c46a09b95e3f879a6776dfcb18a034b81aab46bfcf2723765556deb2abeb952e

Sharing

Copy URL Twitter E-mail

General

Target

c46a09b95e3f879a6776dfcb18a034b81aab46bfcf2723765556deb2abeb952e
Size

93KB
MD5

c987a8b9931fb8677688a4e486d129b3
SHA1

4724bc70f360a23c740d23dbb7e93ee4d50bf555
SHA256

c46a09b95e3f879a6776dfcb18a034b81aab46bfcf2723765556deb2abeb952e
SHA512

01ac83445d6309bd4cff1c8be92f3b39c38b75f9d19708db7ebcab7712f1171c7434b4a9b77d71fefb28c03de0b1298a9371048e11a2f1809c56e8016df52d26
SSDEEP

1536:d2Zr9SpPVhM3AqPEwB6kWRhzzsj8Dsw+RSuRrViNGfuYm5OTkL7+t:dIvLnWRhcA+RtioVm5OTkf+t

Score

1^/10

Malware Config

Signatures

Files

c46a09b95e3f879a6776dfcb18a034b81aab46bfcf2723765556deb2abeb952e
.dll windows:6 windows x64 arch:x64

99fc1938e6d8523e415f457d13520f7e

Code Sign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:0e:01:f8:d6:da:dd:67:52:7e:d0:43:c7:80:37:92
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

13/05/2023, 07:28

Not After

11/05/2024, 06:16

Subject

CN=Open Source Developer\, Stefan KUENG,O=Open Source Developer,L=Altstätten,C=CH,1.2.840.113549.1.9.1=#0c15746f72746f69736573766e40676d61696c2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

23:f4:8a:db:de:b1:6e:c1:73:ff:44:2e:5d:34:49:7f:25:b7:f8:dc:d3:96:78:67:ec:c4:0b:6e:de:ff:ad:fa
Signer

Actual PE Digest

23:f4:8a:db:de:b1:6e:c1:73:ff:44:2e:5d:34:49:7f:25:b7:f8:dc:d3:96:78:67:ec:c4:0b:6e:de:ff:ad:fa

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Development\SVN\Releases\TortoiseSVN-1.14.x\ext\cyrus-sasl\release_x64\saslDIGESTMD5.pdb

Imports

ws2_32

ntohl
ntohs
htons
htonl

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
GetEnvironmentVariableW
QueryPerformanceCounter
GetCurrentProcessId
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
TerminateProcess

vcruntime140

__std_type_info_destroy_list
strchr
__C_specific_handler
memset
memcpy

api-ms-win-crt-string-l1-1-0

isdigit
_strnicmp
_stricmp
strpbrk
isupper
strncpy
_strdup

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

free
malloc

api-ms-win-crt-runtime-l1-1-0

_cexit
_initterm
_initterm_e
_execute_onexit_table
_seh_filter_dll
_initialize_onexit_table
_configure_narrow_argv
_initialize_narrow_environment

Exports

Exports

sasl_client_plug_init
sasl_server_plug_init

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99fc1938e6d8523e415f457d13520f7e

Code Sign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

49:0e:01:f8:d6:da:dd:67:52:7e:d0:43:c7:80:37:92Certificate

Extended Key Usages

Key Usages

23:f4:8a:db:de:b1:6e:c1:73:ff:44:2e:5d:34:49:7f:25:b7:f8:dc:d3:96:78:67:ec:c4:0b:6e:de:ff:ad:faSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 61KB - Virtual size: 60KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 156B

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

49:0e:01:f8:d6:da:dd:67:52:7e:d0:43:c7:80:37:92
Certificate

23:f4:8a:db:de:b1:6e:c1:73:ff:44:2e:5d:34:49:7f:25:b7:f8:dc:d3:96:78:67:ec:c4:0b:6e:de:ff:ad:fa
Signer

.text
Size: 61KB - Virtual size: 60KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 156B