82a93b098852ed1547fa1afeae778afa030a023a5657dc8b48d8fb2e24661725

Sharing

Copy URL Twitter E-mail

General

Target

82a93b098852ed1547fa1afeae778afa030a023a5657dc8b48d8fb2e24661725
Size

1.9MB
MD5

127d3f65e50bf5afc91104c21dc8bf2e
SHA1

0926b014961c49f80b34259093b484e5f5efa152
SHA256

82a93b098852ed1547fa1afeae778afa030a023a5657dc8b48d8fb2e24661725
SHA512

c176fff7e48164730421ad26160e6530a3be55b6046e5959d5e4ab0a0a044caeaefcf7d92ad6e646161fbde9a22b420668f7f5832ba784e31d44109d6dda686f
SSDEEP

24576:nFRh00WrmyYHnWBbgON1p26/oe2czqOqmbiUeE2hP1olvJssOzVwOoYtGHUWzw0Y:ni08oe2CqOh2holeXVJowGHUew0Y

Score

1^/10

Malware Config

Signatures

Files

82a93b098852ed1547fa1afeae778afa030a023a5657dc8b48d8fb2e24661725
.exe windows:5 windows x86 arch:x86

724deb6ae66d741ead4d09480916721c

Code Sign

42:75:18:d2:13:53:cd:9b:4c:68:4e:b8:08:85:65:f0
Certificate

Issuer

CN=Joe's-Software-Emporium

Not Before

24/05/2019, 08:55

Not After

31/12/2039, 23:59

Subject

CN=Joe's-Software-Emporium

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f1:30:0c:65:24:25:26:86:71:f5:9c:00:d1:26:4f:51:94:3e:0d:20
Signer

Actual PE Digest

f1:30:0c:65:24:25:26:86:71:f5:9c:00:d1:26:4f:51:94:3e:0d:20

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\runfromreg no SimpleUpload & SFTP libssh\FilelessLauncher\Release\ConsoleApplication1.pdb

Imports

ws2_32

WSAStringToAddressA
htonl
ntohl
getservbyname
ntohs
__WSAFDIsSet
closesocket
ioctlsocket
getsockopt
recv
send
WSAStartup
WSAGetLastError
getpeername
getsockname
select
WSASetLastError
htons
bind
connect
inet_addr
setsockopt
socket
gethostbyaddr
gethostbyname
getservbyport
gethostname
inet_ntoa

kernel32

CreateProcessA
FindNextFileA
FindNextFileW
CreateFileA
SetLastError
GetCurrentProcess
GetLogicalDriveStringsW
QueryDosDeviceW
OpenProcess
IsWow64Process
LocalLock
QueryPerformanceFrequency
QueryPerformanceCounter
CreateProcessW
GetConsoleWindow
GetComputerNameA
GetComputerNameExW
GetComputerNameW
GetStdHandle
GetConsoleMode
SetConsoleMode
GetCurrentDirectoryA
GetModuleFileNameA
GetCurrentDirectoryW
SetCurrentDirectoryW
GetVersionExW
GetSystemInfo
SetProcessAffinityMask
SetPriorityClass
GetCurrentProcessId
GetSystemDirectoryA
GetSystemWow64DirectoryA
GetEnvironmentVariableA
DeleteFileA
GetNativeSystemInfo
GetEnvironmentStringsW
CopyFileW
Sleep
GetSystemTimeAsFileTime
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
FreeLibrary
LoadLibraryA
FormatMessageA
IsProcessorFeaturePresent
SystemTimeToFileTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringW
GetLocalTime
UnmapViewOfFile
WriteFile
MapViewOfFile
CreateFileMappingW
SetFilePointer
GetFileInformationByHandle
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
HeapReAlloc
ReadFile
GetFileSize
GetModuleFileNameW
WaitForSingleObject
FindFirstFileW
DeleteFileW
CreateFileW
CloseHandle
FindResourceW
LockResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
DecodePointer
GetProcAddress
SetThreadAffinityMask
GetProcessAffinityMask
SetThreadContext
GetThreadContext
GetThreadPriority
IsDebuggerPresent
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
CreateEventW
GetCPInfo
EncodePointer
AreFileApisANSI
CreateEventA
DuplicateHandle
SetEndOfFile
GetFileAttributesExW
FindFirstFileExW
SetEnvironmentVariableA
FreeEnvironmentStringsW
lstrcmpA
GetModuleHandleA
HeapSize
GetTickCount
GetModuleHandleW
GetLastError
RaiseException
WideCharToMultiByte
MultiByteToWideChar
LocalFree
LocalAlloc
HeapFree
GetProcessHeap
HeapAlloc
FormatMessageW
InterlockedDecrement
SetEvent
ExitThread
TerminateProcess
FreeLibraryAndExitThread
GetOEMCP
IsValidCodePage
FindFirstFileExA
WriteConsoleW
GetTimeZoneInformation
SetStdHandle
SetFilePointerEx
FlushFileBuffers
GetExitCodeProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetCurrentThread
GetACP
GetCommandLineW
GetCommandLineA
GetConsoleCP
ReadConsoleW
GetFileType
GetModuleHandleExW
ExitProcess
LoadLibraryExW
RtlUnwind
InitializeSListHead
GetStartupInfoW
GetStringTypeW
CreateDirectoryW
FindClose

user32

ShowWindow
MessageBoxW
GetDesktopWindow

advapi32

OpenProcessToken
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegQueryValueExW
RegQueryInfoKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptAcquireContextA
ConvertSidToStringSidW
CloseServiceHandle
EnumServicesStatusExW
OpenSCManagerW
CryptGenRandom
GetUserNameW
GetUserNameA
RegEnumValueW

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathA

ole32

CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SafeArrayGetElement
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
VariantClear
SysStringLen
SysAllocString
SysFreeString
SysAllocStringLen

mpr

WNetCancelConnection2W
WNetAddConnection2W

netapi32

NetApiBufferFree
NetUserGetInfo
NetUserEnum
NetUserGetLocalGroups

wininet

FtpPutFileW
InternetCloseHandle
InternetGetLastResponseInfoW
InternetOpenA
InternetConnectW

psapi

GetModuleFileNameExW
EnumProcessModules
GetModuleFileNameExA
EnumProcesses
GetMappedFileNameW

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueW

iphlpapi

GetExtendedTcpTable
GetAdaptersAddresses
GetExtendedUdpTable

crypt32

CryptMsgGetParam
CryptMsgOpenToDecode
CryptMsgUpdate
CertOpenStore
CryptMsgClose
CryptDecodeObject
CertGetNameStringA
CertFreeCertificateContext
CryptBinaryToStringA
CertFindCertificateInStore
CertComparePublicKeyInfo
CryptQueryObject
CertCloseStore
CertOpenSystemStoreW
CertEnumCertificatesInStore
CryptHashCertificate

wintrust

WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminEnumCatalogFromHash

Sections

.text
Size: 817KB - Virtual size: 817KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 317KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 699KB - Virtual size: 699KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

724deb6ae66d741ead4d09480916721c

Code Sign

42:75:18:d2:13:53:cd:9b:4c:68:4e:b8:08:85:65:f0Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

f1:30:0c:65:24:25:26:86:71:f5:9c:00:d1:26:4f:51:94:3e:0d:20Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

advapi32

shell32

ole32

oleaut32

mpr

netapi32

wininet

psapi

version

iphlpapi

crypt32

wintrust

Sections

.text Size: 817KB - Virtual size: 817KB

.rdata Size: 317KB - Virtual size: 316KB

.data Size: 18KB - Virtual size: 32KB

.rsrc Size: 699KB - Virtual size: 699KB

.reloc Size: 38KB - Virtual size: 38KB

42:75:18:d2:13:53:cd:9b:4c:68:4e:b8:08:85:65:f0
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

f1:30:0c:65:24:25:26:86:71:f5:9c:00:d1:26:4f:51:94:3e:0d:20
Signer

.text
Size: 817KB - Virtual size: 817KB

.rdata
Size: 317KB - Virtual size: 316KB

.data
Size: 18KB - Virtual size: 32KB

.rsrc
Size: 699KB - Virtual size: 699KB

.reloc
Size: 38KB - Virtual size: 38KB