ce283fd3f336621ba7f999385ebb4f493ca2dafe329a2f8f3c469bac095de6b3

Sharing

Copy URL Twitter E-mail

General

Target

ce283fd3f336621ba7f999385ebb4f493ca2dafe329a2f8f3c469bac095de6b3
Size

542KB
MD5

1e1b8f35c117f1376f07cf473276cc03
SHA1

1ffa9734828e3f47492d5a468abeeee0a9f74cbf
SHA256

ce283fd3f336621ba7f999385ebb4f493ca2dafe329a2f8f3c469bac095de6b3
SHA512

25dd42f3ef50b105ee86c211d775cab3583204d6098dbdaf6a6e6e4989419910bf57fcb4929fbf834689b93e45f3d2bb04563268a8b489a5cd012277191feea9
SSDEEP

12288:VHghUqnmUwiEGb5o3IJMiUgFJ+ZlBZmAgh1lnIvdItYEcHczhucbbh2Z9Rum4tHr:VGmNiEGb5oYJNejUPnIatYExzpqy

Score

1^/10

Malware Config

Signatures

Files

ce283fd3f336621ba7f999385ebb4f493ca2dafe329a2f8f3c469bac095de6b3
.exe windows:6 windows x86 arch:x86

ed0f9fc2e164530df46918f4bc2f80d6

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7c:3e:ea:d1:d0:1e:25:d1:ef:e1:e3:a7:88:d5:20:e8
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2018, 00:00

Not After

05/11/2020, 23:59

Subject

CN=Aquantia Corp.,OU=IT,O=Aquantia Corp.,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

be:5d:f9:cc:c6:f1:d8:1f:cb:18:b2:92:ff:46:12:a3:89:95:90:f8
Signer

Actual PE Digest

be:5d:f9:cc:c6:f1:d8:1f:cb:18:b2:92:ff:46:12:a3:89:95:90:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\GitLab-Runner\builds\f4ff0db7\0\atl\atl-flash-update\bin\Release\atlflashupdate.pdb

Imports

setupapi

SetupDiRestartDevices
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDevicePropertyW
SetupDiOpenDeviceInfoW
SetupDiGetDeviceInterfaceDetailW

kernel32

CreateEventW
DeviceIoControl
CreateDirectoryW
IsWow64Process
VerSetConditionMask
VerifyVersionInfoW
GetOEMCP
CloseHandle
CreateFileW
GetModuleFileNameW
GetCurrentProcess
GetModuleHandleW
LocalFree
FindResourceW
LoadResource
LockResource
SizeofResource
TerminateThread
GetLastError
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapSize
SetEndOfFile
SetConsoleCtrlHandler
GetStringTypeW
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleInputW
SetConsoleMode
GetTimeZoneInformation
ReadConsoleW
ReadFile
GetConsoleMode
FlushFileBuffers
EnumSystemLocalesW
WideCharToMultiByte
RaiseException
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
Sleep
SwitchToThread
GetExitCodeThread
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwind
ExitThread
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
ExitProcess
GetConsoleCP
WriteFile
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID

advapi32

GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
StopTraceW
StartTraceW
EnableTraceEx2
CreateServiceW
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
StartServiceW
OpenServiceW
QueryServiceStatusEx
TraceMessage

ole32

CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

SysStringLen
SysFreeString
SysAllocString
VariantInit
VariantClear
GetErrorInfo

Sections

.text
Size: 394KB - Virtual size: 394KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed0f9fc2e164530df46918f4bc2f80d6

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

7c:3e:ea:d1:d0:1e:25:d1:ef:e1:e3:a7:88:d5:20:e8Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

be:5d:f9:cc:c6:f1:d8:1f:cb:18:b2:92:ff:46:12:a3:89:95:90:f8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

setupapi

kernel32

advapi32

ole32

oleaut32

Sections

.text Size: 394KB - Virtual size: 394KB

.rdata Size: 100KB - Virtual size: 99KB

.data Size: 9KB - Virtual size: 13KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 22KB - Virtual size: 21KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

7c:3e:ea:d1:d0:1e:25:d1:ef:e1:e3:a7:88:d5:20:e8
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

be:5d:f9:cc:c6:f1:d8:1f:cb:18:b2:92:ff:46:12:a3:89:95:90:f8
Signer

.text
Size: 394KB - Virtual size: 394KB

.rdata
Size: 100KB - Virtual size: 99KB

.data
Size: 9KB - Virtual size: 13KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 22KB - Virtual size: 21KB