ac07e497e7f6ea501871bcab8d382e65ade55bb28ccee6c4ec85d8c23530cc74

Sharing

Copy URL

Twitter E-mail

General

Target

ac07e497e7f6ea501871bcab8d382e65ade55bb28ccee6c4ec85d8c23530cc74
Size

364KB
MD5

02e3144d81dc1ce9aafd2bb62cd5dcd8
SHA1

6e9913e9744b7c35a6918175182c2018f943877a
SHA256

ac07e497e7f6ea501871bcab8d382e65ade55bb28ccee6c4ec85d8c23530cc74
SHA512

3788ab8af0e00671e60925be0702d7368ef2c7c7e679baa5fa37940e983b3ff50d91aa7978e7cbff68022776853052532b0431cfcbf7f70c7440ffa241b80268
SSDEEP

6144:UZY8uISr7ptB4thUPgpo4cxQUBQhoqVf4tv8TBz8lokx+:8Y8uISr7p8tO4WooQGqd4tv8TB8qk8

Score

1^/10

Malware Config

Signatures

Files

ac07e497e7f6ea501871bcab8d382e65ade55bb28ccee6c4ec85d8c23530cc74
.dll windows:4 windows x86 arch:x86

bfcbb3d40bebdaf638a31b9223fef378

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c1:d5:e8:a3:af:72:52:d3:89:82:3a:00:4b:e3:1c:82:24:b7:cf:b8
Signer

Actual PE Digest

c1:d5:e8:a3:af:72:52:d3:89:82:3a:00:4b:e3:1c:82:24:b7:cf:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

j:\projects\netfilter3\bin\Release\Win32\ProtocolFilters.pdb

Imports

kernel32

WriteFile
GetFileSize
SetEndOfFile
CreateFileW
SetFilePointer
ReadFile
GetTempPathW
GetTempFileNameW
OpenProcess
DeleteFileW
InterlockedDecrement
CreateDirectoryW
LoadLibraryA
GetProcAddress
FreeLibrary
ProcessIdToSessionId
GetTickCount
CreateEventA
CreateMutexA
WaitForMultipleObjects
ReleaseMutex
LeaveCriticalSection
EnterCriticalSection
GetLastError
DeleteCriticalSection
lstrlenA
SetEvent
InitializeCriticalSection
ResetEvent
ExpandEnvironmentStringsW
CloseHandle
WaitForSingleObject
CreateProcessW
FindClose
FindNextFileW
InterlockedIncrement
FindFirstFileW
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
LCMapStringW
LCMapStringA
HeapSize
Sleep
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetStdHandle
ExitProcess
GetModuleHandleA
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
TlsFree
GetProcessHeap
GetVersionExA
GetCommandLineA
HeapReAlloc
GetSystemTimeAsFileTime
CreateThread
GetCurrentThreadId
ExitThread
MultiByteToWideChar
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapFree
HeapAlloc
SetLastError
RaiseException
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoA

advapi32

OpenProcessToken
LookupAccountSidA
LookupAccountSidW
DuplicateTokenEx
ImpersonateLoggedOnUser
RevertToSelf
GetTokenInformation

oleaut32

SysAllocString
VariantClear
SysFreeString

crypt32

CertFreeCertificateContext
CertOpenStore
CertCloseStore
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertFindCertificateInStore
CertAddCertificateContextToStore
CertAddEncodedCertificateToStore
PFXExportCertStoreEx

ssleay32

ord48
ord86
ord116
ord110
ord82
ord83
ord75
ord6
ord112
ord12
ord22
ord28
ord8
ord60
ord43
ord78
ord58
ord35
ord166
ord61
ord96
ord84
ord284
ord370
ord391
ord108
ord359
ord265
ord155
ord94
ord74
ord183
ord385

libeay32

ord1912
ord1804
ord672
ord669
ord668
ord197
ord181
ord658
ord667
ord674
ord246
ord3315
ord2604
ord281
ord224
ord857
ord254
ord851
ord298
ord639
ord333
ord2639
ord364
ord2684
ord2746
ord909
ord1299
ord444
ord1318
ord2734
ord1317
ord2672
ord109
ord1308
ord1291
ord170
ord581
ord653
ord2291
ord3205
ord58
ord188
ord573
ord656
ord670
ord673
ord279
ord3106
ord485
ord3171
ord283
ord3024
ord2186
ord664
ord1653
ord1654
ord1958
ord2442
ord566
ord578
ord579
ord657
ord648
ord129
ord2239
ord150
ord649
ord541
ord633
ord1177
ord1508
ord641
ord66
ord89
ord52
ord421
ord95
ord78
ord754
ord164

ws2_32

WSAStartup
WSACleanup
ntohl
htons
ntohs
WSAAddressToStringA

Exports

Exports

?PFObject_create@ProtocolFilters@@YAPAVPFObject@1@HH@Z
?pf_addFilter@ProtocolFilters@@YAH_KW4_PF_FilterType@1@KW4_PF_OpTarget@1@1@Z
?pf_canDisableFiltering@ProtocolFilters@@YAH_K@Z
?pf_deleteFilter@ProtocolFilters@@YAH_KW4_PF_FilterType@1@@Z
?pf_free@ProtocolFilters@@YAXXZ
?pf_getFilterCount@ProtocolFilters@@YAH_K@Z
?pf_getNFEventHandler@ProtocolFilters@@YAPAVNF_EventHandler@nfapi@@XZ
?pf_getProcessOwnerA@ProtocolFilters@@YAHKPADH@Z
?pf_getProcessOwnerW@ProtocolFilters@@YAHKPA_WH@Z
?pf_init@ProtocolFilters@@YAHPAVPFEvents@1@PB_W@Z
?pf_isFilterActive@ProtocolFilters@@YAH_KW4_PF_FilterType@1@@Z
?pf_postObject@ProtocolFilters@@YAH_KPAVPFObject@1@@Z
?pf_setRootSSLCertImportFlags@ProtocolFilters@@YAXK@Z
?pf_setRootSSLCertSubject@ProtocolFilters@@YAXPBD@Z
?pf_unzipStream@ProtocolFilters@@YAHPAVPFStream@1@@Z

Sections

.text
Size: 272KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bfcbb3d40bebdaf638a31b9223fef378

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

c1:d5:e8:a3:af:72:52:d3:89:82:3a:00:4b:e3:1c:82:24:b7:cf:b8Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

oleaut32

crypt32

ssleay32

libeay32

ws2_32

Exports

Exports

Sections

.text Size: 272KB - Virtual size: 269KB

.rdata Size: 52KB - Virtual size: 49KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 14KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

c1:d5:e8:a3:af:72:52:d3:89:82:3a:00:4b:e3:1c:82:24:b7:cf:b8
Signer

.text
Size: 272KB - Virtual size: 269KB

.rdata
Size: 52KB - Virtual size: 49KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 14KB