openssl[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

openssl.exe
Size

461KB
MD5

b363e8e1e2cff861d5904bc8944974b6
SHA1

48c450a24b2904b5f285935d7b44e698f14ca115
SHA256

fd564aef33f91e863e17425986f7a1a410f2c789cc704ab9c57ca2053b02e4c5
SHA512

eb7309a16c99f7a30263c8b2f7e97def40a64cb2261ffce6031a3a495fc672c47bf740f5320c00b2ba1942a755748dfcf15ee507d6cde6ae0b3ca6bc82d01748
SSDEEP

12288:ESG/LzFBnQC0K2yxnLA1Viw1lPD2ZibRIdbRw3jo8BJ0YP8evKQBa3ZJ/C1D5Nzs:9wYIc0EjP3iUU7BEE

Score

1^/10

Malware Config

Signatures

Files

openssl.exe
.exe windows:6 windows x86 arch:x86

3982542c79a6bb81761d7fad8f404693

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:0e:aa:29:4c:d4:ab:d9:eb:1c:c7:84:c9:24:24:3d
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03/12/2019, 00:00

Not After

07/12/2022, 12:00

Subject

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:aa:d4:1c:c1:a9:50:0b:5d:ed:a2:79:34:f4:62:3b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

13/08/2018, 00:00

Not After

11/09/2021, 23:59

Subject

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:35:01:ea:17:c5:39:29:8d:be:59:1e:52:8b:f6:60
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/02/2021, 15:35

Not After

06/03/2032, 15:35

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

31:85:e9:60:ab:e1:9f:74:88:a3:32:a2:e0:33:54:e8:6b:73:db:16:62:8a:64:2f:44:7b:97:d8:a2:cd:8d:7a
Signer

Actual PE Digest

31:85:e9:60:ab:e1:9f:74:88:a3:32:a2:e0:33:54:e8:6b:73:db:16:62:8a:64:2f:44:7b:97:d8:a2:cd:8d:7a

Digest Algorithm

sha256

PE Digest Matches

true

e2:5f:b0:59:b2:a4:43:c9:26:8a:84:5f:43:c1:d9:36:0c:9d:55:5c
Signer

Actual PE Digest

e2:5f:b0:59:b2:a4:43:c9:26:8a:84:5f:43:c1:d9:36:0c:9d:55:5c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\ob\bora-17778206\cayman_openssl\build\release\win32_vc140\openssl\build\out32dll\openssl.pdb

Imports

ssleay32

ord2
ord52
ord349
ord32
ord342
ord340
ord372
ord379
ord381
ord366
ord377
ord382
ord38
ord40
ord71
ord400
ord5
ord28
ord22
ord375
ord98
ord30
ord24
ord105
ord99
ord399
ord365
ord394
ord43
ord15
ord271
ord274
ord272
ord86
ord56
ord96
ord368
ord384
ord268
ord341
ord314
ord172
ord110
ord116
ord322
ord317
ord326
ord316
ord325
ord329
ord60
ord90
ord31
ord59
ord302
ord292
ord376
ord295
ord385
ord387
ord361
ord122
ord397
ord401
ord396
ord344
ord339
ord407
ord177
ord157
ord166
ord290
ord150
ord154
ord141
ord142
ord164
ord162
ord145
ord49
ord183
ord82
ord16
ord79
ord125
ord55
ord405
ord373
ord275
ord343
ord315
ord171
ord112
ord118
ord58
ord243
ord6
ord244
ord45
ord108
ord78
ord35
ord48
ord323
ord320
ord328
ord318
ord310
ord189
ord75
ord231
ord21
ord61
ord119
ord249
ord264
ord120
ord33
ord277
ord73
ord406
ord94
ord72
ord293
ord63
ord83
ord77
ord65
ord130
ord129
ord127
ord42
ord180
ord8
ord12
ord121
ord296
ord357
ord358
ord353
ord291
ord294
ord303
ord391
ord359
ord356
ord355
ord281
ord283
ord286
ord280
ord285
ord278
ord267
ord74

libeay32

ord2949
ord2708
ord4445
ord224
ord3205
ord3189
ord897
ord891
ord890
ord892
ord4258
ord4296
ord4429
ord298
ord190
ord2246
ord2157
ord177
ord179
ord178
ord2164
ord2161
ord198
ord197
ord2604
ord189
ord4576
ord4571
ord4380
ord4196
ord4436
ord4490
ord4450
ord4234
ord4475
ord4483
ord4394
ord4319
ord4534
ord4473
ord4347
ord4160
ord4312
ord4285
ord4338
ord4526
ord3936
ord4365
ord4293
ord4350
ord4375
ord4463
ord4184
ord4538
ord4227
ord4487
ord4396
ord4228
ord4142
ord4186
ord4345
ord4280
ord4138
ord4457
ord4155
ord4232
ord4438
ord4348
ord4292
ord4418
ord4464
ord4223
ord4273
ord4402
ord4202
ord4479
ord4468
ord4359
ord4453
ord4459
ord4467
ord517
ord518
ord267
ord268
ord3844
ord22
ord3710
ord1001
ord1002
ord3048
ord2981
ord2844
ord2647
ord2598
ord2738
ord2648
ord3023
ord2838
ord3077
ord2866
ord2897
ord3123
ord3158
ord2960
ord3028
ord3101
ord3047
ord2938
ord2971
ord2713
ord3164
ord2561
ord2935
ord2686
ord2899
ord2874
ord2921
ord4542
ord3923
ord3924
ord1183
ord2662
ord4321
ord909
ord93
ord78
ord52
ord86
ord629
ord626
ord2596
ord3676
ord4543
ord2033
ord1969
ord623
ord2452
ord625
ord558
ord556
ord555
ord1016
ord1017
ord1015
ord4545
ord3333
ord3527
ord680
ord641
ord529
ord657
ord2429
ord679
ord222
ord250
ord246
ord2067
ord1915
ord2011
ord2105
ord1654
ord1653
ord2411
ord905
ord910
ord82
ord66
ord89
ord109
ord87
ord67
ord169
ord167
ord168
ord21
ord723
ord827
ord916
ord2427
ord1905
ord3488
ord355
ord997
ord57
ord2279
ord2281
ord2276
ord2280
ord181
ord88
ord2292
ord170
ord3243
ord3241
ord154
ord2111
ord1960
ord366
ord2630
ord2821
ord4144
ord304
ord316
ord4470
ord4230
ord1010
ord281
ord4121
ord4383
ord4320
ord4119
ord4532
ord4430
ord4233
ord4330
ord4344
ord4183
ord4143
ord4272
ord4137
ord610
ord4669
ord4662
ord4664
ord877
ord769
ord872
ord4454
ord658
ord602
ord600
ord577
ord664
ord673
ord671
ord656
ord667
ord672
ord670
ord654
ord607
ord606
ord605
ord601
ord2209
ord2217
ord2544
ord3237
ord576
ord1914
ord1912
ord2286
ord2704
ord248
ord2493
ord2502
ord2478
ord2832
ord2627
ord2695
ord1508
ord1509
ord401
ord421
ord403
ord423
ord2250
ord419
ord2117
ord4489
ord188
ord3245
ord3903
ord3820
ord83
ord76
ord54
ord361
ord363
ord3837
ord4537
ord3896
ord3883
ord3109
ord4372
ord4299
ord4206
ord60
ord323
ord4253
ord285
ord4179
ord4174
ord151
ord120
ord28
ord33
ord205
ord202
ord200
ord727
ord830
ord207
ord395
ord415
ord3713
ord4687
ord4683
ord213
ord209
ord732
ord3687
ord1871
ord397
ord4690
ord3823
ord2203
ord2202
ord2743
ord3877
ord3873
ord3836
ord3857
ord330
ord255
ord4059
ord2915
ord3019
ord59
ord315
ord464
ord269
ord2936
ord2249
ord899
ord894
ord896
ord2291
ord230
ord4093
ord175
ord173
ord171
ord116
ord129
ord119
ord117
ord516
ord513
ord514
ord11
ord14
ord2052
ord2027
ord1080
ord1160
ord4739
ord2060
ord1988
ord2126
ord1908
ord1973
ord1954
ord4536
ord816
ord164
ord9
ord1205
ord13
ord1161
ord23
ord362
ord364
ord1167
ord280
ord282
ord4188
ord678
ord352
ord1901
ord1900
ord575
ord642
ord677
ord541
ord565
ord584
ord619
ord535
ord3004
ord349
ord585
ord2823
ord2742
ord2837
ord2798
ord2607
ord2543
ord2608
ord3516
ord636
ord665
ord603
ord579
ord580
ord578
ord573
ord571
ord567
ord566
ord2834
ord3087
ord3031
ord422
ord746
ord849
ord444
ord4358
ord1229
ord398
ord418
ord912
ord8
ord438
ord445
ord760
ord549
ord378
ord402
ord815
ord333
ord588
ord622
ord627
ord537
ord2391
ord863
ord4706
ord583
ord4535
ord2009
ord2063
ord2034
ord283
ord1869
ord484
ord488
ord2406
ord854
ord946
ord1985
ord227
ord253
ord420
ord944
ord1961
ord4288
ord4318
ord4247
ord55
ord3212
ord497
ord493
ord491
ord492
ord490
ord1970
ord1935
ord214
ord2014
ord832
ord416
ord1968
ord4539
ord210
ord835
ord220
ord417
ord3473
ord3422
ord3575
ord3443
ord3400
ord3742
ord3707
ord3585
ord3556
ord3452
ord3456
ord3714
ord3424
ord3519
ord3481
ord150
ord365
ord2877
ord2568
ord3528
ord2693

ws2_32

ntohs
listen
htons
htonl
connect
bind
setsockopt
WSAGetLastError
getsockname
shutdown
select
closesocket
__WSAFDIsSet
WSACancelBlockingCall
socket
gethostbyname
getservbyname
WSAStartup
WSACleanup
accept

kernel32

GetProcessTimes
WriteFile
ReadFile
FindClose
GetStdHandle
CreateThread
ExitProcess
Sleep
GetLastError
CloseHandle
GetCurrentProcessId
OpenProcess
GetSystemTime
SystemTimeToFileTime
GetModuleHandleA
SetLastError
FreeLibrary
LoadLibraryA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW

vcruntime140

strstr
memcpy
memset
strchr
_except_handler4_common

api-ms-win-crt-stdio-l1-1-0

fgets
_lseek
__acrt_iob_func
clearerr
_fileno
fopen
fputc
_kbhit
fclose
feof
fread
fputs
_set_fmode
_read
fseek
ftell
_setmode
setvbuf
fflush
ferror
__p__commode
__stdio_common_vsscanf
_write
fwrite
__stdio_common_vfprintf
_open
_close

api-ms-win-crt-runtime-l1-1-0

_controlfp_s
_crt_atexit
abort
perror
_register_onexit_function
_initialize_onexit_table
terminate
_c_exit
_cexit
__p___argv
__p___argc
_exit
_initterm_e
exit
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_wassert
_errno
signal
_seh_filter_exe
_set_app_type

api-ms-win-crt-convert-l1-1-0

atoi
atol

api-ms-win-crt-string-l1-1-0

_stricmp
islower
toupper
strspn
isdigit
isxdigit
strncmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_access

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc
_set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

_except1
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

OPENSSL_Applink

Sections

.text
Size: 305KB - Virtual size: 305KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3982542c79a6bb81761d7fad8f404693

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

61:1c:b2:8a:00:00:00:00:00:26Certificate

Key Usages

09:0e:aa:29:4c:d4:ab:d9:eb:1c:c7:84:c9:24:24:3dCertificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

5d:aa:d4:1c:c1:a9:50:0b:5d:ed:a2:79:34:f4:62:3bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

01:35:01:ea:17:c5:39:29:8d:be:59:1e:52:8b:f6:60Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

31:85:e9:60:ab:e1:9f:74:88:a3:32:a2:e0:33:54:e8:6b:73:db:16:62:8a:64:2f:44:7b:97:d8:a2:cd:8d:7aSigner

e2:5f:b0:59:b2:a4:43:c9:26:8a:84:5f:43:c1:d9:36:0c:9d:55:5cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ssleay32

libeay32

ws2_32

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 305KB - Virtual size: 305KB

.rdata Size: 102KB - Virtual size: 102KB

.data Size: 9KB - Virtual size: 14KB

.reloc Size: 23KB - Virtual size: 23KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

61:1c:b2:8a:00:00:00:00:00:26
Certificate

09:0e:aa:29:4c:d4:ab:d9:eb:1c:c7:84:c9:24:24:3d
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

5d:aa:d4:1c:c1:a9:50:0b:5d:ed:a2:79:34:f4:62:3b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

01:35:01:ea:17:c5:39:29:8d:be:59:1e:52:8b:f6:60
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

31:85:e9:60:ab:e1:9f:74:88:a3:32:a2:e0:33:54:e8:6b:73:db:16:62:8a:64:2f:44:7b:97:d8:a2:cd:8d:7a
Signer

e2:5f:b0:59:b2:a4:43:c9:26:8a:84:5f:43:c1:d9:36:0c:9d:55:5c
Signer

.text
Size: 305KB - Virtual size: 305KB

.rdata
Size: 102KB - Virtual size: 102KB

.data
Size: 9KB - Virtual size: 14KB

.reloc
Size: 23KB - Virtual size: 23KB