6fd3a5528ca7c85e5a6fdab251eee859[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

6fd3a5528ca7c85e5a6fdab251eee859.bin
Size

42.9MB
MD5

bbe1fc851fe14065f1424289ee221853
SHA1

bb9439fd45dc947bff3ed87520484b2951aede20
SHA256

c5d8071bf397c55547d6d6928c9a8a6d7f42d4ca6c1c7bd2166e6a61e77ff164
SHA512

6a65625074c654f0a961dab1b6a360a3745eacf4b773a8759c61d1f6464f34bc6827be1cad3b642cbbef3fdf630b2e77cce98d5042b716c2bd3c658169927391
SSDEEP

786432:/RUiebl0oBxTFPHhj43W5mBiojIR7KZScDmTP9OOctGOrWdgz8JWS6YPJ8mL53NF:SfB0oZPHGXiEW7KUcqTZctGOrq48HL53

Score

1^/10

Malware Config

Signatures

Files

6fd3a5528ca7c85e5a6fdab251eee859.bin
.zip

Password: infected
156b1c92329a8a4d35eedaec7b58a849dba5cd38eec5a0de05cceac8229b9ec9.exe
.exe windows:6 windows x86 arch:x86

Password: infected

e504861fdb36c009b7edf6e794462775

Code Sign

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

18/03/2020, 00:00

Not After

18/03/2045, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:1a:e7:7d:ef:c0:50:2a:89:51:e2:7d
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

10/11/2023, 06:18

Not After

09/01/2025, 13:26

Subject

SERIALNUMBER=521508867,CN=Raman Karpuk,O=Raman Karpuk,L=Warszawa,ST=Województwo Mazowieckie,C=PL,1.2.840.113549.1.9.1=#0c12696e666f406163746976652d61632e636f6d,1.3.6.1.4.1.311.60.2.1.3=#1302504c,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9a:b6:7d:af:89:24:bf:fd:e3:79:d2:49:d8:98:5a:c2:e7:9a:ed:4b:3c:47:2d:ac:e5:9f:f6:ef:6f:20:7a:a3
Signer

Actual PE Digest

9a:b6:7d:af:89:24:bf:fd:e3:79:d2:49:d8:98:5a:c2:e7:9a:ed:4b:3c:47:2d:ac:e5:9f:f6:ef:6f:20:7a:a3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEnvironmentVariableW
GetUserDefaultLocaleName
SetFilePointer
GetTempPathW
GetSystemDirectoryW
Wow64RevertWow64FsRedirection
CreateRemoteThread
GetExitCodeProcess
Wow64DisableWow64FsRedirection
GetCommandLineW
GetFileSizeEx
ReadFile
CreateDirectoryW
GetProcAddress
LoadLibraryA
WriteFile
GetTickCount
CreateProcessW
SetCurrentDirectoryW
GetTickCount64
FormatMessageW
GetModuleHandleA
ReleaseMutex
CreateMutexW
GetEnvironmentVariableW
InitializeCriticalSection
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CloseHandle
DeleteFileW
GetLastError
Sleep
CreateFileW
DeviceIoControl
CreateThread
TerminateThread
DecodePointer
WriteConsoleW
HeapSize
GetStringTypeW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
SetStdHandle
GetFileAttributesExW
FlushFileBuffers
HeapReAlloc
HeapFree
HeapAlloc
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleOutputCP
ReadConsoleW
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
ExitProcess
SetFilePointerEx
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
MoveFileExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
SetLastError
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetCurrentProcessId
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerSetConditionMask
VerifyVersionInfoW
FindFirstFileA
FindNextFileA
FindClose
SetEvent
FormatMessageA
InitializeCriticalSectionAndSpinCount
ResetEvent
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetSystemInfo
GetNativeSystemInfo
GetFileAttributesW
IsWow64Process
RtlUnwind
RaiseException

user32

GetDC
LoadCursorA
ShowWindow
IsWindow
LoadBitmapA
DefWindowProcA
CreateWindowExA
GetDesktopWindow
RegisterClassExA
DestroyWindow
GetWindowRect
BeginPaint
SetWindowPos
MessageBoxW
InvalidateRect
UpdateWindow
EndPaint

gdi32

SelectObject
CreateCompatibleDC
GetDIBits
BitBlt

advapi32

StartServiceA
OpenServiceW
ControlService
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
DeleteService
OpenSCManagerA
CloseServiceHandle
CreateServiceW
RegGetValueW
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
QueryServiceStatusEx

shell32

CommandLineToArgvW
ShellExecuteExW
ShellExecuteA

ws2_32

WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockopt
closesocket
WSAStartup
getaddrinfo
inet_addr
shutdown
WSAResetEvent
WSAWaitForMultipleEvents
WSAGetLastError
inet_pton
freeaddrinfo
WSASetLastError
inet_ntop
WSACleanup
setsockopt
WSAIoctl
htons
socket
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
recvfrom
sendto
getpeername
ioctlsocket
gethostname
WSAEventSelect
ntohs

shlwapi

PathRemoveFileSpecW
PathAppendW
StrStrIW
PathCombineW

dnsapi

DnsFree
DnsQuery_A

wldap32

ord32
ord33
ord60
ord27
ord30
ord200
ord301
ord26
ord22
ord41
ord211
ord79
ord50
ord46
ord217
ord35
ord143

bcrypt

BCryptGenRandom

crypt32

CertEnumCertificatesInStore
CertOpenSystemStoreA
CertCloseStore

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aaz0
Size: 38.2MB - Virtual size: 38.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.aaz1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aaz2
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

e504861fdb36c009b7edf6e794462775

Code Sign

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8Certificate

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

03:1a:e7:7d:ef:c0:50:2a:89:51:e2:7dCertificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

9a:b6:7d:af:89:24:bf:fd:e3:79:d2:49:d8:98:5a:c2:e7:9a:ed:4b:3c:47:2d:ac:e5:9f:f6:ef:6f:20:7a:a3Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ws2_32

shlwapi

dnsapi

wldap32

bcrypt

crypt32

version

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 176KB - Virtual size: 176KB

.data Size: 5KB - Virtual size: 23KB

.aaz0 Size: 38.2MB - Virtual size: 38.2MB

.aaz1 Size: 1KB - Virtual size: 1KB

.aaz2 Size: 4.1MB - Virtual size: 4.1MB

.rsrc Size: 1.9MB - Virtual size: 1.9MB

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

03:1a:e7:7d:ef:c0:50:2a:89:51:e2:7d
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

9a:b6:7d:af:89:24:bf:fd:e3:79:d2:49:d8:98:5a:c2:e7:9a:ed:4b:3c:47:2d:ac:e5:9f:f6:ef:6f:20:7a:a3
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 176KB - Virtual size: 176KB

.data
Size: 5KB - Virtual size: 23KB

.aaz0
Size: 38.2MB - Virtual size: 38.2MB

.aaz1
Size: 1KB - Virtual size: 1KB

.aaz2
Size: 4.1MB - Virtual size: 4.1MB

.rsrc
Size: 1.9MB - Virtual size: 1.9MB