434b9d0e8d984f815090d090fa984b5647f4903165b609d3408669fcbee9ae84

Sharing

Copy URL Twitter E-mail

General

Target

434b9d0e8d984f815090d090fa984b5647f4903165b609d3408669fcbee9ae84
Size

142KB
MD5

5858969463d2d48d2a0adb713053cb18
SHA1

82c9d488e192980781b4f20afff3d7645bdbe6b6
SHA256

434b9d0e8d984f815090d090fa984b5647f4903165b609d3408669fcbee9ae84
SHA512

410db552bed744ba42dd600d752b96aa3654e6c1c51b54586b7b63c3886b09460159fa26eb1e52a3d34051cf408506b77ccc6c195318791bde39b2680a991cda
SSDEEP

3072:unzbXKguNqo15WuhHA8fJmMFzFzyemuxT0EndjDi4sgvGR/:2naguNqIou+4tFz70YtsgvGR/

Score

1^/10

Malware Config

Signatures

Files

434b9d0e8d984f815090d090fa984b5647f4903165b609d3408669fcbee9ae84
.dll windows:6 windows x86 arch:x86

a1bc1e23ad883ae841dff7f9d1f5eec8

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:bf:f1:25:c6:50:d7:c5:a0:82:20:8f
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/08/2022, 10:44

Not After

04/08/2025, 10:44

Subject

SERIALNUMBER=1027739867473,CN=AO Kaspersky Lab,O=AO Kaspersky Lab,STREET=sh Leningradskoe\, 39A / str 2,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:cc:0c:ca:0c:2c:b1:40:61:6e:db:ac:81:b9:6e
Certificate

Issuer

CN=Kaspersky Lab,O=Kaspersky Lab,L=Moscow,C=RU

Not Before

25/08/2021, 14:06

Not After

25/08/2036, 14:06

Subject

CN=Kaspersky Lab,O=Kaspersky Lab,L=Moscow,C=RU

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:9b:7d:e1:be:2a:2a:42:26:00:42:36:e6:bf:29:9a:27:24:28:7c:aa:da:d6:4a:58:0c:f2:35:e9:23:e9:ce
Signer

Actual PE Digest

3d:9b:7d:e1:be:2a:2a:42:26:00:42:36:e6:bf:29:9a:27:24:28:7c:aa:da:d6:4a:58:0c:f2:35:e9:23:e9:ce

Digest Algorithm

sha256

PE Digest Matches

true

3d:9b:7d:e1:be:2a:2a:42:26:00:42:36:e6:bf:29:9a:27:24:28:7c:aa:da:d6:4a:58:0c:f2:35:e9:23:e9:ce
Signer

Actual PE Digest

3d:9b:7d:e1:be:2a:2a:42:26:00:42:36:e6:bf:29:9a:27:24:28:7c:aa:da:d6:4a:58:0c:f2:35:e9:23:e9:ce

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\a\b\d_00000000_\b\b\execroot\k\bazel-out\x64_windows-opt\bin\component\application_control\source\facade\ac_facade.pdb

Imports

msvcp140

?__ExceptionPtrRethrow@@YAXPBX@Z
?_Xlength_error@std@@YAXPBD@Z
?__ExceptionPtrCompare@@YA_NPBX0@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?uncaught_exception@std@@YA_NXZ
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z

advapi32

LookupAccountSidW

kernel32

DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
GetCurrentProcess
InitializeSListHead
GetModuleFileNameA
HeapFree
GetModuleHandleExA
GetLastError
HeapAlloc
GetProcAddress
GetProcessHeap

vcruntime140

__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
_purecall
__std_terminate
_CxxThrowException
__std_type_info_destroy_list
memset
_except_handler4_common
memcpy
memmove

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh

api-ms-win-crt-convert-l1-1-0

mbrtowc
_itoa
wcrtomb_s

api-ms-win-crt-string-l1-1-0

towlower

api-ms-win-crt-runtime-l1-1-0

_initterm
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
terminate
_initterm_e

Exports

Exports

ekaCanUnloadModule
ekaGetObjectFactory

Sections

.text
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1bc1e23ad883ae841dff7f9d1f5eec8

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

13:bf:f1:25:c6:50:d7:c5:a0:82:20:8fCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

1a:cc:0c:ca:0c:2c:b1:40:61:6e:db:ac:81:b9:6eCertificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

3d:9b:7d:e1:be:2a:2a:42:26:00:42:36:e6:bf:29:9a:27:24:28:7c:aa:da:d6:4a:58:0c:f2:35:e9:23:e9:ceSigner

3d:9b:7d:e1:be:2a:2a:42:26:00:42:36:e6:bf:29:9a:27:24:28:7c:aa:da:d6:4a:58:0c:f2:35:e9:23:e9:ceSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp140

advapi32

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 86KB - Virtual size: 86KB

.rdata Size: 23KB - Virtual size: 22KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

13:bf:f1:25:c6:50:d7:c5:a0:82:20:8f
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

1a:cc:0c:ca:0c:2c:b1:40:61:6e:db:ac:81:b9:6e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

3d:9b:7d:e1:be:2a:2a:42:26:00:42:36:e6:bf:29:9a:27:24:28:7c:aa:da:d6:4a:58:0c:f2:35:e9:23:e9:ce
Signer

3d:9b:7d:e1:be:2a:2a:42:26:00:42:36:e6:bf:29:9a:27:24:28:7c:aa:da:d6:4a:58:0c:f2:35:e9:23:e9:ce
Signer

.text
Size: 86KB - Virtual size: 86KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB