a2055ba5755f9434cac2b6720f7f81166989eab76cfbc0ca9d0e6b7ef511e9d3

Sharing

Copy URL Twitter E-mail

General

Target

a2055ba5755f9434cac2b6720f7f81166989eab76cfbc0ca9d0e6b7ef511e9d3
Size

383KB
MD5

c790fdf6b6dd5441ad17f0e23d65524a
SHA1

2af925a6d5dc00896a168d6c667dbaaf7d26371d
SHA256

a2055ba5755f9434cac2b6720f7f81166989eab76cfbc0ca9d0e6b7ef511e9d3
SHA512

8f806060fb8c9184dc14d8808c0406a7ea5399afb586f1b37463289a08707e82ccf2df891608500325642343f95ac40ee93ea8b22e2cc5454e6a694976884857
SSDEEP

6144:TJmPAxLx4TEvCycQh8eDCahtbvowfRvqgRvxvDtBMTh+UUTST:lmPSLagqkh8shtTo4vxUhj4

Score

1^/10

Malware Config

Signatures

Files

a2055ba5755f9434cac2b6720f7f81166989eab76cfbc0ca9d0e6b7ef511e9d3
.dll windows:5 windows x64 arch:x64

e5983e1936dda96fc595e29f394b2819

Code Sign

32:16:4f:47:01:87:9c:b6:c1:a8:77:54:49:39:ae:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/04/2020, 00:00

Not After

02/05/2022, 23:59

Subject

CN=Fasoo Co.\, Ltd.,O=Fasoo Co.\, Ltd.,L=Mapo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ec:eb:84:c8:7a:f5:e6:09:c7:fd:39:1b:f1:49:a9:b5:26:37:c0:a7
Signer

Actual PE Digest

ec:eb:84:c8:7a:f5:e6:09:c7:fd:39:1b:f1:49:a9:b5:26:37:c0:a7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\DRM_Client_Build\workspace\f_xlus\label\DRM_Client_Slave\XL_UsageSender\x64\Release\f_xlus_64.pdb

Imports

iphlpapi

GetAdaptersInfo

wininet

InternetConnectW
InternetCrackUrlW
InternetCloseHandle
InternetReadFile
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetOpenW

shfolder

SHGetFolderPathW

kernel32

IsBadReadPtr
GetProcAddress
Sleep
ExitProcess
lstrcpynA
MultiByteToWideChar
lstrcatA
lstrlenW
GetLastError
SetLastError
FreeLibrary
LoadLibraryA
SetEndOfFile
SetFilePointer
ReadFile
CloseHandle
GetFileSize
CreateFileW
WriteFile
lstrlenA
lstrcpyA
WideCharToMultiByte
lstrcmpiA
GetWindowsDirectoryW
lstrcatW
CreateDirectoryW
lstrcpyW
lstrcmpiW
OutputDebugStringW
CreateMutexW
OpenMutexW
ProcessIdToSessionId
GetCurrentProcessId
SetEvent
OpenEventW
GetVersion
DeleteFileW
SetFileAttributesW
GetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
GetCurrentProcess
WaitForSingleObject
ReleaseMutex
CreateEventW
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
GetLocalTime
GetModuleFileNameA
LeaveCriticalSection
DeleteFileA
OutputDebugStringA
CreateFileA
EnterCriticalSection
DeleteCriticalSection
CreateDirectoryA
InitializeCriticalSection
LoadLibraryW
WriteConsoleW
GetConsoleOutputCP
GetSystemInfo
GetLocaleInfoW
GetDriveTypeA
GetFullPathNameA
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GetConsoleMode
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeFormatA
GetDateFormatA
FatalAppExitA
HeapFree
GetProcessHeap
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
RaiseException
RtlPcToFileHeader
GetSystemTimeAsFileTime
GetTimeZoneInformation
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
ExitThread
GetCurrentThreadId
CreateThread
FlsSetValue
GetCommandLineA
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
TlsAlloc
FlsGetValue
FlsFree
GetCurrentThread
FlsAlloc
HeapSetInformation
HeapCreate
HeapDestroy
GetStdHandle
GetFullPathNameW
GetFileInformationByHandle
PeekNamedPipe
GetFileType
GetCurrentDirectoryA
SetCurrentDirectoryA
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetStringTypeW

user32

MsgWaitForMultipleObjects

advapi32

GetUserNameW
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
OleRun

oleaut32

VariantClear
SysFreeString
SysStringLen
SysAllocString
SetErrorInfo
VariantInit
VariantChangeType
GetErrorInfo
CreateErrorInfo

fcw_crtw2

?encode@CryptObfuscator@@QEAAHAEAVCryptBytes@@PEBDH@Z
?setHeader@CryptObfuscator@@QEAAXH@Z
??1CryptBytes@@QEAA@XZ
??1CryptObfuscator@@QEAA@XZ
??0CryptBytes@@QEAA@XZ
??0CryptObfuscator@@QEAA@XZ
?decode@CryptObfuscator@@QEAAHAEAVCryptBytes@@PEBD@Z

Exports

Exports

Init
Init2
Init3
Msg
MsgEx
Term
UpdateUsageLog

Sections

.text
Size: 283KB - Virtual size: 283KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5983e1936dda96fc595e29f394b2819

Code Sign

32:16:4f:47:01:87:9c:b6:c1:a8:77:54:49:39:ae:6bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

ec:eb:84:c8:7a:f5:e6:09:c7:fd:39:1b:f1:49:a9:b5:26:37:c0:a7Signer

Headers

File Characteristics

PDB Paths

Imports

iphlpapi

wininet

shfolder

kernel32

user32

advapi32

ole32

oleaut32

fcw_crtw2

Exports

Exports

Sections

.text Size: 283KB - Virtual size: 283KB

.rdata Size: 61KB - Virtual size: 61KB

.data Size: 9KB - Virtual size: 18KB

.pdata Size: 16KB - Virtual size: 16KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

32:16:4f:47:01:87:9c:b6:c1:a8:77:54:49:39:ae:6b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

ec:eb:84:c8:7a:f5:e6:09:c7:fd:39:1b:f1:49:a9:b5:26:37:c0:a7
Signer

.text
Size: 283KB - Virtual size: 283KB

.rdata
Size: 61KB - Virtual size: 61KB

.data
Size: 9KB - Virtual size: 18KB

.pdata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB