ce12520373630dcfbfc44de12d5b152a[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

ce12520373630dcfbfc44de12d5b152a.bin
Size

8.0MB
MD5

57b9384442b3a2cbfcede7482270a3e6
SHA1

7abd1a7a5d32e2ffa0b3bdbff94d919bab58b849
SHA256

c2b28ea0cceb3a055e7bb7203dc9b06e55d56f72b074ca5b22728039d0d4257a
SHA512

3dcbd3c3c2ace625a913e7f971b34b90b5bd5c043f038fa2a902002b32a7a32d45a60a6a1e9e84c9cef864ed2229cd0f9137426bed2e58842fa30b964059f54a
SSDEEP

196608:eOYqkzT4olko1sXmBgHuiL3pODNh+Sw1br:eHqz8koImBgOiL30fM

Score

1^/10

Malware Config

Signatures

Files

ce12520373630dcfbfc44de12d5b152a.bin
.zip

Password: infected
36b8ba26821e11bbd57865bafa66e582592623e4ec5e7da952672cf059df0429.exe
.exe windows:5 windows x86 arch:x86

Password: infected

65a603fdc32eed194c86af51cc334e46

Code Sign

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/07/2009, 17:25

Not After

07/12/2030, 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 15:43

Not After

07/11/2030, 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 19:19

Not After

29/12/2040, 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:20:3f:a4:7b:99:d3:12:6f:05:65:21:05:71:57:86
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

16/09/2022, 16:05

Not After

16/09/2024, 16:05

Subject

SERIALNUMBER=727035-6,CN=Avanquest Software (7270356 Canada Inc),O=Avanquest Software (7270356 Canada Inc),L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:79:4d:b7:5f:20:54:0a:88:c5:a4:81:61:db:4e:6e:2a:9f:8c:c4:ce:7f:02:5d:43:c8:5b:7a:77:96:6d:0b
Signer

Actual PE Digest

08:79:4d:b7:5f:20:54:0a:88:c5:a4:81:61:db:4e:6e:2a:9f:8c:c4:ce:7f:02:5d:43:c8:5b:7a:77:96:6d:0b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\TemporaryBuilds\azure-installer-pool-de-1\14\s\_bin\suite2021\Win32\PDFSuite2021Installer.pdb

Imports

kernel32

CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
CreateEventA
SetEvent
CreateDirectoryW
RemoveDirectoryW
WaitForSingleObjectEx
GetCurrentThreadId
GetCurrentProcess
LocalAlloc
LocalFree
GetDriveTypeW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCommandLineW
GetLastError
RaiseException
GetModuleHandleW
GetProcAddress
DecodePointer
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
CreateThread
WaitForSingleObject
CreateEventW
GetCurrentProcessId
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetModuleFileNameW
GetFileSize
ReadFile
HeapDestroy
HeapReAlloc
HeapSize
TerminateProcess
OutputDebugStringW
SetUnhandledExceptionFilter
InterlockedExchange
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteFileW
SetFileAttributesW
GetFullPathNameW
GetVersionExW
WriteFile
CopyFileW
CreateProcessW
FindFirstFileW
FindNextFileW
FindClose
Sleep
CreateMutexW
ReleaseMutex
LoadLibraryW
FreeLibrary
ReleaseSemaphore
CreateSemaphoreA
WaitForMultipleObjectsEx
InterlockedIncrement
lstrcmpiW
LoadLibraryExW
QueryPerformanceCounter
QueryPerformanceFrequency
CreateMutexA
GetUserDefaultLCID
OpenProcess
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
IsWow64Process
GetExitCodeProcess
Process32FirstW
Process32NextW
GetModuleHandleA
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetModuleFileNameA
LoadLibraryExA
FormatMessageW
SetLastError
DuplicateHandle
TlsAlloc
WaitForMultipleObjects
TerminateThread
QueueUserAPC
InterlockedExchangeAdd
PostQueuedCompletionStatus
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
InterlockedCompareExchange
VerSetConditionMask
VerifyVersionInfoW
ProcessIdToSessionId
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
GetTickCount
GetStdHandle
OutputDebugStringA
GetTempPathA
GetWindowsDirectoryA
GetComputerNameA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetSystemTimeAsFileTime
SetFilePointer
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetCurrentDirectoryW
GetFileAttributesW
lstrcpynW
SwitchToThread
UnmapViewOfFile
CreateFileMappingA
FormatMessageA
GlobalSize
LoadLibraryA
GetTempFileNameA
GetLocaleInfoA
FindResourceA
MulDiv
ExitThread
GetCPInfo
SetThreadLocale
GetNumberFormatW
GetCurrencyFormatW
GetSystemTime
GetLocalTime
GetTimeZoneInformation
FileTimeToSystemTime
GetLocaleInfoW
GetDateFormatW
GetThreadLocale
GetVersionExA
SetEndOfFile
MapViewOfFile
FlushViewOfFile
CompareStringW
GetTempPathW
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
ExpandEnvironmentStringsA
GetFileType
PeekNamedPipe
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetCurrentThread
GetThreadTimes
UnregisterWaitEx
VirtualProtect
VirtualQuery
GetWindowsDirectoryW
GetFileAttributesExW
ResetEvent
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetStringTypeW
GetExitCodeThread
TryEnterCriticalSection
QueueUserWorkItem
EncodePointer
LCMapStringW
OpenEventA
ResumeThread
CreateWaitableTimerA
SetFilePointerEx
DeviceIoControl
AreFileApisANSI
GetStringTypeExW
LCMapStringA
GetStringTypeExA
IsValidCodePage
IsDBCSLeadByteEx
EnumSystemLocalesA
FoldStringW
GetTimeFormatW
CreateProcessA
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
SetConsoleCtrlHandler
VirtualAlloc
WriteConsoleW
GetConsoleCP
ExitProcess
SystemTimeToTzSpecificLocalTime
FreeLibraryAndExitThread
GetACP
IsValidLocale
EnumSystemLocalesW
FlushFileBuffers
SetStdHandle
CreatePipe
FindFirstFileExW
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
VirtualFree
InterlockedPopEntrySList
QueryDepthSList
GetStringTypeA

Exports

Exports

??0?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@QAE@XZ
??0?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ
??0?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ
??1?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtagRECT@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ
?get_lock@singleton_module@serialization@boost@@CAAA_NXZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_locked@singleton_module@serialization@boost@@SA_NXZ
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
?lock@?1??get_lock@singleton_module@serialization@boost@@CAAA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@SAXXZ
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?unlock@singleton_module@serialization@boost@@SAXXZ

Sections

.text
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 223KB - Virtual size: 317KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13.2MB - Virtual size: 13.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 347KB - Virtual size: 346KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

65a603fdc32eed194c86af51cc334e46

Code Sign

4a:53:8c:28Certificate

Key Usages

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7fCertificate

Extended Key Usages

Key Usages

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2bCertificate

Extended Key Usages

Key Usages

41:20:3f:a4:7b:99:d3:12:6f:05:65:21:05:71:57:86Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

08:79:4d:b7:5f:20:54:0a:88:c5:a4:81:61:db:4e:6e:2a:9f:8c:c4:ce:7f:02:5d:43:c8:5b:7a:77:96:6d:0bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 6.2MB - Virtual size: 6.2MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 223KB - Virtual size: 317KB

.rsrc Size: 13.2MB - Virtual size: 13.2MB

.reloc Size: 347KB - Virtual size: 346KB

4a:53:8c:28
Certificate

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

41:20:3f:a4:7b:99:d3:12:6f:05:65:21:05:71:57:86
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

08:79:4d:b7:5f:20:54:0a:88:c5:a4:81:61:db:4e:6e:2a:9f:8c:c4:ce:7f:02:5d:43:c8:5b:7a:77:96:6d:0b
Signer

.text
Size: 6.2MB - Virtual size: 6.2MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 223KB - Virtual size: 317KB

.rsrc
Size: 13.2MB - Virtual size: 13.2MB

.reloc
Size: 347KB - Virtual size: 346KB