2:29:93:45:cf:59:5d:45:63:3c:5f:8d:c0:96
Signer

Actual PE Digest

af:b8:d4:25:d2:49:f2:29:93:45:cf:59:5d:45:63:3c:5f:8d:c0:96

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Desktop\Release2.8\bin\target\release\deps\Stellar_Spectrum.pdb

Imports

kernel32

FindFirstFileW
GetCurrentProcess
GetModuleHandleA
FindClose
GetLastError
Sleep
GetFinalPathNameByHandleW
PostQueuedCompletionStatus
TryAcquireSRWLockExclusive
WriteProcessMemory
SetHandleInformation
GetCurrentThread
GetStdHandle
GetConsoleMode
SetFileCompletionNotificationModes
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceFrequency
GetModuleHandleW
SetLastError
GetEnvironmentVariableW
CreateIoCompletionPort
GetQueuedCompletionStatusEx
GetProcAddress
GetCurrentThreadId
CreateThread
QueryPerformanceCounter
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentProcessId
CreateMutexA
WaitForSingleObjectEx
LoadLibraryA
ReleaseMutex
RtlVirtualUnwind
AcquireSRWLockShared
ReleaseSRWLockShared
GetSystemTimeAsFileTime
InitializeSListHead
HeapReAlloc
GetSystemInfo
SwitchToThread
FormatMessageW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetThreadStackGuarantee
AddVectoredExceptionHandler
FindNextFileW
lstrlenW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
GetProcessHeap
CloseHandle
FlushInstructionCache
GetFullPathNameW
HeapFree
IsProcessorFeaturePresent

crypt32

CertAddCertificateContextToStore
CertDuplicateCertificateChain
CertDuplicateCertificateContext
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertEnumCertificatesInStore
CertOpenStore
CertGetCertificateChain
CertCloseStore
CertDuplicateStore
CertFreeCertificateContext

ntdll

NtAllocateVirtualMemory
NtProtectVirtualMemory
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWaitForSingleObject
NtWriteVirtualMemory
NtCreateFile
NtCreateThreadEx
NtWriteFile

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

bcrypt

BCryptGenRandom

ws2_32

ioctlsocket
send
WSACleanup
bind
connect
getsockopt
setsockopt
recv
WSASend
getaddrinfo
getsockname
WSAGetLastError
getpeername
shutdown
freeaddrinfo
WSAStartup
WSASocketW
closesocket
WSAIoctl

advapi32

RegCloseKey
RegOpenKeyExW
SystemFunction036
RegQueryValueExW

secur32

DecryptMessage
AcceptSecurityContext
AcquireCredentialsHandleA
InitializeSecurityContextW
FreeCredentialsHandle
ApplyControlToken
FreeContextBuffer
QueryContextAttributesW
DeleteSecurityContext
EncryptMessage

vcruntime140

_CxxThrowException
memmove
memset
memcmp
memcpy
__CxxFrameHandler3
__C_specific_handler
__current_exception
__current_exception_context

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

__setusermatherr
pow

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
__p___argv
_initterm_e
_c_exit
exit
_exit
_crt_atexit
__p___argc
_cexit
_initterm
terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 755KB - Virtual size: 754KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4cf9cf83e4cc2e148767146b63da4284

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

0c:b5:47:74:5d:ad:50:ec:89:3c:a3:58:0a:14:81:00:e6:71:78:a4:f5:97:92:30:d2:13:08:a0:b3:45:03:faSigner

af:b8:d4:25:d2:49:f2:29:93:45:cf:59:5d:45:63:3c:5f:8d:c0:96Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

crypt32

ntdll

shell32

ole32

bcrypt

ws2_32

advapi32

secur32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 755KB - Virtual size: 754KB

.data Size: 512B - Virtual size: 952B

.pdata Size: 83KB - Virtual size: 83KB

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 7KB - Virtual size: 7KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

cb:bf:3d:73:b5:02:21:79:28:5f:ba:16:9d:66:f0:30
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

0c:b5:47:74:5d:ad:50:ec:89:3c:a3:58:0a:14:81:00:e6:71:78:a4:f5:97:92:30:d2:13:08:a0:b3:45:03:fa
Signer

af:b8:d4:25:d2:49:f2:29:93:45:cf:59:5d:45:63:3c:5f:8d:c0:96
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 755KB - Virtual size: 754KB

.data
Size: 512B - Virtual size: 952B

.pdata
Size: 83KB - Virtual size: 83KB

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 7KB - Virtual size: 7KB