9f1cfc0c76527627e05ed9a4517861173309d30b624baa4db0e2d105c3c47960

Sharing

Copy URL Twitter E-mail

General

Target

9f1cfc0c76527627e05ed9a4517861173309d30b624baa4db0e2d105c3c47960
Size

667KB
MD5

6cdd42e211e64d564c7c838eef4a5cf7
SHA1

3ceb63fc6de8e6f85c526425fb9f62ea5b6731bd
SHA256

9f1cfc0c76527627e05ed9a4517861173309d30b624baa4db0e2d105c3c47960
SHA512

d2ef944ca222677f60285c0ac9a078e10b8bf6ad768906c5495aa2aa99e4f520859d0fc69dc899975f6e3547094a59bfe666d0ec1dfd4864faea7824823e0f33
SSDEEP

12288:cpoZW4bpnERjUv6PbvhyS0+lELhPnirzyA1oh:ciZ9bpnEdUihlElnqzyA1oh

Score

1^/10

Malware Config

Signatures

Files

9f1cfc0c76527627e05ed9a4517861173309d30b624baa4db0e2d105c3c47960
.dll windows:5 windows x64 arch:x64

413a3af05dd7870fe1e41382e0c1a74d

Code Sign

16:00:05:d3:c5:b1:ad:c1:0b:ed:fa:30:c9:00:00:00:05:d3:c5
Certificate

Issuer

CN=Microsoft IT TLS CA 4,OU=Microsoft IT,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/07/2019, 17:50

Not After

15/07/2021, 17:50

Subject

CN=www.visualstudio.com,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:00:05:d3:c5:b1:ad:c1:0b:ed:fa:30:c9:00:00:00:05:d3:c5
Certificate

Issuer

CN=Microsoft IT TLS CA 4,OU=Microsoft IT,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/07/2019, 17:50

Not After

15/07/2021, 17:50

Subject

CN=www.visualstudio.com,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e6:90:49:b7:06:18:63:4c:e3:c9:e0:c5:d0:71:55:2a:63:dd:02:82:63:9a:84:76:be:c3:d4:ac:57:0c:fe:30
Signer

Actual PE Digest

e6:90:49:b7:06:18:63:4c:e3:c9:e0:c5:d0:71:55:2a:63:dd:02:82:63:9a:84:76:be:c3:d4:ac:57:0c:fe:30

Digest Algorithm

sha256

PE Digest Matches

true

e6:ee:44:c7:8a:18:4f:1c:21:d0:ad:e8:c9:5a:34:58:9f:76:60:e6
Signer

Actual PE Digest

e6:ee:44:c7:8a:18:4f:1c:21:d0:ad:e8:c9:5a:34:58:9f:76:60:e6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW
SetFileTime
GetFileTime
SetFileAttributesW
GetFileAttributesW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateDirectoryW
VirtualFree
LocalFree
LocalAlloc
GetCurrentProcessId
CreateThread
TerminateProcess
CreateProcessW
GetEnvironmentVariableW
GetTickCount
WritePrivateProfileStringW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
LoadLibraryA
OutputDebugStringW
MoveFileExW
GetPrivateProfileStringW
IsBadReadPtr
GetCurrentThreadId
WideCharToMultiByte
WaitForSingleObject
GetComputerNameExW
GetVersionExW
GetSystemInfo
DisableThreadLibraryCalls
CreateMutexW
SetThreadExecutionState
FindFirstFileW
FindClose
MultiByteToWideChar
GlobalFree
GlobalAlloc
TerminateThread
GetVersion
GetModuleFileNameW
FreeLibrary
LockResource
LoadResource
DeleteFileW
CopyFileW
SizeofResource
FindResourceExW
CloseHandle
GetFileSize
CreateFileW
LoadLibraryW
FlushInstructionCache
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
HeapAlloc
RaiseException
GetNativeSystemInfo
HeapReAlloc
GetLastError
LeaveCriticalSection
SetLastError
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
CreateSemaphoreW
ReleaseSemaphore
GetCurrentProcessorNumber
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
EncodePointer
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
ReadFile
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateEventW
SetEvent
CreateTimerQueue
VirtualQuery
OpenThread
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
Thread32First
Thread32Next
HeapCreate
InitializeSListHead
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
VirtualAlloc
GetCurrentProcess
EnterCriticalSection
HeapFree
VirtualProtect
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetExitCodeThread
GetCurrentThread
SwitchToThread
WaitForSingleObjectEx
DuplicateHandle
TryEnterCriticalSection
WriteFile
QueryPerformanceFrequency
Sleep

user32

GetSystemMetrics
wsprintfA
wsprintfW
SetThreadDesktop
CreateDesktopW

advapi32

RegOverridePredefKey
SystemFunction036
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetUserNameW
RegCloseKey
RegOpenCurrentUser
ImpersonateLoggedOnUser
OpenProcessToken
RevertToSelf
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegEnumValueW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext

ole32

CoCreateGuid

wininet

InternetSetOptionW
InternetWriteFile
InternetQueryDataAvailable
InternetReadFile
InternetCloseHandle
HttpQueryInfoW
HttpEndRequestW
HttpSendRequestExW
HttpAddRequestHeadersW
InternetConnectW
InternetQueryOptionW
HttpOpenRequestW
InternetOpenW

shlwapi

PathRemoveFileSpecW
PathFindFileNameW

iphlpapi

GetNetworkParams

mpr

WNetAddConnection3W

ws2_32

connect
WSAIoctl
getsockopt
ioctlsocket
__WSAFDIsSet
closesocket
shutdown
gethostbyname
socket
htonl
bind
getsockname
ntohs
ntohl
htons
sendto
listen
select
recvfrom
GetAddrInfoW
recv
setsockopt
WSAGetLastError
send
accept
WSAStartup
inet_addr
FreeAddrInfoW

crypt32

CryptStringToBinaryA
CryptBinaryToStringA
CertCloseStore
CertOpenSystemStoreW
CertFindChainInStore
CertFreeCertificateContext
CryptDecodeObjectEx

netapi32

NetApiBufferFree
NetWkstaGetInfo

ntdll

NtQuerySystemInformation
RtlImageNtHeader
RtlPcToFileHeader

winhttp

WinHttpSetOption
WinHttpGetProxyForUrl
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpOpen
WinHttpQueryOption
WinHttpSendRequest
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpGetIEProxyConfigForCurrentUser

dnsapi

DnsFree
DnsQuery_W

msvcrt

exp
sqrt
__RTDynamicCast
__CxxFrameHandler
___lc_codepage_func
_lock
_unlock
??1exception@@UEAA@XZ
_iob
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
tolower
_wtoi
_clearfp
__pctype_func
__dllonexit
_controlfp
_XcptFilter
_statusfp
?terminate@@YAXXZ
_msize
log10
__uncaught_exception
wcstoul
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z
calloc
toupper
strtol
_wcsicmp
__C_specific_handler
fgets
ceil
strrchr
strchr
memcmp
strncmp
_initterm
atexit
__getmainargs
_amsg_exit
_cexit
___lc_handle_func
memchr
??0exception@@QEAA@AEBQEBD@Z
fclose
??2@YAPEAX_K@Z
fopen
??3@YAXPEAX@Z
_time64
realloc
memset
setlocale
_beginthreadex
fputc
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@XZ
_errno
malloc
free
abort
wcsstr
localeconv
__DestructExceptionObject

msvcp60

_Tolower
_Toupper
_Getctype

Exports

Exports

CoreStage
LdrStage

Sections

.text
Size: 449KB - Virtual size: 449KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

413a3af05dd7870fe1e41382e0c1a74d

Code Sign

16:00:05:d3:c5:b1:ad:c1:0b:ed:fa:30:c9:00:00:00:05:d3:c5Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

16:00:05:d3:c5:b1:ad:c1:0b:ed:fa:30:c9:00:00:00:05:d3:c5Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

e6:90:49:b7:06:18:63:4c:e3:c9:e0:c5:d0:71:55:2a:63:dd:02:82:63:9a:84:76:be:c3:d4:ac:57:0c:fe:30Signer

e6:ee:44:c7:8a:18:4f:1c:21:d0:ad:e8:c9:5a:34:58:9f:76:60:e6Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

wininet

shlwapi

iphlpapi

mpr

ws2_32

crypt32

netapi32

ntdll

winhttp

dnsapi

msvcrt

msvcp60

Exports

Exports

Sections

.text Size: 449KB - Virtual size: 449KB

.rdata Size: 152KB - Virtual size: 151KB

.data Size: 26KB - Virtual size: 35KB

.pdata Size: 25KB - Virtual size: 24KB

.rsrc Size: 1024B - Virtual size: 920B

.reloc Size: 3KB - Virtual size: 2KB

16:00:05:d3:c5:b1:ad:c1:0b:ed:fa:30:c9:00:00:00:05:d3:c5
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

16:00:05:d3:c5:b1:ad:c1:0b:ed:fa:30:c9:00:00:00:05:d3:c5
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

e6:90:49:b7:06:18:63:4c:e3:c9:e0:c5:d0:71:55:2a:63:dd:02:82:63:9a:84:76:be:c3:d4:ac:57:0c:fe:30
Signer

e6:ee:44:c7:8a:18:4f:1c:21:d0:ad:e8:c9:5a:34:58:9f:76:60:e6
Signer

.text
Size: 449KB - Virtual size: 449KB

.rdata
Size: 152KB - Virtual size: 151KB

.data
Size: 26KB - Virtual size: 35KB

.pdata
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 1024B - Virtual size: 920B

.reloc
Size: 3KB - Virtual size: 2KB