643d8e174cdfa91f2e96357e774eb53b[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

643d8e174cdfa91f2e96357e774eb53b.bin
Size

2.1MB
MD5

8f6400056e97a5b3f0abaa11eb64e165
SHA1

e7afd5080144e3a3a4618dc6f217ee799831e2ee
SHA256

32bce7cf6d6fe4ebdcd9e947e5111c174e2a6a9088a682d99b7034f663c2a7cd
SHA512

70fe5cf8257718e04ebaa95c0e70c5a0065423ec16004092abac2d41d6039eb8bdde73f200865af380b801b1ec3fd902f8e2c22e57a574ca35efb64a7e3bbc0e
SSDEEP

49152:nBTVgPQkqBnrQ5Xpga/Ed8CkKCXpy1hO7Sd7lt+LwYsLdfW:5VgPJAc5ZgQlKCXQ1hvdxt+Uhe

Score

1^/10

Malware Config

Signatures

Files

643d8e174cdfa91f2e96357e774eb53b.bin
.zip

Password: infected
4f3f450f69f6122af8c4cd268b87e4a6d10f6d7e1274d1053df4bebad681c9c9.exe
.exe windows:5 windows x64 arch:x64

Password: infected

d7433a4ea153ad5f909272a7228d38ec

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/06/2020, 00:00

Not After

22/07/2022, 12:00

Subject

SERIALNUMBER=C1067879,CN=Logitech Inc,O=Logitech Inc,L=Newark,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dd:39:c0:05:f8:c2:fa:6b:72:df:17:64:5f:86:5d:fe:bf:7f:20:7d
Signer

Actual PE Digest

dd:39:c0:05:f8:c2:fa:6b:72:df:17:64:5f:86:5d:fe:bf:7f:20:7d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleFileNameW
SetThreadPriority
ResumeThread
WaitForSingleObject
GetFileSize
GetCurrentDirectoryA
MulDiv
lstrlenW
LocalFree
FormatMessageA
CopyFileA
lstrcmpA
GetLocaleInfoA
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
GetCurrentThread
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetTickCount
SystemTimeToFileTime
ReplaceFileA
SetFileTime
GetFileTime
GetTempFileNameA
GetFullPathNameA
GetDiskFreeSpaceA
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalAlloc
GetStringTypeExA
GetThreadLocale
lstrcmpiA
DeleteFileA
MoveFileA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileA
GetVolumeInformationA
GetShortPathNameA
GlobalFlags
TlsGetValue
InitializeCriticalSection
TlsAlloc
GlobalHandle
TlsSetValue
LocalReAlloc
TlsFree
GetCPInfo
GetOEMCP
GetACP
GetProfileIntA
Sleep
SearchPathA
GetTempPathA
GetFileAttributesExA
LocalFileTimeToFileTime
GetFileSizeEx
SetErrorMode
VirtualProtect
GetWindowsDirectoryA
GetNumberFormatA
FindResourceExW
EncodePointer
DecodePointer
HeapFree
HeapAlloc
ReleaseActCtx
GetStartupInfoW
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
ExitThread
CreateThread
GetSystemTimeAsFileTime
HeapReAlloc
ExitProcess
HeapQueryInformation
HeapSize
SetStdHandle
GetFileType
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetStdHandle
HeapSetInformation
GetVersion
HeapCreate
SetHandleCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
QueryPerformanceCounter
IsValidCodePage
GetStringTypeW
LCMapStringW
CompareStringW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
WriteConsoleW
GetProcessHeap
CreateFileW
SetEnvironmentVariableA
CloseHandle
GetFileAttributesA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GlobalAlloc
GlobalReAlloc
GlobalFree
GlobalSize
FindResourceA
FreeResource
GetCurrentThreadId
GlobalFindAtomA
GlobalDeleteAtom
GetVersionExA
FreeLibrary
CompareStringA
LoadLibraryW
lstrcmpW
GlobalLock
GlobalUnlock
GetCurrentProcessId
lstrlenA
GlobalGetAtomNameA
GlobalAddAtomA
MultiByteToWideChar
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
CreateActCtxW
GetModuleFileNameA
GetCommandLineA
CreateFileA
lstrcpyA
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
ActivateActCtx
GetProcAddress
GetModuleHandleA
LoadLibraryA
GetLastError
DeactivateActCtx
SetLastError

user32

KillTimer
SetCapture
WindowFromPoint
LoadCursorW
LoadCursorA
MessageBeep
GetCursorPos
NotifyWinEvent
GetAsyncKeyState
CharUpperA
AppendMenuA
GetMenuDefaultItem
IsMenu
DrawIconEx
SetMenuDefaultItem
DrawStateA
FillRect
OpenClipboard
CopyImage
SetClipboardData
CloseClipboard
EmptyClipboard
LoadImageW
SetRect
UnionRect
GetUpdateRect
LockWindowUpdate
GetDC
ReleaseDC
GetKeyNameTextA
MapVirtualKeyA
GetMenuItemInfoA
GetMenuStringA
SystemParametersInfoA
RegisterClipboardFormatA
SetClassLongPtrA
GetSysColorBrush
ValidateRect
TranslateMessage
GetMessageA
DestroyAcceleratorTable
EnableScrollBar
UpdateLayeredWindow
MonitorFromPoint
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
RemoveMenu
InsertMenuA
DrawEdge
DrawFrameControl
DrawFocusRect
EnumDisplayMonitors
SetLayeredWindowAttributes
PostQuitMessage
MapDialogRect
SetWindowContextHelpId
LoadAcceleratorsW
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
PostThreadMessageA
WaitMessage
ShowOwnedPopups
GetIconInfo
CharUpperBuffA
FrameRect
InvertRect
HideCaret
SetCursorPos
RealChildWindowFromPoint
CopyIcon
CopyAcceleratorTableA
ToAsciiEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableA
SubtractRect
UnregisterClassA
IsClipboardFormatAvailable
GetDoubleClickTime
EnumChildWindows
CharNextA
InvalidateRgn
GetNextDlgGroupItem
DestroyCursor
DrawIcon
CreateMenu
IsCharLowerA
MapVirtualKeyExA
GetWindowRgn
GetTabbedTextExtentW
CheckMenuItem
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
SetTimer
RemovePropA
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetWindowLongPtrA
SetWindowLongPtrA
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
MessageBoxA
CreateWindowExA
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
DeferWindowPos
GetScrollInfo
SetScrollInfo
PtInRect
SetWindowPlacement
GetWindowPlacement
DefWindowProcA
CallWindowProcA
GetClassNameA
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
WinHelpA
SetWindowPos
DestroyIcon
SetFocus
GetWindowThreadProcessId
GetActiveWindow
IsWindowEnabled
EqualRect
GetDlgItem
SetWindowLongA
GetDlgCtrlID
GetKeyState
LoadIconW
SetCursor
PeekMessageA
ReleaseCapture
LoadAcceleratorsA
SetActiveWindow
InsertMenuItemA
GetMenuItemID
GetMenuItemCount
CreatePopupMenu
GetClassInfoA
IntersectRect
GetMenu
GetLastActivePopup
BringWindowToTop
SetMenu
GetDesktopWindow
GetWindowLongA
ShowWindow
TranslateAcceleratorA
IsWindow
DestroyWindow
GetClassLongPtrA
SetForegroundWindow
SetParent
GetTopWindow
GetCapture
IsWindowVisible
SetWindowRgn
IsZoomed
IsIconic
PostMessageA
OffsetRect
IsRectEmpty
CopyRect
GetWindow
GetParent
SetRectEmpty
LoadMenuW
GetSubMenu
SendMessageA
ScreenToClient
GetClientRect
InvalidateRect
UpdateWindow
GetWindowRect
InflateRect
GetSysColor
LoadBitmapW
EnableWindow
IsChild
GetFocus
ClientToScreen
LoadImageA
GetSystemMetrics
RedrawWindow
GetSystemMenu
DeleteMenu
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
CheckDlgButton
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
GetPropA
GetMenuState
ModifyMenuA

gdi32

GetDIBits
RealizePalette
SelectPalette
CreateRectRgn
CombineRgn
StretchBlt
GetObjectA
GetTextExtentPoint32A
GetStockObject
DeleteObject
CreateFontIndirectA
GetPixel
SetPixel
ExtTextOutA
GetTextMetricsA
SaveDC
PatBlt
BitBlt
SetDIBColorTable
GetTextColor
CreateRectRgnIndirect
CreateRoundRectRgn
CreatePen
CreateBitmap
SetBkColor
SetTextColor
CreateCompatibleBitmap
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
GetLayout
SetLayout
CreateDIBSection
SelectObject
DeleteDC
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutA
RectVisible
SelectClipRgn
ScaleWindowExtEx
GetCurrentPositionEx
PtVisible
StartDocA
GetWindowExtEx
CreateCompatibleDC
SetPixelV
EnumFontFamiliesExA
GetTextExtentPoint32W
GetTextExtentPointA
GetTextFaceA
GetTextAlign
GetStretchBltMode
GetROP2
GetPolyFillMode
GetBkMode
GetNearestColor
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
GetSystemPaletteEntries
GetNearestPaletteIndex
GetWindowOrgEx
SetPaletteEntries
GetPaletteEntries
CreatePalette
ExtFloodFill
LPtoDP
GetViewportOrgEx
GetRgnBox
OffsetRgn
GetCharWidthA
RoundRect
Rectangle
EndDoc
AbortDoc
SetAbortProc
EndPage
ExtSelectClipRgn
CreatePatternBrush
GetObjectType
GetDeviceCaps
CreateSolidBrush
CreateHatchBrush
SetRectRgn
GetMapMode
DPtoLP
CopyMetaFileA
CreateDCA
CreateEllipticRgn
CreatePolygonRgn
GetBkColor
Polyline
Ellipse
Polygon
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
StartPage
GetViewportExtEx

oleaut32

SysAllocString
SysAllocStringByteLen
SysStringLen
VariantCopy
SysFreeString
SysAllocStringLen
VariantInit
VariantClear
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
OleCreateFontIndirect
VariantChangeType

msimg32

AlphaBlend
TransparentBlt

comctl32

ImageList_GetIconSize
ImageList_Destroy
ImageList_DrawEx
ImageList_ReplaceIcon
ImageList_GetImageCount
ImageList_Create
ImageList_GetIcon
InitCommonControlsEx

shlwapi

PathIsUNCA
PathStripToRootA
UrlUnescapeA
PathFindFileNameA
PathFindExtensionA
PathRemoveFileSpecW

oledlg

ord8

gdiplus

GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipGetImagePalette
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipDrawImageI

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

wininet

InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetOpenUrlA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetQueryDataAvailable
InternetCloseHandle
HttpQueryInfoA
InternetSetOptionExA

winmm

PlaySoundA

winspool.drv

ClosePrinter
OpenPrinterA
GetJobA
DocumentPropertiesA

comdlg32

GetFileTitleA

advapi32

RegOpenKeyExW
RegEnumValueA
RegCloseKey
RegSetValueA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
SetFileSecurityA
GetFileSecurityA
RegEnumKeyExA

shell32

DragFinish
SHGetFileInfoA
SHAppBarMessage
ShellExecuteA
SHAddToRecentDocs
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ExtractIconA
DragQueryFileA

ole32

CoRegisterMessageFilter
StgCreateDocfileOnILockBytes
CoInitializeEx
StringFromCLSID
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
CoRevokeClassObject
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoGetClassObject
OleLockRunning
OleGetClipboard
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
CreateILockBytesOnHGlobal
CoTaskMemFree
CreateStreamOnHGlobal
StgOpenStorageOnILockBytes
CLSIDFromString
CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoCreateGuid
CoInitialize
CoCreateInstance
CoUninitialize
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
OleDestroyMenuDescriptor

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 686KB - Virtual size: 686KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

d7433a4ea153ad5f909272a7228d38ec

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

dd:39:c0:05:f8:c2:fa:6b:72:df:17:64:5f:86:5d:fe:bf:7f:20:7dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

oleaut32

msimg32

comctl32

shlwapi

oledlg

gdiplus

oleacc

imm32

wininet

winmm

winspool.drv

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 686KB - Virtual size: 686KB

.data Size: 37KB - Virtual size: 86KB

.pdata Size: 93KB - Virtual size: 92KB

text Size: 3KB - Virtual size: 2KB

data Size: 2KB - Virtual size: 1KB

.vmp0 Size: 2KB - Virtual size: 2KB

.reloc Size: 64KB - Virtual size: 64KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

08:fc:2a:6c:41:1d:88:e7:25:3c:3d:99:17:0e:ae:62
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

dd:39:c0:05:f8:c2:fa:6b:72:df:17:64:5f:86:5d:fe:bf:7f:20:7d
Signer

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 686KB - Virtual size: 686KB

.data
Size: 37KB - Virtual size: 86KB

.pdata
Size: 93KB - Virtual size: 92KB

text
Size: 3KB - Virtual size: 2KB

data
Size: 2KB - Virtual size: 1KB

.vmp0
Size: 2KB - Virtual size: 2KB

.reloc
Size: 64KB - Virtual size: 64KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB