bd562a643a88cab40a35bca60b9263b0b30cef3884f84d26fe16f5cbd4519546

Sharing

Copy URL Twitter E-mail

General

Target

bd562a643a88cab40a35bca60b9263b0b30cef3884f84d26fe16f5cbd4519546
Size

614KB
MD5

2a307fbd28b5405f77e907230cfcbdf8
SHA1

0bf09d4d2142f4ac1583f2135ecfde1d326c3bf6
SHA256

bd562a643a88cab40a35bca60b9263b0b30cef3884f84d26fe16f5cbd4519546
SHA512

fc3f4827530011e1fa4aadae036f1db8f284ac59d2caf1c5af7ab1da6d37e0055c34b4d2dc55cacdfec075e17be615147cf78c3b8799c7e6e8aabac4f385e98a
SSDEEP

12288:uks4g2bqEUk4ihHDJiqtjfu2Uxkdplq4ANlCTcZpz1wHdDo+UO1vpmNFpB6:ukTbpUk4ihHDJiqtjfu2Ckdmlnpz1N6

Score

1^/10

Malware Config

Signatures

Files

bd562a643a88cab40a35bca60b9263b0b30cef3884f84d26fe16f5cbd4519546
.dll windows:6 windows x86 arch:x86

cef37bef8276317e5275078e3b64cc11

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:5c:4d:f7:38:d9:91:d8:ce:03:ba:96:89:74:d9:a9
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

14/06/2021, 00:00

Not After

11/06/2024, 23:59

Subject

CN=Nero AG,O=Nero AG,L=Karlsruhe,ST=Baden-Württemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:5c:4d:f7:38:d9:91:d8:ce:03:ba:96:89:74:d9:a9
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

14/06/2021, 00:00

Not After

11/06/2024, 23:59

Subject

CN=Nero AG,O=Nero AG,L=Karlsruhe,ST=Baden-Württemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:0f:cc:31:a7:71:5e:3d:20:9e:e3:b6:40:4a:31:e7:03:64:da:b9:1e:23:72:fc:88:d2:12:2a:12:a6:51:bf
Signer

Actual PE Digest

e7:0f:cc:31:a7:71:5e:3d:20:9e:e3:b6:40:4a:31:e7:03:64:da:b9:1e:23:72:fc:88:d2:12:2a:12:a6:51:bf

Digest Algorithm

sha256

PE Digest Matches

true

94:d1:60:36:be:49:4b:f9:52:04:ab:9f:d6:1f:88:00:ba:18:97:e7
Signer

Actual PE Digest

94:d1:60:36:be:49:4b:f9:52:04:ab:9f:d6:1f:88:00:ba:18:97:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\jenkins_build\workspace\Components\MMC_Green\src\audiopluginmgr\Release\plugins\APM_mp3pro.pdb

Imports

winmm

timeEndPeriod
timeBeginPeriod
timeSetEvent
timeKillEvent

mfc140u

ord7997
ord13256
ord9139
ord6549
ord3816
ord3677
ord9040
ord500
ord1142
ord5585
ord4882
ord2304
ord6531
ord9210
ord12172
ord2760
ord13752
ord6218
ord3164
ord3403
ord3404
ord11396
ord12131
ord6860
ord10250
ord5763
ord12928
ord12219
ord12251
ord10433
ord8217
ord4589
ord12247
ord12239
ord5918
ord3852
ord6349
ord14668
ord6350
ord14669
ord6348
ord14667
ord8000
ord12531
ord14466
ord3265
ord11982
ord2034
ord7941
ord12947
ord4090
ord4152
ord9398
ord14595
ord7922
ord14589
ord12542
ord12541
ord2486
ord5357
ord8324
ord12865
ord8386
ord8470
ord6804
ord1693
ord8032
ord12921
ord976
ord1452
ord6501
ord3371
ord3372
ord3941
ord12124
ord2682
ord5935
ord13703
ord11717
ord6877
ord14596
ord7923
ord14590
ord3055
ord4494
ord9693
ord4502
ord4988
ord4927
ord4912
ord4974
ord5019
ord4942
ord4997
ord5013
ord4954
ord4960
ord4966
ord4948
ord5003
ord4936
ord1777
ord1756
ord1770
ord1744
ord1722
ord12258
ord12262
ord13878
ord3266
ord9256
ord11002
ord6978
ord3797
ord8965
ord14588
ord11936
ord3838
ord12089
ord9128
ord11726
ord11725
ord5652
ord10288
ord10284
ord10286
ord10287
ord10285
ord1472
ord2761
ord8210
ord3302
ord3305
ord13756
ord6220
ord3147
ord4222
ord8744
ord2993
ord3872
ord458
ord1133
ord4485
ord1477
ord1003
ord1066
ord1446
ord1070
ord1111
ord4092
ord1412
ord5921
ord293
ord2997
ord1697
ord4324
ord1654
ord2990
ord6175
ord13257
ord2246
ord1182
ord551
ord1450
ord974
ord7027
ord5882
ord4886
ord1655
ord8505
ord280
ord2389
ord13260
ord13966
ord14419
ord310
ord4817
ord8360
ord8757
ord2996
ord1690
ord1653
ord1532
ord1046
ord306
ord316
ord1533
ord1530
ord6751
ord1523
ord2399
ord2300
ord2184
ord2374
ord2268
ord485
ord12348
ord2378
ord14604
ord265
ord12405
ord14657
ord266
ord1052
ord324
ord1511
ord1687
ord4815
ord3693
ord3697
ord286
ord2383
ord8464
ord1526
ord290
ord4323
ord1525
ord2385
ord296
ord1045
ord1513
ord3696
ord7820
ord995
ord7653
ord928
ord14131
ord5422
ord13028
ord6490
ord9126
ord3145
ord4219
ord9468
ord11015
ord14507
ord4477
ord6834
ord9135
ord14234
ord14137
ord3257
ord4236
ord1002
ord6497
ord9209
ord10255
ord8219
ord5409
ord7712
ord7723
ord7722
ord6129
ord5228
ord5411
ord10472
ord5252
ord5790
ord5525
ord9350
ord5760
ord14785
ord5549
ord5249
ord7493
ord12220
ord12168
ord3849
ord1514
ord325
ord1053
ord2365
ord2408
ord2411
ord2376
ord2410
ord11983

kernel32

FileTimeToSystemTime
GetProcAddress
GetModuleHandleW
WriteFile
GetTempPathW
SystemTimeToTzSpecificLocalTime
GetLocaleInfoA
MoveFileW
OutputDebugStringW
GetFileInformationByHandle
GetLastError
GetFileTime
CloseHandle
CreateFileW
GetTempFileNameW
InitializeCriticalSectionEx
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
GetFileSize
ReadFile
DeleteFileW
LocalFree
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetFileAttributesW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
LoadLibraryW
WaitForSingleObject
GetTickCount
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
CreateMutexW
CreateEventW
CreateSemaphoreW
WaitForSingleObjectEx
Sleep
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetFilePointer
LocalAlloc
GetVersionExA
GetVersionExW
GetThreadPriority
SetThreadPriority
GetCurrentThread
lstrlenW
lstrcpynW
GetCurrentProcess
lstrcmpW
WaitForMultipleObjects
GetCurrentThreadId

user32

IsWindow
EnableWindow
GetWindowRect
GetClientRect
AdjustWindowRect
PeekMessageW
PostThreadMessageW
GetQueueStatus
RegisterWindowMessageW
DispatchMessageW
MsgWaitForMultipleObjects
GetWindowTextW
GetWindow
SendMessageW
GetWindowLongW
GetClassNameW
SetWindowTextW

advapi32

RegOpenKeyW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegCreateKeyW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoCreateInstance
CoFreeUnusedLibraries

oleaut32

SysFreeString
SysAllocString

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__std_terminate
_purecall
memmove
_CxxThrowException
__CxxFrameHandler3
memcpy
wcschr
memset
__vcrt_InitializeCriticalSectionEx
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
_except_handler4_common
__std_type_info_destroy_list
__RTDynamicCast

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_invalid_parameter_noinfo
_initialize_narrow_environment
_cexit
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_errno

api-ms-win-crt-string-l1-1-0

_stricmp
iswalnum
strncpy
isdigit
wcsncpy_s
strncmp
iswalpha

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-heap-l1-1-0

malloc
free
_recalloc
calloc

api-ms-win-crt-time-l1-1-0

_localtime64_s
clock
wcsftime
_mktime64

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s
__stdio_common_vswscanf

api-ms-win-crt-math-l1-1-0

_except1
_ftol
_CIpow
ceil
floor

Exports

Exports

NERO_PLUGIN_GetPrimaryAudioObject
NERO_PLUGIN_ReadyToFinish

Sections

.text
Size: 341KB - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cef37bef8276317e5275078e3b64cc11

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

0a:5c:4d:f7:38:d9:91:d8:ce:03:ba:96:89:74:d9:a9Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0a:5c:4d:f7:38:d9:91:d8:ce:03:ba:96:89:74:d9:a9Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

e7:0f:cc:31:a7:71:5e:3d:20:9e:e3:b6:40:4a:31:e7:03:64:da:b9:1e:23:72:fc:88:d2:12:2a:12:a6:51:bfSigner

94:d1:60:36:be:49:4b:f9:52:04:ab:9f:d6:1f:88:00:ba:18:97:e7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winmm

mfc140u

kernel32

user32

advapi32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 341KB - Virtual size: 340KB

.rdata Size: 133KB - Virtual size: 133KB

.data Size: 10KB - Virtual size: 146KB

.shared Size: 512B - Virtual size: 4B

.gfids Size: 512B - Virtual size: 32B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 88KB - Virtual size: 88KB

.reloc Size: 21KB - Virtual size: 20KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0a:5c:4d:f7:38:d9:91:d8:ce:03:ba:96:89:74:d9:a9
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0a:5c:4d:f7:38:d9:91:d8:ce:03:ba:96:89:74:d9:a9
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

e7:0f:cc:31:a7:71:5e:3d:20:9e:e3:b6:40:4a:31:e7:03:64:da:b9:1e:23:72:fc:88:d2:12:2a:12:a6:51:bf
Signer

94:d1:60:36:be:49:4b:f9:52:04:ab:9f:d6:1f:88:00:ba:18:97:e7
Signer

.text
Size: 341KB - Virtual size: 340KB

.rdata
Size: 133KB - Virtual size: 133KB

.data
Size: 10KB - Virtual size: 146KB

.shared
Size: 512B - Virtual size: 4B

.gfids
Size: 512B - Virtual size: 32B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 88KB - Virtual size: 88KB

.reloc
Size: 21KB - Virtual size: 20KB