f1e1a60305360186b0bb73dd4c4008092b09c37525c507f92fe4945c8db0625a

Sharing

Copy URL

Twitter E-mail

General

Target

f1e1a60305360186b0bb73dd4c4008092b09c37525c507f92fe4945c8db0625a
Size

31KB
MD5

0f0ba68edf0fda554030eb814a46ee7d
SHA1

0a9d8994fde34b11a5d291f6bbdfadc02f575821
SHA256

f1e1a60305360186b0bb73dd4c4008092b09c37525c507f92fe4945c8db0625a
SHA512

f1503c13d09ba1a01af87c5665f81c5615b9a415132240b68ad9c2b8564d049b50618fa34f9c19390583c85d5010418419236b005f0fff8c508838c23b26c8c4
SSDEEP

384:19agaUZWixEWIxi0pSt+e/QcYR9z60m4w5QRtHRN7WcYR9z6/8X:19taimxi0Q5Qn9z18QRtWn9zv

Score

1^/10

Malware Config

Signatures

Files

f1e1a60305360186b0bb73dd4c4008092b09c37525c507f92fe4945c8db0625a
.dll windows:6 windows x64 arch:x64

8e3190ca5b1dfe3662e83fefed12f437

Code Sign

33:00:00:00:e7:1a:a6:e3:0b:5e:b4:0a:54:00:00:00:00:00:e7
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-02-2023 22:33

Not After

31-01-2024 22:33

Subject

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01-05-2013 20:44

Not After

01-05-2028 20:54

Subject

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-02-2023 20:10

Not After

31-01-2024 20:10

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

18:14:c5:80:45:9e:c9:74:6c:d5:ae:f2:bb:4f:44:4d:37:cd:3b:b7:6d:96:7b:f1:dd:ea:37:cf:e2:6b:f3:9c
Signer

Actual PE Digest

18:14:c5:80:45:9e:c9:74:6c:d5:ae:f2:bb:4f:44:4d:37:cd:3b:b7:6d:96:7b:f1:dd:ea:37:cf:e2:6b:f3:9c

Digest Algorithm

sha256

PE Digest Matches

true

18:14:c5:80:45:9e:c9:74:6c:d5:ae:f2:bb:4f:44:4d:37:cd:3b:b7:6d:96:7b:f1:dd:ea:37:cf:e2:6b:f3:9c
Signer

Actual PE Digest

18:14:c5:80:45:9e:c9:74:6c:d5:ae:f2:bb:4f:44:4d:37:cd:3b:b7:6d:96:7b:f1:dd:ea:37:cf:e2:6b:f3:9c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_codecvt_ids.amd64.pdb

Imports

vcruntime140

memcpy
__std_type_info_destroy_list
__C_specific_handler
memset

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm

kernel32

IsDebuggerPresent
QueryPerformanceCounter
DisableThreadLibraryCalls
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcessId
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

Exports

Exports

?id@?$codecvt@_SDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$codecvt@_S_QU_Mbstatet@@@std@@2V0locale@2@A
?id@?$codecvt@_UDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$codecvt@_U_QU_Mbstatet@@@std@@2V0locale@2@A

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8e3190ca5b1dfe3662e83fefed12f437

Code Sign

33:00:00:00:e7:1a:a6:e3:0b:5e:b4:0a:54:00:00:00:00:00:e7Certificate

Extended Key Usages

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14Certificate

Key Usages

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

18:14:c5:80:45:9e:c9:74:6c:d5:ae:f2:bb:4f:44:4d:37:cd:3b:b7:6d:96:7b:f1:dd:ea:37:cf:e2:6b:f3:9cSigner

18:14:c5:80:45:9e:c9:74:6c:d5:ae:f2:bb:4f:44:4d:37:cd:3b:b7:6d:96:7b:f1:dd:ea:37:cf:e2:6b:f3:9cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

vcruntime140

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 344B

.pdata Size: 512B - Virtual size: 384B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 44B

33:00:00:00:e7:1a:a6:e3:0b:5e:b4:0a:54:00:00:00:00:00:e7
Certificate

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Certificate

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

18:14:c5:80:45:9e:c9:74:6c:d5:ae:f2:bb:4f:44:4d:37:cd:3b:b7:6d:96:7b:f1:dd:ea:37:cf:e2:6b:f3:9c
Signer

18:14:c5:80:45:9e:c9:74:6c:d5:ae:f2:bb:4f:44:4d:37:cd:3b:b7:6d:96:7b:f1:dd:ea:37:cf:e2:6b:f3:9c
Signer

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 344B

.pdata
Size: 512B - Virtual size: 384B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 44B