6cb35b9475cfdc645dd0919cf1392b2b86f1adeb31309f8a3360147e980be01a

Sharing

Copy URL Twitter E-mail

General

Target

6cb35b9475cfdc645dd0919cf1392b2b86f1adeb31309f8a3360147e980be01a
Size

459KB
MD5

9400d4bd0029dbe4556b87b6fc643ee4
SHA1

bb9b05375f25596ffbbbd59d8d0218c5cf4b80de
SHA256

6cb35b9475cfdc645dd0919cf1392b2b86f1adeb31309f8a3360147e980be01a
SHA512

9bb900e9fef067cb1a8778defa5880d8b9a62115da383a191b21555bbce239e91a9bd7bd51be10f9fe004e688b99771082114030f30440c85cacaac6c95b6d08
SSDEEP

6144:3NDmfcsq0SMn+XAshW5HMc8AnABjrLpvexF+VBBOey6F2WR81Pqy:Jm7SMewwWkBB+W8

Score

1^/10

Malware Config

Signatures

Files

6cb35b9475cfdc645dd0919cf1392b2b86f1adeb31309f8a3360147e980be01a
.dll windows:6 windows x86 arch:x86

cd5a067d5425501df4f67464ca613af1

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:3e:42:04:89:e9:95:0f:ae:01:50:30:62:54:54:c0
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/02/2023, 00:00

Not After

07/02/2026, 23:59

Subject

SERIALNUMBER=91441302MA4X2E1MX8,CN=Jiangxia Information Technology (Huizhou) Co.\, Ltd.,O=Jiangxia Information Technology (Huizhou) Co.\, Ltd.,L=Huizhou,ST=Guangdong Province,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074875697a686f75,1.3.6.1.4.1.311.60.2.1.2=#13124775616e67646f6e672050726f76696e6365,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

56:d8:7b:63:8f:53:14:ad:3c:1e:c3:b7:5e:e7:4e:2a:e3:75:43:c6:43:4e:80:65:61:eb:af:54:30:a9:de:ab
Signer

Actual PE Digest

56:d8:7b:63:8f:53:14:ad:3c:1e:c3:b7:5e:e7:4e:2a:e3:75:43:c6:43:4e:80:65:61:eb:af:54:30:a9:de:ab

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

jxm-capture-core

obs_output_get_height
obs_encoder_get_extra_data
obs_output_get_width
obs_output_get_service
obs_output_get_video_encoder
obs_output_get_settings
obs_encoder_get_settings
obs_encoder_packet_ref
obs_encoder_packet_release
obs_service_get_url
obs_service_get_key
obs_service_get_username
obs_service_get_password
obs_parse_avc_packet
obs_parse_avc_header
os_gettime_ns
dstr_copy
dstr_depad
os_event_init
os_event_destroy
os_event_try
os_event_signal
os_event_reset
os_sem_destroy
obs_output_can_begin_data_capture
os_sem_wait
os_set_thread_name
text_lookup_destroy
text_lookup_getstr
obs_register_output_s
obs_module_load_locale
blogva
obs_output_get_name
obs_properties_add_int
bmemdup
obs_data_set_default_string
obs_data_set_default_int
obs_data_set_default_bool
obs_data_get_bool
obs_properties_add_bool
obs_properties_add_list
obs_property_list_add_string
obs_output_get_delay
obs_properties_create
obs_data_get_int
obs_data_get_string
obs_data_set_int
obs_data_release
bfree
brealloc
obs_output_begin_data_capture
obs_output_end_data_capture
obs_output_initialize_encoders
os_sem_post
obs_output_signal_stop
bmalloc
os_wcs_to_utf8_ptr
array_output_serializer_init
dstr_ncat
obs_encoder_audio
obs_encoder_video
obs_encoder_get_sample_rate
obs_encoder_get_height
obs_encoder_get_width
obs_data_get_double
video_output_get_frame_rate
audio_output_get_channels
os_ftelli64
os_fopen
obs_properties_add_text
os_sleep_ms
os_event_wait
dstr_printf
obs_encoder_get_caps
obs_encoder_update
obs_encoder_get_name
obs_output_set_last_error
os_sem_init
obs_output_get_audio_encoder
blog

zlib

inflate
inflateEnd
inflateInit_

libcurl

curl_easy_setopt
curl_easy_init
curl_easy_strerror
curl_global_init
curl_easy_cleanup
curl_easy_perform

ws2_32

WSASocketW
bind
inet_addr
WSAStringToAddressA
WSAIoctl
WSAEventSelect
WSAEnumNetworkEvents
gethostbyname
WSACleanup
WSAPoll
WSAStartup
shutdown
getsockopt
ioctlsocket
closesocket
inet_pton
connect
send
socket
WSAGetLastError
getaddrinfo
freeaddrinfo
inet_ntop
recv
sendto
setsockopt
htonl
htons
ntohl
ntohs
recvfrom

winmm

timeGetTime

iphlpapi

GetBestRoute
GetAdaptersAddresses
GetIfEntry

crypt32

CertOpenSystemStoreW
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore

jxm-threads

pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_unlock
pthread_detach
pthread_create
pthread_join
pthread_mutex_lock

kernel32

SetUnhandledExceptionFilter
GetCurrentProcess
GetProcAddress
GetModuleHandleW
SwitchToThread
GetCurrentProcessId
QueryPerformanceCounter
FormatMessageA
LocalFree
TerminateProcess
WaitForMultipleObjects
CreateEventW
ResetEvent
CreateSemaphoreA
CreateThread
Sleep
WaitForSingleObject
ReleaseSemaphore
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CloseHandle
SystemTimeToFileTime
GetSystemTime
SetThreadPriority
GetCurrentThread
FormatMessageW
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
UnhandledExceptionFilter
InitializeSListHead
IsDebuggerPresent
GetLastError

advapi32

CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

vcruntime140

memcpy
memmove
memset
strchr
strrchr
memchr
strstr
__std_type_info_destroy_list
_except_handler4_common

api-ms-win-crt-stdio-l1-1-0

fseek
fgets
__stdio_common_vfprintf
fopen
fwrite
fclose
__stdio_common_vsnprintf_s
__stdio_common_vsscanf
ftell
__stdio_common_vsprintf_s
__stdio_common_vsprintf
putc
__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc
realloc

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-convert-l1-1-0

strtol
atoi
atol
strtoll
strtod

api-ms-win-crt-string-l1-1-0

strncmp
_strnicmp
_strdup
isspace
strcpy_s
strncpy_s
isprint
strncpy

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_seh_filter_dll
_cexit
_configure_narrow_argv
_initialize_narrow_environment
_execute_onexit_table
_errno
exit
_initialize_onexit_table
_initterm
strerror

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_time64
_mktime64
_localtime64
_gmtime64

api-ms-win-crt-math-l1-1-0

_dclass
_except1

api-ms-win-crt-locale-l1-1-0

localeconv

Exports

Exports

obs_module_description
obs_module_free_locale
obs_module_load
obs_module_set_locale
obs_module_set_pointer
obs_module_unload
obs_module_ver

Sections

.text
Size: 317KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cd5a067d5425501df4f67464ca613af1

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

0a:3e:42:04:89:e9:95:0f:ae:01:50:30:62:54:54:c0Certificate

Extended Key Usages

Key Usages

56:d8:7b:63:8f:53:14:ad:3c:1e:c3:b7:5e:e7:4e:2a:e3:75:43:c6:43:4e:80:65:61:eb:af:54:30:a9:de:abSigner

Headers

DLL Characteristics

File Characteristics

Imports

jxm-capture-core

zlib

libcurl

ws2_32

winmm

iphlpapi

crypt32

jxm-threads

kernel32

advapi32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 317KB - Virtual size: 317KB

.rdata Size: 116KB - Virtual size: 116KB

.data Size: 1024B - Virtual size: 15KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 13KB - Virtual size: 12KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0a:3e:42:04:89:e9:95:0f:ae:01:50:30:62:54:54:c0
Certificate

56:d8:7b:63:8f:53:14:ad:3c:1e:c3:b7:5e:e7:4e:2a:e3:75:43:c6:43:4e:80:65:61:eb:af:54:30:a9:de:ab
Signer

.text
Size: 317KB - Virtual size: 317KB

.rdata
Size: 116KB - Virtual size: 116KB

.data
Size: 1024B - Virtual size: 15KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 13KB - Virtual size: 12KB