6ba88cb14a02776e2f404cc808545442fec03d71d9c18eb16fb95b92f0c2d736

Sharing

Copy URL

Twitter E-mail

General

Target

6ba88cb14a02776e2f404cc808545442fec03d71d9c18eb16fb95b92f0c2d736
Size

22KB
MD5

b7ade62a58774776820db8a30508fd85
SHA1

d5a30fd61d6dfad8569b87844ccd68ab122a1d88
SHA256

6ba88cb14a02776e2f404cc808545442fec03d71d9c18eb16fb95b92f0c2d736
SHA512

f43cdebe1f1699d7b1fdb4d5c2e7e65edf40c1fbc3c83516dfc0e8ae8e28fb13aa073668266b0eda2f221543b0a53de221d3050afd02781ab9f6061617156716
SSDEEP

384:9CsK5ofkc00PnxjogzfZuzPMbvpUwKi8JN77hhY9:96WfkcRnRPSd3hm9

Score

1^/10

Malware Config

Signatures

Files

6ba88cb14a02776e2f404cc808545442fec03d71d9c18eb16fb95b92f0c2d736
.dll windows:6 windows x64 arch:x64

479153e7ff36b2f51bcc10fcbfa44287

Code Sign

2a:95:32:18:e1:0b:4b:7b:6f:d1:4b:2a:9e:c3:0d:26
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-05-2016 00:00

Not After

11-05-2026 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:e3:4d:3c:5e:10:d7:36:de:e1:c5:32:0c:2e:f8:f8
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

29-08-2017 00:00

Not After

28-08-2020 23:59

Subject

SERIALNUMBER=HE 340361,CN=Movavi Software Limited,O=Movavi Software Limited,L=Apsiou,ST=Limassol,C=CY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1306417073696f75,1.3.6.1.4.1.311.60.2.1.2=#13084c696d6173736f6c,1.3.6.1.4.1.311.60.2.1.3=#13024359

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

85:62:ca:92:18:2d:8d:18:a3:7f:20:1b:39:0b:8d:41:07:fd:e2:16:dc:b7:90:74:8b:d8:8e:d9:07:8a:90:35
Signer

Actual PE Digest

85:62:ca:92:18:2d:8d:18:a3:7f:20:1b:39:0b:8d:41:07:fd:e2:16:dc:b7:90:74:8b:d8:8e:d9:07:8a:90:35

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\J\WS\MVC_X64_git\build-x64\bin\SDLManager.pdb

Imports

sdl

SDL_QuitSubSystem
SDL_InitSubSystem
SDL_Init
SDL_Quit

msvcp140

_Mtx_unlock
_Mtx_lock
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Throw_C_error@std@@YAXH@Z

vcruntime140

__C_specific_handler
__current_exception
__current_exception_context
memset
__std_type_info_destroy_list
__std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-environment-l1-1-0

_wputenv

api-ms-win-crt-runtime-l1-1-0

_initterm
_crt_atexit
_register_onexit_function
_initialize_narrow_environment
_crt_at_quick_exit
_cexit
_initterm_e
terminate
_execute_onexit_table
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll

kernel32

SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress

Exports

Exports

??0SDLManager@Player@Movavi@@AEAA@XZ
??1SDLManager@Player@Movavi@@AEAA@XZ
?Get@SDLManager@Player@Movavi@@SAAEAV123@XZ
?OnAudioDeviceCreate@SDLManager@Player@Movavi@@QEAAXXZ
?OnAudioDeviceDestroy@SDLManager@Player@Movavi@@QEAAXXZ
?OnVideoDeviceCreate@SDLManager@Player@Movavi@@QEAAXXZ
?OnVideoDeviceDestroy@SDLManager@Player@Movavi@@QEAAXXZ

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

479153e7ff36b2f51bcc10fcbfa44287

Code Sign

2a:95:32:18:e1:0b:4b:7b:6f:d1:4b:2a:9e:c3:0d:26Certificate

Extended Key Usages

Key Usages

63:e3:4d:3c:5e:10:d7:36:de:e1:c5:32:0c:2e:f8:f8Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

85:62:ca:92:18:2d:8d:18:a3:7f:20:1b:39:0b:8d:41:07:fd:e2:16:dc:b7:90:74:8b:d8:8e:d9:07:8a:90:35Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

sdl

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 360B

.pdata Size: 1024B - Virtual size: 708B

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 512B - Virtual size: 28B

2a:95:32:18:e1:0b:4b:7b:6f:d1:4b:2a:9e:c3:0d:26
Certificate

63:e3:4d:3c:5e:10:d7:36:de:e1:c5:32:0c:2e:f8:f8
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

85:62:ca:92:18:2d:8d:18:a3:7f:20:1b:39:0b:8d:41:07:fd:e2:16:dc:b7:90:74:8b:d8:8e:d9:07:8a:90:35
Signer

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 360B

.pdata
Size: 1024B - Virtual size: 708B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 512B - Virtual size: 28B