4c3f0027d2e0e9c8664bf102fc2840e4[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4c3f0027d2e0e9c8664bf102fc2840e4.exe
Size

7.4MB
MD5

4c3f0027d2e0e9c8664bf102fc2840e4
SHA1

1af682cc65c9a3c4f1f06fc1a698cf18bfeb3e12
SHA256

5f5d2d0921c6917bd07ea44fbfef38efc470942736a13283ba4e15df051c0f38
SHA512

3baeaecaae645fe329eccabd4e9e05a589ee69edf3e60e16ed3987f2ecb5c874dc75858dfd71871ed4a116aac2f9b58822d0a2c35fcbf7a8e4e77357e63af238
SSDEEP

196608:w6Oakf78Ql8X6OAfiZ8AY/5iEvCidMtCVHb1QR:LOXDra6OP5OiEvCi+IaR

Score

1^/10

Malware Config

Signatures

Files

4c3f0027d2e0e9c8664bf102fc2840e4.exe
.exe windows:5 windows x86 arch:x86

3c629f9928a51ed1038c5709d48035af

Code Sign

1c:b9:00:c4:b2:06:fa:99:4b:bc:cd:93:a6:c2:76:06
Certificate

Issuer

CN=ASUS VivoBook EU 16X M3604YA-MB248 90NB11A1-M00B80

Not Before

12/06/2024, 15:28

Not After

13/06/2034, 15:28

Subject

CN=ASUS VivoBook EU 16X M3604YA-MB248 90NB11A1-M00B80

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a5:3c:c4:9f:f4:94:c2:ba:bc:12:f3:97:84:84:29:bf:f5:a3:a4:dc:6f:26:10:7d:0d:45:f4:c3:fd:8c:b7:84
Signer

Actual PE Digest

a5:3c:c4:9f:f4:94:c2:ba:bc:12:f3:97:84:84:29:bf:f5:a3:a4:dc:6f:26:10:7d:0d:45:f4:c3:fd:8c:b7:84

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__CxxFrameHandler3
memcmp
strlen
_EH_prolog
strncpy
malloc
_wtoi64
atexit
??_V@YAXPAX@Z
memchr
strcpy_s
strtok_s
memmove
strchr
memcpy
strcat
??_U@YAPAXI@Z
wcslen
memset

kernel32

IsProcessorFeaturePresent
LoadLibraryW
ExitProcess
GetCurrentProcess
HeapAlloc
GetProcessHeap
lstrlenA
HeapFree
SetThreadContext
WriteProcessMemory
ResumeThread
VirtualAllocEx
ReadProcessMemory
CreateProcessA
VirtualQueryEx
OpenProcess
GetComputerNameA
FileTimeToSystemTime
CloseHandle
WaitForSingleObject
CreateThread
GetDriveTypeA
GetLogicalDriveStringsA
CreateDirectoryA
LoadLibraryA
GetStringTypeW
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
GetModuleFileNameW
GetStdHandle
WriteFile
Sleep
GetCurrentThreadId
SetLastError
GetModuleHandleW
GetThreadContext
RaiseException
EncodePointer
GetLastError
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsSetValue
GetProcAddress
GetSystemTimeAsFileTime
CreateEventA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
HeapAlloc
HeapFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery

user32

wsprintfW
CharToOemA

advapi32

GetCurrentHwProfileA
GetUserNameA
RegOpenKeyExA
RegGetValueA

shell32

SHFileOperationA

ole32

CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysFreeString
VariantClear
VariantInit
SysAllocString

shlwapi

ord155

crypt32

CryptStringToBinaryA

Sections

.text
Size: - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmpX.
Size: - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmpX.
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmpX.
Size: 7.3MB - Virtual size: 7.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3c629f9928a51ed1038c5709d48035af

Code Sign

1c:b9:00:c4:b2:06:fa:99:4b:bc:cd:93:a6:c2:76:06Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

a5:3c:c4:9f:f4:94:c2:ba:bc:12:f3:97:84:84:29:bf:f5:a3:a4:dc:6f:26:10:7d:0d:45:f4:c3:fd:8c:b7:84Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

Sections

.text Size: - Virtual size: 135KB

.rdata Size: - Virtual size: 45KB

.data Size: - Virtual size: 2.1MB

.vmpX. Size: - Virtual size: 4.2MB

.vmpX. Size: 1KB - Virtual size: 1KB

.vmpX. Size: 7.3MB - Virtual size: 7.3MB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 58KB - Virtual size: 57KB

1c:b9:00:c4:b2:06:fa:99:4b:bc:cd:93:a6:c2:76:06
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

a5:3c:c4:9f:f4:94:c2:ba:bc:12:f3:97:84:84:29:bf:f5:a3:a4:dc:6f:26:10:7d:0d:45:f4:c3:fd:8c:b7:84
Signer

.text
Size: - Virtual size: 135KB

.rdata
Size: - Virtual size: 45KB

.data
Size: - Virtual size: 2.1MB

.vmpX.
Size: - Virtual size: 4.2MB

.vmpX.
Size: 1KB - Virtual size: 1KB

.vmpX.
Size: 7.3MB - Virtual size: 7.3MB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 58KB - Virtual size: 57KB