10c0e2afb37a24ac7732a402a4c9d854b35a382f1651d4aa2ece429b154aecb2

Sharing

Copy URL Twitter E-mail

General

Target

10c0e2afb37a24ac7732a402a4c9d854b35a382f1651d4aa2ece429b154aecb2
Size

510KB
MD5

8f3513cf9abd889eead995d01876306c
SHA1

94949bdd31e9c2ccdc905d24666b929bb55f1297
SHA256

10c0e2afb37a24ac7732a402a4c9d854b35a382f1651d4aa2ece429b154aecb2
SHA512

e26cb4d493442d8ed4623dcce2a9b73d2759e46f9989caf1acb894b6fff9c4114a5f776534ca90cca2cb0f77adda05dbd0ba9549183f472946fa8a1bb47a4c2b
SSDEEP

12288:2DGr2e8VoD4uJ2y9b017j5vBHyWwXuuu/gKLDP5YXh2thGozglV4WZ79dxS0u2EZ:2KlJ2VdvpIUtglnZ45P4VbxuH

Score

1^/10

Malware Config

Signatures

Files

10c0e2afb37a24ac7732a402a4c9d854b35a382f1651d4aa2ece429b154aecb2
.dll windows:6 windows x86 arch:x86

2769e631325004ea913e5174621873fc

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b7:86:f8:a9:9c:6c:21:2b:f5:38:ca:8b:a4:c1:ae:ba:52:d7:fb:5c:1e:6f:50:4f:cd:a8:55:8a:22:3a:46:83
Signer

Actual PE Digest

b7:86:f8:a9:9c:6c:21:2b:f5:38:ca:8b:a4:c1:ae:ba:52:d7:fb:5c:1e:6f:50:4f:cd:a8:55:8a:22:3a:46:83

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\user\build_system\Project_Crutch\Release-Dropbox\Crutch3.pdb

Imports

dnsapi

DnsFree
DnsQuery_W

iphlpapi

GetAdaptersInfo

advapi32

CryptDestroyHash
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
RegQueryValueExA
RegOpenKeyExA
CryptReleaseContext
RegCloseKey
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGenRandom

ws2_32

accept
listen
ioctlsocket
sendto
getaddrinfo
freeaddrinfo
gethostname
connect
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
socket
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
htonl
ntohl
inet_addr
recvfrom

winhttp

WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser

crypt32

CertFreeCertificateContext

wldap32

ord45
ord60
ord22
ord211
ord143
ord50
ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46

wininet

InternetOpenUrlA
InternetCloseHandle
InternetReadFile
InternetOpenA

kernel32

LCMapStringW
CompareStringW
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FindFirstFileExW
FindClose
SetStdHandle
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteConsoleW
SetEnvironmentVariableA
GetTimeZoneInformation
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
GetModuleFileNameA
GetConsoleCP
GetModuleFileNameW
ReadConsoleW
GetConsoleMode
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
QueryPerformanceCounter
OutputDebugStringW
UnhandledExceptionFilter
HeapSize
RtlUnwind
RaiseException
SetFilePointerEx
FileTimeToSystemTime
GetFileInformationByHandle
FileTimeToLocalFileTime
GetNativeSystemInfo
FreeLibrary
HeapAlloc
HeapFree
VirtualFree
GetProcessHeap
IsBadReadPtr
SetLastError
GetProcAddress
VirtualAlloc
LoadLibraryA
VirtualProtect
CreateProcessW
SetHandleInformation
WaitForSingleObject
WriteFile
Sleep
ReadFile
CreateFileW
MultiByteToWideChar
GetLastError
CreatePipe
CloseHandle
DeleteFileW
CreateThread
CreateFileA
GetFileSize
CreateMutexW
GetSystemTimeAsFileTime
DeleteFileA
GetTickCount
SetErrorMode
ExpandEnvironmentStringsA
GetFileAttributesW
CreateProcessA
TerminateProcess
LocalAlloc
LocalFree
GetVolumeInformationW
ExpandEnvironmentStringsW
SystemTimeToFileTime
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SleepEx
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
FormatMessageA
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
GetCurrentProcessId
LoadLibraryExW
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
GetCommandLineA
GetCurrentThreadId
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
AreFileApisANSI
ExitThread

user32

OemToCharA

Sections

.text
Size: 387KB - Virtual size: 386KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2769e631325004ea913e5174621873fc

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:dfCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

b7:86:f8:a9:9c:6c:21:2b:f5:38:ca:8b:a4:c1:ae:ba:52:d7:fb:5c:1e:6f:50:4f:cd:a8:55:8a:22:3a:46:83Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dnsapi

iphlpapi

advapi32

ws2_32

winhttp

crypt32

wldap32

wininet

kernel32

user32

Sections

.text Size: 387KB - Virtual size: 386KB

.rdata Size: 79KB - Virtual size: 78KB

.data Size: 13KB - Virtual size: 21KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 21KB - Virtual size: 20KB

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

b7:86:f8:a9:9c:6c:21:2b:f5:38:ca:8b:a4:c1:ae:ba:52:d7:fb:5c:1e:6f:50:4f:cd:a8:55:8a:22:3a:46:83
Signer

.text
Size: 387KB - Virtual size: 386KB

.rdata
Size: 79KB - Virtual size: 78KB

.data
Size: 13KB - Virtual size: 21KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 21KB - Virtual size: 20KB