runasdate-x64[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

runasdate-x64.zip
Size

56KB
MD5

8af2f91c1e162524b3e98a5d8609e700
SHA1

c951f424193fc2ad93983ffd358aa466e4a5a2cd
SHA256

647ea1883269a8478a4c84cd33f4b8a6f1dab0aa2bf3703e7f344827fc8a3d9e
SHA512

6082c448193b4769308e2881dccd64e5623af68b8ca299c11f0ee955bc0cb191f20cefb6ecf500d0bebf9ca016f2c0d412d001bd75dde355e2187e60563dd1cd
SSDEEP

768:AgKNAJIc1Uxz6Gqcwronfw/MjL+6sHz4fk7iXN71kGvsvQAQDJDxcHVRfzFUV1Nl:AbuImKOGFKMjL+d+kM8QAQDoL4hC8

Score

1^/10

Malware Config

Signatures

Files

runasdate-x64.zip
.zip
RunAsDate.chm
.chm
RunAsDate.exe
.exe windows:4 windows x64 arch:x64

2d00442cc69a1e2fdde271301b66f637

Code Sign

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-09-2019 00:00

Not After

09-09-2023 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11-05-2022 00:00

Not After

10-08-2033 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:74:c5:42:8a:00:89:a6:03:d1:12:c8:62:cf:45:84:32:0a:09:d8:04:2f:23:c5:8d:ff:5e:36:f4:76:2b:52
Signer

Actual PE Digest

5c:74:c5:42:8a:00:89:a6:03:d1:12:c8:62:cf:45:84:32:0a:09:d8:04:2f:23:c5:8d:ff:5e:36:f4:76:2b:52

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

f:\Projects\VS2005\RunAsDate\x64\release\RunAsDate.pdb

Imports

msvcrt

qsort
strlen
wcscat
strcpy
__dllonexit
_onexit
__C_specific_handler
_purecall
wcsrchr
wcscmp
??3@YAXPEAX@Z
malloc
_memicmp
free
wcschr
_wcslwr
_itow
_wcsnicmp
_XcptFilter
??2@YAPEAX_K@Z
memcmp
wcstoul
wcscpy
_wcsicmp
abs
_ultow
_wtoi
wcslen
memcpy
memset
_snwprintf
wcsncat
_c_exit
_exit
_cexit
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type

comctl32

ImageList_SetImageCount
ImageList_AddMasked
ImageList_Create
ord17

kernel32

CreateRemoteThread
ResumeThread
WriteProcessMemory
DeleteFileW
CreateProcessW
ReadProcessMemory
VirtualAllocEx
EnumResourceTypesW
Process32FirstW
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32NextW
GetCurrentProcess
CompareFileTime
GetStartupInfoW
VirtualFreeEx
WaitForSingleObject
FreeLibrary
SystemTimeToFileTime
LoadLibraryW
FileTimeToSystemTime
GetProcAddress
GetLocalTime
GetSystemTime
WriteFile
ReadFile
GetModuleFileNameW
CloseHandle
CreateFileW
GetWindowsDirectoryW
FindResourceW
OpenProcess
LoadResource
LocalFree
LoadLibraryExW
GetSystemDirectoryW
LockResource
GetTempPathW
GetDateFormatW
SizeofResource
GetLastError
FormatMessageW
GetVersionExW
GetModuleHandleW
GetTimeFormatW
SetFilePointer
GetFileAttributesW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetPrivateProfileStringW
WideCharToMultiByte
SetErrorMode

user32

DestroyIcon
LoadMenuW
GetWindowTextW
DestroyWindow
SetWindowPos
LoadStringW
EnumChildWindows
DialogBoxParamW
CreateDialogParamW
GetParent
ShowWindow
ChildWindowFromPoint
SetCursor
LoadCursorW
GetSysColorBrush
SendDlgItemMessageW
EndDialog
GetWindowRect
GetDlgItem
GetDlgItemInt
InvalidateRect
EndPaint
GetWindow
SetDlgItemInt
DrawFrameControl
SetWindowTextW
BeginPaint
SetDlgItemTextW
GetClientRect
GetDlgItemTextW
GetSystemMetrics
DeferWindowPos
SendMessageW
MessageBoxW
SetWindowLongW
GetWindowLongW
BeginDeferWindowPos
LoadImageW
SetWindowPlacement
GetWindowPlacement
EndDeferWindowPos
EnableWindow
MapWindowPoints
GetDC
ReleaseDC
GetClassNameW
MoveWindow
GetMenuItemCount
SetFocus
GetSysColor
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu

gdi32

SetTextColor
CreateFontIndirectW
SetBkMode
DeleteObject
GetDeviceCaps

comdlg32

GetOpenFileNameW

shell32

ShellExecuteExW
SHGetFileInfoW
ShellExecuteW
DragFinish
DragQueryFileW
DragAcceptFiles

ole32

CoInitialize
CoCreateInstance
CoUninitialize

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
readme.txt

Sharing

General

Malware Config

Signatures

Files

2d00442cc69a1e2fdde271301b66f637

Code Sign

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

5c:74:c5:42:8a:00:89:a6:03:d1:12:c8:62:cf:45:84:32:0a:09:d8:04:2f:23:c5:8d:ff:5e:36:f4:76:2b:52Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

comctl32

kernel32

user32

gdi32

comdlg32

shell32

ole32

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 9KB - Virtual size: 13KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 16KB - Virtual size: 15KB

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

5c:74:c5:42:8a:00:89:a6:03:d1:12:c8:62:cf:45:84:32:0a:09:d8:04:2f:23:c5:8d:ff:5e:36:f4:76:2b:52
Signer

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 9KB - Virtual size: 13KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 16KB - Virtual size: 15KB