8627fec805a50e3c1f3634aef7ed31b2aef70fcd3460862e7475e54f17da045e

Sharing

Copy URL Twitter E-mail

General

Target

8627fec805a50e3c1f3634aef7ed31b2aef70fcd3460862e7475e54f17da045e
Size

3.1MB
MD5

8431896ffc1fc9485594ef6df4ce6738
SHA1

ed08471c60ed33ceb625b7bd5d4c533b30081bb7
SHA256

8627fec805a50e3c1f3634aef7ed31b2aef70fcd3460862e7475e54f17da045e
SHA512

16eb31877e0bd88d60fa13fac6f2b4e3725571f4000fa1615e5fbfc63c8cbaf0d8c54794d16e66c401daa74f0b2b6401f85d252ab5c30456ff7e523e1737a2e6
SSDEEP

98304:e1u8I9rcQwhePkSX/XthUMvjATdopAJ0xPTp3fOc09tNl:e1rI9rBAePHh5vjAJopAJ0xPTp3fOc0D

Score

1^/10

Malware Config

Signatures

Files

8627fec805a50e3c1f3634aef7ed31b2aef70fcd3460862e7475e54f17da045e
.exe windows:6 windows x86 arch:x86

10c8c34bcf4da53e47831f2fa23bb599

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:de:a8:38:8f:fe:fa:e2:5e:cf:70:2a:7b:9a:c7:c7
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

15/08/2023, 00:00

Not After

14/08/2024, 23:59

Subject

SERIALNUMBER=4069736,CN=Solarwinds Worldwide\, LLC,O=Solarwinds Worldwide\, LLC,L=Austin,ST=Texas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:26:67:fe:e3:6f:33:a0:75:26:8f:63:b5:44:f7:43:ce:f0:dd:36:ff:af:ce:00:da:ef:c7:d6:77:42:7f:9e
Signer

Actual PE Digest

4e:26:67:fe:e3:6f:33:a0:75:26:8f:63:b5:44:f7:43:ce:f0:dd:36:ff:af:ce:00:da:ef:c7:d6:77:42:7f:9e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\BuildAgent\work\9590350abdd7651f\src\agent\plugins\src\SolarWinds.ADM.AgentPlugin\bin\Release\SolarWinds.ADM.AgentPlugin.pdb

Imports

ws2_32

WSASetLastError
WSAGetLastError
WSAAddressToStringW
WSACleanup
htonl
WSAStringToAddressW
WSAStartup
ntohl

kernel32

lstrcpyW
OpenFileMappingA
TerminateThread
SystemTimeToFileTime
GetSystemTime
lstrlenW
LocalAlloc
SetEnvironmentVariableW
GetEnvironmentVariableW
SetLastError
TlsFree
TlsAlloc
LoadLibraryW
GetProcAddress
GetModuleFileNameW
MultiByteToWideChar
GetStringTypeExA
GetUserDefaultLCID
LCMapStringA
LoadLibraryA
FreeLibrary
WideCharToMultiByte
IsDebuggerPresent
OutputDebugStringW
GetStringTypeW
TryEnterCriticalSection
GetCurrentThreadId
CloseHandle
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
GetNativeSystemInfo
EncodePointer
CreateEventW
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
QueryPerformanceCounter
QueryPerformanceFrequency
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
CreateMutexW
OpenMutexW
WaitForSingleObject
ReleaseMutex
SetEvent
ResetEvent
CreateFileW
WriteFile
FlushFileBuffers
GetFileSize
CreateEventA
FormatMessageW
GetStringTypeExW
SetErrorMode
GetVersionExW
WaitForMultipleObjects
GetCommandLineW
InterlockedDecrement
TerminateProcess
GetSystemInfo
GetComputerNameExW
SetConsoleCtrlHandler
DeleteFileW
SetFileAttributesW
GetComputerNameW
LoadLibraryExW
CopyFileW
CreateDirectoryW
VerSetConditionMask
VerifyVersionInfoW
OpenProcess
OutputDebugStringA
GetTimeZoneInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
GetCurrentDirectoryW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileTime
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
DeviceIoControl
MoveFileExW
AreFileApisANSI
ReadFile
SetFilePointer
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
OpenEventA
ResumeThread
RtlUnwind
CreateProcessA
ExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
GetCommandLineA
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetFileType
SetStdHandle
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetExitCodeProcess
CreatePipe
FindClose
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
InterlockedIncrement
InterlockedExchange
InterlockedExchangeAdd
GetProcessTimes
CreateFileA
FindFirstFileA
GetFileSizeEx
CreateMutexA
CreateFileMappingA
CreateSemaphoreA
CreateDirectoryA
RemoveDirectoryA
UnmapViewOfFile
MapViewOfFileEx
FormatMessageA
LocalFree
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
GetCurrentProcessId

user32

wsprintfW
LoadStringW
GetActiveWindow
LoadStringA
MessageBoxW

advapi32

ConvertSidToStringSidW
LookupAccountNameW
CopySid
RegNotifyChangeKeyValue
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
OpenProcessToken
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LsaOpenPolicy
LsaNtStatusToWinError
LsaClose
LsaQueryInformationPolicy
LsaFreeMemory
RegSetValueExW
RegOpenKeyExA
RegQueryValueExA
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
OpenThreadToken
CloseServiceHandle
EnumServicesStatusExW
OpenSCManagerW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupPrivilegeValueW
AdjustTokenPrivileges

shell32

CommandLineToArgvW
SHGetFolderPathW

iphlpapi

GetAdaptersAddresses

crypt32

CertOpenStore
CryptProtectData
CertFreeCertificateContext
CertGetCertificateContextProperty
CertCloseStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CryptUnprotectData

rpcrt4

NdrClientCall2
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

sigar-x86-winnt

_sigar_proc_state_get@16
_sigar_proc_list_destroy@8
_sigar_proc_list_get@8
_sigar_strerror@8
_sigar_proc_args_get@16
_sigar_proc_args_destroy@8
_sigar_proc_exe_get@16
_sigar_close@4
_sigar_sys_info_get@8
_sigar_fqdn_get@12
_sigar_ptql_query_create@12
_sigar_ptql_query_match@16
_sigar_ptql_query_destroy@4
_sigar_ptql_query_find@12
_sigar_open@4

secur32

GetUserNameExW
GetComputerObjectNameW

oleaut32

SysFreeString

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 564KB - Virtual size: 563KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10c8c34bcf4da53e47831f2fa23bb599

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0d:de:a8:38:8f:fe:fa:e2:5e:cf:70:2a:7b:9a:c7:c7Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

4e:26:67:fe:e3:6f:33:a0:75:26:8f:63:b5:44:f7:43:ce:f0:dd:36:ff:af:ce:00:da:ef:c7:d6:77:42:7f:9eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

advapi32

shell32

iphlpapi

crypt32

rpcrt4

version

sigar-x86-winnt

secur32

oleaut32

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 564KB - Virtual size: 563KB

.data Size: 51KB - Virtual size: 59KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 140KB - Virtual size: 139KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:de:a8:38:8f:fe:fa:e2:5e:cf:70:2a:7b:9a:c7:c7
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

4e:26:67:fe:e3:6f:33:a0:75:26:8f:63:b5:44:f7:43:ce:f0:dd:36:ff:af:ce:00:da:ef:c7:d6:77:42:7f:9e
Signer

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 564KB - Virtual size: 563KB

.data
Size: 51KB - Virtual size: 59KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 140KB - Virtual size: 139KB