f223a0652c137a3935aeb0efef6e0160fdec9860128760ef6ab934b14f36c6f7

Sharing

Copy URL Twitter E-mail

General

Target

f223a0652c137a3935aeb0efef6e0160fdec9860128760ef6ab934b14f36c6f7
Size

1.8MB
MD5

35834abb632be281b563b9bd4076344c
SHA1

4562afd8fb4987c6684f83193e6b25f1d2bfe222
SHA256

f223a0652c137a3935aeb0efef6e0160fdec9860128760ef6ab934b14f36c6f7
SHA512

54258f116ed20d27cbd005e38c5920d6b6ad2b7ee552b98c6f589bb3ac5f596d8f0fbbde3e8e521097eb10fc45ac2bbd29576a0fbda1ce77cd050857f5ca00d5
SSDEEP

24576:uMqIFF69oh0lhSMXlnX3WXFe7pSCy3+4auQ7XB3N6MF2yuE2NROViRM9/kUH:uMqIFkXnWe8CyuPuWBoMF25EERW5CUH

Score

1^/10

Malware Config

Signatures

Files

f223a0652c137a3935aeb0efef6e0160fdec9860128760ef6ab934b14f36c6f7
.dll windows:6 windows x64 arch:x64

8fbcb78d10726d67e987cc52e55aa1d1

Code Sign

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/07/2015, 00:00

Not After

26/07/2018, 23:59

Subject

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cf:dd:d8:8a:bf:e2:c0:ca:43:99:ad:35:c7:42:15:b6:67:c6:9b:dd
Signer

Actual PE Digest

cf:dd:d8:8a:bf:e2:c0:ca:43:99:ad:35:c7:42:15:b6:67:c6:9b:dd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

ExpandEnvironmentStringsW
CloseHandle
WaitForSingleObject
Sleep
CreateThread
GetCurrentThread
VirtualQuery
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GlobalAlloc
GlobalFree
IsBadHugeReadPtr
WideCharToMultiByte
GetCurrentProcess
MultiByteToWideChar
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfoExW
GetLastError
InitOnceComplete
InitOnceBeginInitialize
TerminateProcess

user32

FindWindowA
SendInput
GetAsyncKeyState
GetForegroundWindow
GetCursorPos
GetKeyNameTextA
MapVirtualKeyA
GetWindowInfo

msvcp140

??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
_Mbrtowc
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ

ws2_32

WSCDeinstallProvider
WSCGetProviderPath
WSCEnumProtocols

vcruntime140

__std_type_info_destroy_list
memchr
_purecall
__C_specific_handler
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
memmove
memcmp
memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initterm
_cexit
_crt_atexit
_initterm_e
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
system
_initialize_narrow_environment
_configure_narrow_argv
abort
_seh_filter_dll
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

strcmp
strlen
wcslen

api-ms-win-crt-heap-l1-1-0

calloc
malloc
_callnewh
free

api-ms-win-crt-math-l1-1-0

sqrtf
_fdtest
tanf
_ldtest
_dtest
_fdsign
_ldsign
sinf
_dsign
powf
cosf
fabs

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s

Exports

Exports

Initialization
WSPStartup

Sections

.text
Size: 579KB - Virtual size: 578KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.txt0
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8fbcb78d10726d67e987cc52e55aa1d1

Code Sign

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

cf:dd:d8:8a:bf:e2:c0:ca:43:99:ad:35:c7:42:15:b6:67:c6:9b:ddSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

ws2_32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

Exports

Exports

Sections

.text Size: 579KB - Virtual size: 578KB

.rdata Size: 141KB - Virtual size: 141KB

.data Size: 2KB - Virtual size: 17KB

.pdata Size: 56KB - Virtual size: 55KB

.txt0 Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 512B - Virtual size: 444B

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

cf:dd:d8:8a:bf:e2:c0:ca:43:99:ad:35:c7:42:15:b6:67:c6:9b:dd
Signer

.text
Size: 579KB - Virtual size: 578KB

.rdata
Size: 141KB - Virtual size: 141KB

.data
Size: 2KB - Virtual size: 17KB

.pdata
Size: 56KB - Virtual size: 55KB

.txt0
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 512B - Virtual size: 444B