22470f4001c91b695826db8b89fa470b3a211344c4c43e3c45aac371c6f4bd94

Sharing

Copy URL Twitter E-mail

General

Target

22470f4001c91b695826db8b89fa470b3a211344c4c43e3c45aac371c6f4bd94
Size

444KB
MD5

1686fc54af6d8e1297fe811c8a12c193
SHA1

7646435404c3766fc2e895799b7cf3ff8a202f4a
SHA256

22470f4001c91b695826db8b89fa470b3a211344c4c43e3c45aac371c6f4bd94
SHA512

33d68b3f22f32fce2c743f61799dd58b4a177d18a031e2bf8196821f6d5bb0c5c09178775eab0dc9136d4c2e677ce09603b2ea76f2929633e1d463261a8da1f6
SSDEEP

6144:4dxQiV1ovMJUL1Bp/Va9ky9DZSayS2hVC1bPcV0iy9S8:4dZ10LRBp/Va9ky9DZQYD/iyX

Score

1^/10

Malware Config

Signatures

Files

22470f4001c91b695826db8b89fa470b3a211344c4c43e3c45aac371c6f4bd94
.dll windows:6 windows x86 arch:x86

22d3a7a204010dce3d3863867edbcf57

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:66:72:13:08:65:81:e3:ff:ef:3e:8f:c6:3a:f2:cc
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11/04/2023, 00:00

Not After

12/04/2026, 23:59

Subject

CN=Famatech Corp.,O=Famatech Corp.,L=Road Town,C=VG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

86:5d:38:ac:42:aa:29:f0:20:3a:f0:2f:c5:0f:41:0f:c0:0e:07:96:2f:b1:4c:07:de:fc:4b:8b:67:fc:65:9c
Signer

Actual PE Digest

86:5d:38:ac:42:aa:29:f0:20:3a:f0:2f:c5:0f:41:0f:c0:0e:07:96:2f:b1:4c:07:de:fc:4b:8b:67:fc:65:9c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Z:\out\Release\RadminVPN\x86\RvTCPConnect.pdb

Imports

kernel32

WideCharToMultiByte
GetACP
GetOEMCP
CloseHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
TerminateThread
WriteFile
MultiByteToWideChar
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateFileW
GetConsoleMode
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
GetProcAddress
GetConsoleOutputCP
FlushFileBuffers
HeapSize
SetStdHandle
GetStringTypeW
SetFilePointerEx
GetProcessHeap
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
WriteConsoleW
GetFileType
GetStdHandle
GetModuleHandleW
GetVersionExW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
InitializeSListHead
RtlUnwind
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
HeapReAlloc

advapi32

UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
RegisterTraceGuidsW
TraceEvent
GetTraceEnableFlags

ole32

CoTaskMemFree
StringFromCLSID

ws2_32

socket
setsockopt
send
recv
ntohs
ntohl
listen
getnameinfo
htonl
getsockopt
WSAEventSelect
connect
closesocket
bind
accept
getsockname
getpeername
WSAEnumNetworkEvents
shutdown
htons
ioctlsocket

Exports

Exports

TCPConnect_Connect
TCPConnect_Connect2
TCPConnect_ConnectEx
TCPConnect_CreateConnection
TCPConnect_CreateListeningConnection
TCPConnect_CreateUniversalConnector
TCPConnect_FreeConnection
TCPConnect_FreeMemory
TCPConnect_FreeModule
TCPConnect_GetError
TCPConnect_GetState
TCPConnect_InitModule
TCPConnect_IsReadyToDie
TCPConnect_Listen
TCPConnect_Listen2
TCPConnect_SetHandshake
TCPConnect_SetLocalAddress
TCPConnect_SetRemoteAddresses
TCPConnect_ShutdownConnection

Sections

.text
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

22d3a7a204010dce3d3863867edbcf57

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:66:72:13:08:65:81:e3:ff:ef:3e:8f:c6:3a:f2:ccCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

86:5d:38:ac:42:aa:29:f0:20:3a:f0:2f:c5:0f:41:0f:c0:0e:07:96:2f:b1:4c:07:de:fc:4b:8b:67:fc:65:9cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ole32

ws2_32

Exports

Exports

Sections

.text Size: 315KB - Virtual size: 315KB

.rdata Size: 45KB - Virtual size: 44KB

.data Size: 40KB - Virtual size: 350KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 33KB - Virtual size: 33KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:66:72:13:08:65:81:e3:ff:ef:3e:8f:c6:3a:f2:cc
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

86:5d:38:ac:42:aa:29:f0:20:3a:f0:2f:c5:0f:41:0f:c0:0e:07:96:2f:b1:4c:07:de:fc:4b:8b:67:fc:65:9c
Signer

.text
Size: 315KB - Virtual size: 315KB

.rdata
Size: 45KB - Virtual size: 44KB

.data
Size: 40KB - Virtual size: 350KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 33KB - Virtual size: 33KB