RunAsDate[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RunAsDate.exe
Size

99KB
MD5

ea578b7831ff40dbd547a065382c5960
SHA1

8d772cefc50d6cdbbcfb13bb9526ef9b168fbc39
SHA256

0a6696db24b9f6b6d5919b6a85574ec93e1f658299a81e3df7252ecfb824db0d
SHA512

1a93ea417652fa3b39a27e6bd773c5fd5e5c67dd908956dbe1ee43193f49d6a5c08bede512cc263890911d61c13b23b292e82648c797c5fb9a701457944f62a3
SSDEEP

3072:uS6B+TjnwdE/hs10zHve/zWezruMAzzDRf84PeaCM:uS+QWuPe/zWezruMAzzx84Z/

Score

1^/10

Malware Config

Signatures

Files

RunAsDate.exe
.exe windows:4 windows x64 arch:x64

2d00442cc69a1e2fdde271301b66f637

Code Sign

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/09/2019, 00:00

Not After

09/09/2023, 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:74:c5:42:8a:00:89:a6:03:d1:12:c8:62:cf:45:84:32:0a:09:d8:04:2f:23:c5:8d:ff:5e:36:f4:76:2b:52
Signer

Actual PE Digest

5c:74:c5:42:8a:00:89:a6:03:d1:12:c8:62:cf:45:84:32:0a:09:d8:04:2f:23:c5:8d:ff:5e:36:f4:76:2b:52

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

f:\Projects\VS2005\RunAsDate\x64\release\RunAsDate.pdb

Imports

msvcrt

qsort
strlen
wcscat
strcpy
__dllonexit
_onexit
__C_specific_handler
_purecall
wcsrchr
wcscmp
??3@YAXPEAX@Z
malloc
_memicmp
free
wcschr
_wcslwr
_itow
_wcsnicmp
_XcptFilter
??2@YAPEAX_K@Z
memcmp
wcstoul
wcscpy
_wcsicmp
abs
_ultow
_wtoi
wcslen
memcpy
memset
_snwprintf
wcsncat
_c_exit
_exit
_cexit
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type

comctl32

ImageList_SetImageCount
ImageList_AddMasked
ImageList_Create
ord17

kernel32

CreateRemoteThread
ResumeThread
WriteProcessMemory
DeleteFileW
CreateProcessW
ReadProcessMemory
VirtualAllocEx
EnumResourceTypesW
Process32FirstW
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32NextW
GetCurrentProcess
CompareFileTime
GetStartupInfoW
VirtualFreeEx
WaitForSingleObject
FreeLibrary
SystemTimeToFileTime
LoadLibraryW
FileTimeToSystemTime
GetProcAddress
GetLocalTime
GetSystemTime
WriteFile
ReadFile
GetModuleFileNameW
CloseHandle
CreateFileW
GetWindowsDirectoryW
FindResourceW
OpenProcess
LoadResource
LocalFree
LoadLibraryExW
GetSystemDirectoryW
LockResource
GetTempPathW
GetDateFormatW
SizeofResource
GetLastError
FormatMessageW
GetVersionExW
GetModuleHandleW
GetTimeFormatW
SetFilePointer
GetFileAttributesW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetPrivateProfileStringW
WideCharToMultiByte
SetErrorMode

user32

DestroyIcon
LoadMenuW
GetWindowTextW
DestroyWindow
SetWindowPos
LoadStringW
EnumChildWindows
DialogBoxParamW
CreateDialogParamW
GetParent
ShowWindow
ChildWindowFromPoint
SetCursor
LoadCursorW
GetSysColorBrush
SendDlgItemMessageW
EndDialog
GetWindowRect
GetDlgItem
GetDlgItemInt
InvalidateRect
EndPaint
GetWindow
SetDlgItemInt
DrawFrameControl
SetWindowTextW
BeginPaint
SetDlgItemTextW
GetClientRect
GetDlgItemTextW
GetSystemMetrics
DeferWindowPos
SendMessageW
MessageBoxW
SetWindowLongW
GetWindowLongW
BeginDeferWindowPos
LoadImageW
SetWindowPlacement
GetWindowPlacement
EndDeferWindowPos
EnableWindow
MapWindowPoints
GetDC
ReleaseDC
GetClassNameW
MoveWindow
GetMenuItemCount
SetFocus
GetSysColor
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu

gdi32

SetTextColor
CreateFontIndirectW
SetBkMode
DeleteObject
GetDeviceCaps

comdlg32

GetOpenFileNameW

shell32

ShellExecuteExW
SHGetFileInfoW
ShellExecuteW
DragFinish
DragQueryFileW
DragAcceptFiles

ole32

CoInitialize
CoCreateInstance
CoUninitialize

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2d00442cc69a1e2fdde271301b66f637

Code Sign

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

5c:74:c5:42:8a:00:89:a6:03:d1:12:c8:62:cf:45:84:32:0a:09:d8:04:2f:23:c5:8d:ff:5e:36:f4:76:2b:52Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

comctl32

kernel32

user32

gdi32

comdlg32

shell32

ole32

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 9KB - Virtual size: 13KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 16KB - Virtual size: 15KB

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

5c:74:c5:42:8a:00:89:a6:03:d1:12:c8:62:cf:45:84:32:0a:09:d8:04:2f:23:c5:8d:ff:5e:36:f4:76:2b:52
Signer

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 9KB - Virtual size: 13KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 16KB - Virtual size: 15KB