MNRKKkvtZ6q6Pe9zD050MX[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

MNRKKkvtZ6q6Pe9zD050MX.exe
Size

11.4MB
MD5

a7400236ffab02ae5af5c9a0f61e7300
SHA1

e3a6e33cb751dd81f4f6a62405df2930e9ede400
SHA256

bb3af0c03e6b0833fa268d98e5a8b19e78fb108a830b58b2ade50c57e9fc9bed
SHA512

28bcef5cd4d01b8582a13538b893a96a1d86a07a9b91672f1602d3d5cc0806aaec00e9fa64b7852294dec3f0aa27045ba19d65869d4c4ba4bc3ce68ade8e5ebd
SSDEEP

196608:A5uVpY9sN2r7spYYB4M25DsvfnCcqBxsfQTQLMU+5tkFXfnTXfWhfDMwhT9GN9FB:A5+pY9k2r7smIss3C/ab+5twTPgN69FB

Score

1^/10

Malware Config

Signatures

Files

MNRKKkvtZ6q6Pe9zD050MX.exe
.exe windows:6 windows x64 arch:x64

bd5e4e5f645408e15fe7064ed8f7b46d

Code Sign

a7:f3:9e:96:e0:42:fb:85:de:05:31:31:f5:3e:53:51
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

14/12/2020, 00:00

Not After

14/12/2021, 23:59

Subject

CN=珠海源泽咨询有限公司,O=珠海源泽咨询有限公司,POSTALCODE=519031,STREET=横琴新区宝华路6号105室-48741(集中办公区),L=珠海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:f3:9e:96:e0:42:fb:85:de:05:31:31:f5:3e:53:51
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

14/12/2020, 00:00

Not After

14/12/2021, 23:59

Subject

CN=珠海源泽咨询有限公司,O=珠海源泽咨询有限公司,POSTALCODE=519031,STREET=横琴新区宝华路6号105室-48741(集中办公区),L=珠海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:36:a3:50:5f:b5:29:05:6b:ca:44:28:38:33:4b:1f:14:67:d7:9d:af:24:22:e6:0f:af:76:d9:12:1e:df:d8
Signer

Actual PE Digest

30:36:a3:50:5f:b5:29:05:6b:ca:44:28:38:33:4b:1f:14:67:d7:9d:af:24:22:e6:0f:af:76:d9:12:1e:df:d8

Digest Algorithm

sha256

PE Digest Matches

true

cb:15:ad:c6:1a:ce:8c:2e:87:b8:9d:11:40:de:d8:1f:46:c7:e0:14
Signer

Actual PE Digest

cb:15:ad:c6:1a:ce:8c:2e:87:b8:9d:11:40:de:d8:1f:46:c7:e0:14

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

select

kernel32

GetVersionExW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

shell32

ord680

pdh

PdhGetFormattedCounterValue

advapi32

RegQueryInfoKeyW

version

GetFileVersionInfoW

ntdll

VerSetConditionMask

cfgmgr32

CM_Get_Child

bcrypt

BCryptGenRandom

userenv

GetUserProfileDirectoryW

netapi32

NetShareEnum

ole32

CoTaskMemFree

user32

SetTimer
CharUpperBuffW

winmm

timeSetEvent

dnsapi

DnsQuery_W

iphlpapi

ConvertInterfaceLuidToIndex

crypt32

CertCloseStore

Exports

Exports

NvOptimusEnablementCuda

Sections

.text
Size: - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 5.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 234KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: - Virtual size: 106B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.p8e
Size: - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

./?l
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.eH*
Size: 11.4MB - Virtual size: 11.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 434B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd5e4e5f645408e15fe7064ed8f7b46d

Code Sign

a7:f3:9e:96:e0:42:fb:85:de:05:31:31:f5:3e:53:51Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

a7:f3:9e:96:e0:42:fb:85:de:05:31:31:f5:3e:53:51Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

30:36:a3:50:5f:b5:29:05:6b:ca:44:28:38:33:4b:1f:14:67:d7:9d:af:24:22:e6:0f:af:76:d9:12:1e:df:d8Signer

cb:15:ad:c6:1a:ce:8c:2e:87:b8:9d:11:40:de:d8:1f:46:c7:e0:14Signer

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

shell32

pdh

advapi32

version

ntdll

cfgmgr32

bcrypt

userenv

netapi32

ole32

user32

winmm

dnsapi

iphlpapi

crypt32

Exports

Exports

Sections

.text Size: - Virtual size: 5.8MB

.rdata Size: - Virtual size: 5.9MB

.data Size: - Virtual size: 149KB

.pdata Size: - Virtual size: 234KB

.qtmetad Size: - Virtual size: 106B

.p8e Size: - Virtual size: 3.6MB

./?l Size: 5KB - Virtual size: 5KB

.eH* Size: 11.4MB - Virtual size: 11.4MB

.rsrc Size: 512B - Virtual size: 434B

a7:f3:9e:96:e0:42:fb:85:de:05:31:31:f5:3e:53:51
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

a7:f3:9e:96:e0:42:fb:85:de:05:31:31:f5:3e:53:51
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

30:36:a3:50:5f:b5:29:05:6b:ca:44:28:38:33:4b:1f:14:67:d7:9d:af:24:22:e6:0f:af:76:d9:12:1e:df:d8
Signer

cb:15:ad:c6:1a:ce:8c:2e:87:b8:9d:11:40:de:d8:1f:46:c7:e0:14
Signer

.text
Size: - Virtual size: 5.8MB

.rdata
Size: - Virtual size: 5.9MB

.data
Size: - Virtual size: 149KB

.pdata
Size: - Virtual size: 234KB

.qtmetad
Size: - Virtual size: 106B

.p8e
Size: - Virtual size: 3.6MB

./?l
Size: 5KB - Virtual size: 5KB

.eH*
Size: 11.4MB - Virtual size: 11.4MB

.rsrc
Size: 512B - Virtual size: 434B