eb7b33b436d034b2992c4f40082ba48c744d546daa3b49be8564f2c509bd80e9

Sharing

Copy URL Twitter E-mail

General

Target

eb7b33b436d034b2992c4f40082ba48c744d546daa3b49be8564f2c509bd80e9
Size

226KB
MD5

2104fae9f482a72002204d74c1ca1e1f
SHA1

8941d889cb199a234d99c90ce78a96411b6dedb6
SHA256

eb7b33b436d034b2992c4f40082ba48c744d546daa3b49be8564f2c509bd80e9
SHA512

7bbea688d851a36951bfaad77c1832f66671fc79691bd4ac63ee50725c5f7fd3b5a441dee18b6e62586f4f2d0f0b7d3f2ee74120295bf083af899150dd3d8116
SSDEEP

6144:rWwweAGxK1y5Eoz4wrETDftDB3U0hWB9y/3G:rWlSzxrEvfFdU0YBK3G

Score

1^/10

Malware Config

Signatures

Files

eb7b33b436d034b2992c4f40082ba48c744d546daa3b49be8564f2c509bd80e9
.dll windows:5 windows x86 arch:x86

96197e72496e42b66353e7e82c3f5782

Code Sign

02:10:36:b9:e8:0d:16:ea:7f:8c:f0:e9:06:2b:34:55
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

08/01/2021, 00:00

Not After

11/01/2023, 23:59

Subject

CN=DEEPSoft Co.\, Ltd.,O=DEEPSoft Co.\, Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

56:6e:0f:47:8a:2c:1f:ac:f7:5e:89:67:db:98:e0:92:a2:06:fe:76
Signer

Actual PE Digest

56:6e:0f:47:8a:2c:1f:ac:f7:5e:89:67:db:98:e0:92:a2:06:fe:76

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateDirectoryA
WideCharToMultiByte
GlobalMemoryStatusEx
InterlockedCompareExchange64
InitializeCriticalSection
DeleteCriticalSection
SetFileAttributesA
LeaveCriticalSection
InterlockedIncrement
GetCurrentProcessId
GetDriveTypeA
TerminateProcess
GetCommandLineA
GetCurrentThreadId
EnterCriticalSection
GetLogicalDrives
VirtualQueryEx
VirtualProtectEx
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
ResumeThread
DeleteFileA
GetEnvironmentVariableA
CreateProcessA
ReadFile
FindNextFileA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCurrentProcess
CreatePipe
MultiByteToWideChar
DuplicateHandle
GetModuleFileNameA
GetCurrentThread
OutputDebugStringA
InterlockedExchange
Sleep
IsBadReadPtr
GetVersionExA
GetSystemInfo
LocalFree
GlobalFree
CreateThread
WaitForSingleObject
GetSystemDirectoryA
GetTickCount
WriteFile
SetFilePointer
GetLastError
GetModuleHandleA
InterlockedDecrement
LoadLibraryA
FindClose
GetProcAddress
FreeLibrary
GetProcessHeap
HeapAlloc
HeapFree
CreateFileA
DeviceIoControl
CloseHandle
GlobalAlloc
FindFirstFileA
InterlockedCompareExchange
VirtualProtect
VirtualQuery
LoadLibraryExA
LoadLibraryExW
RtlUnwind
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
lstrlenA
SetEndOfFile
HeapReAlloc
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
HeapSize
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
GetStdHandle
ExitProcess
UnhandledExceptionFilter

user32

PostMessageA
GetSystemMetrics
SetUserObjectSecurity
SetProcessWindowStation
OpenWindowStationA
GetUserObjectInformationA
GetProcessWindowStation
CloseDesktop
CloseWindowStation
KillTimer
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
RegisterClassA
LoadCursorA
LoadIconA
SetTimer
OpenDesktopA
GetUserObjectSecurity
CharLowerBuffA

advapi32

BuildExplicitAccessWithNameA
LogonUserA
RegCreateKeyExA
RegSetValueExA
StartServiceA
ChangeServiceConfigA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
GetNamedSecurityInfoA
LogonUserW
DuplicateTokenEx
ImpersonateLoggedOnUser
RevertToSelf
CreateProcessWithTokenW
CreateProcessWithLogonW
LookupAccountNameA
AddAccessAllowedAce
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAce
CopySid
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetAclInformation
GetAce
IsValidSid
GetSecurityDescriptorDacl
GetFileSecurityA
AllocateAndInitializeSid
SetEntriesInAclA
SetNamedSecurityInfoA
FreeSid
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
LookupAccountSidA

ole32

CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitialize
CoUninitialize

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

odbc32

ord41
ord43
ord11
ord18
ord13
ord27
ord4
ord36
ord9
ord31
ord24
ord75
ord39

opends60

ord41
ord42
ord26
ord40
ord25

ws2_32

WSASocketA
socket
closesocket
htons
inet_addr
connect
select
__WSAFDIsSet
recv
send
WSASetLastError
WSAStartup
WSAEventSelect
WSACleanup
shutdown
WSASendTo
WSASend
WSAAsyncGetHostByName
WSARecv
WSARecvFrom
WSAAccept
listen
bind
htonl
getsockname
WSAAsyncSelect
inet_ntoa
getpeername
WSAGetLastError
inet_ntop
WSAIoctl
gethostbyname
setsockopt
gethostname
ioctlsocket

wininet

InternetConnectA
InternetReadFile
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetCrackUrlA
InternetOpenA

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

gdi32

GetStockObject

Exports

Exports

maggie

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96197e72496e42b66353e7e82c3f5782

Code Sign

02:10:36:b9:e8:0d:16:ea:7f:8c:f0:e9:06:2b:34:55Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

56:6e:0f:47:8a:2c:1f:ac:f7:5e:89:67:db:98:e0:92:a2:06:fe:76Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

odbc32

opends60

ws2_32

wininet

userenv

gdi32

Exports

Exports

Sections

.text Size: 161KB - Virtual size: 161KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 6KB - Virtual size: 23KB

.detourd Size: 512B - Virtual size: 12B

.detourc Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 13KB

02:10:36:b9:e8:0d:16:ea:7f:8c:f0:e9:06:2b:34:55
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

56:6e:0f:47:8a:2c:1f:ac:f7:5e:89:67:db:98:e0:92:a2:06:fe:76
Signer

.text
Size: 161KB - Virtual size: 161KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 6KB - Virtual size: 23KB

.detourd
Size: 512B - Virtual size: 12B

.detourc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 13KB