1a958f9b33227d46b19c524ff8016538f25c47d9c98e9999a6c9c43ca4f280e4

Sharing

Copy URL Twitter E-mail

General

Target

1a958f9b33227d46b19c524ff8016538f25c47d9c98e9999a6c9c43ca4f280e4
Size

181KB
MD5

90fb929b2c8e471ef9826d308ba90bb8
SHA1

bd131e84f5193342a96bd476af1a4e865127bb45
SHA256

1a958f9b33227d46b19c524ff8016538f25c47d9c98e9999a6c9c43ca4f280e4
SHA512

3151bdba858a267fa8417e5800f99421530ea4ab7d9f8a085070a7ea632a53bb91f993e8dcd9ada5487e833546a502cf201c8f8669a4c26f86e355f2665be045
SSDEEP

3072:TfJaGptisFmaK6dXS4teOazn0NGUOAWR9/Kd7cFlEYHfWe0E3Fo9Khr9DIzC7WFB:TzpYDt6dXNt/azzPF759te

Score

1^/10

Malware Config

Signatures

Files

1a958f9b33227d46b19c524ff8016538f25c47d9c98e9999a6c9c43ca4f280e4
.dll windows:6 windows x64 arch:x64

b79895a8cbcbcd520095d0d1fe55e649

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

14/09/2023, 12:18

Not After

13/09/2026, 12:18

Subject

CN=The Document Foundation,OU=LibreOffice Build Team,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cd:25:32:25:07:bc:11:d9:ec:c4:e5:b2:90:8e:a7:04:95:f1:5b:d5:25:bf:85:22:a2:aa:4b:95:50:14:ff:9d
Signer

Actual PE Digest

cd:25:32:25:07:bc:11:d9:ec:c4:e5:b2:90:8e:a7:04:95:f1:5b:d5:25:bf:85:22:a2:aa:4b:95:50:14:ff:9d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\r\workdir\UnpackedTarball\python3\PCbuild\amd64\_ssl.pdb

Imports

ws2_32

select
WSAGetLastError

crypt32

CertFreeCRLContext
CertOpenStore
CertCloseStore
CertAddStoreToCollection
CertEnumCRLsInStore
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertEnumCertificatesInStore

libcrypto-3

OBJ_obj2txt
PEM_read_bio_X509
X509_VERIFY_PARAM_set1_host
BIO_clear_flags
a2i_IPADDRESS
X509_NAME_ENTRY_get_data
OpenSSL_version_num
BIO_up_ref
ASN1_OBJECT_free
ERR_peek_last_error
X509_get_subject_name
X509_check_ca
BIO_set_flags
OPENSSL_sk_num
X509_VERIFY_PARAM_set_hostflags
X509_STORE_add_cert
X509_get0_notAfter
DH_free
ERR_get_error
BIO_read
BIO_printf
X509_get_default_cert_file_env
X509_VERIFY_PARAM_set1_ip
OBJ_obj2nid
X509_get_default_cert_dir_env
X509_get_issuer_name
RAND_status
i2t_ASN1_OBJECT
X509_get0_notBefore
ASN1_STRING_to_UTF8
ERR_reason_error_string
BIO_ctrl
X509_VERIFY_PARAM_set_flags
i2d_X509
BIO_new
OBJ_nid2sn
i2a_ASN1_INTEGER
OBJ_txt2obj
GENERAL_NAME_free
X509_NAME_get_entry
BIO_ctrl_pending
CRYPTO_free
EC_KEY_free
X509_get_version
OPENSSL_sk_value
X509_verify_cert_error_string
X509_OBJECT_get0_X509
AUTHORITY_INFO_ACCESS_free
X509_NAME_ENTRY_set
X509_VERIFY_PARAM_clear_flags
RAND_bytes
GENERAL_NAME_print
BIO_new_fp
BIO_write
BIO_free
ASN1_STRING_get0_data
CRL_DIST_POINTS_free
X509_NAME_ENTRY_get_object
BIO_puts
BIO_gets
OPENSSL_sk_pop_free
OBJ_nid2obj
d2i_X509_bio
OpenSSL_version
X509_get_serialNumber
X509_get_default_cert_dir
X509_get_default_cert_file
RAND_add
OBJ_nid2ln
ERR_clear_error
X509_free
BIO_new_mem_buf
PEM_read_DHparams
ASN1_STRING_length
X509_get_ext_d2i
X509_OBJECT_get_type
ASN1_OCTET_STRING_free
X509_STORE_get0_objects
X509_VERIFY_PARAM_get_flags
EC_KEY_new_by_curve_name
ASN1_TIME_print
OBJ_sn2nid
BIO_free_all
BIO_s_mem
X509_NAME_entry_count
COMP_get_type
BIO_s_file

libssl-3

TLS_client_method
SSL_CTX_callback_ctrl
SSL_CIPHER_get_cipher_nid
TLSv1_2_method
SSL_CTX_get_options
SSL_ctrl
SSL_SESSION_get_timeout
SSL_SESSION_has_ticket
SSL_CTX_get_verify_callback
SSL_set_bio
SSL_CIPHER_get_bits
TLSv1_1_method
SSL_CTX_set_verify
SSL_CTX_get0_param
SSL_get_ciphers
d2i_SSL_SESSION
SSL_CIPHER_get_auth_nid
SSL_pending
SSL_CIPHER_get_kx_nid
SSL_SESSION_get_time
SSL_read
SSL_set_verify
SSL_CIPHER_get_version
SSL_CTX_get_verify_mode
SSL_CTX_set_cipher_list
SSL_set_post_handshake_auth
SSL_set_accept_state
SSL_CTX_load_verify_locations
SSL_CTX_set_num_tickets
SSL_CTX_use_certificate_chain_file
SSL_CIPHER_get_name
SSL_get_peer_finished
SSL_get1_peer_certificate
SSL_get0_param
SSL_CTX_get_default_passwd_cb_userdata
SSL_write
SSL_set_SSL_CTX
SSL_session_reused
SSL_shutdown
SSL_get_current_cipher
SSL_get_verify_mode
SSL_is_init_finished
SSL_CTX_set_session_id_context
SSL_CTX_set_msg_callback
SSL_SESSION_get_ticket_lifetime_hint
TLS_server_method
SSL_CTX_set_keylog_callback
SSL_get_error
SSL_CTX_get_num_tickets
SSL_set_connect_state
SSL_CTX_set_post_handshake_auth
SSL_CIPHER_description
SSL_set_read_ahead
SSL_select_next_proto
SSL_CTX_new
SSL_set_fd
SSL_CTX_use_PrivateKey_file
SSL_get_verify_callback
SSL_CIPHER_get_digest_nid
SSL_get_finished
SSL_set_ex_data
SSL_get_ex_data
SSL_get0_alpn_selected
SSL_CTX_clear_options
SSL_get_version
SSL_CTX_check_private_key
SSL_CTX_ctrl
SSL_CTX_free
SSL_new
SSL_CTX_set_alpn_protos
SSL_CTX_set_default_verify_paths
SSL_CTX_set_alpn_select_cb
SSL_CTX_set_options
SSL_set_session
SSL_SESSION_free
SSL_CTX_get_cert_store
SSL_get_session
SSL_free
SSL_get_current_compression
TLS_method
SSL_verify_client_post_handshake
SSL_CTX_set_default_passwd_cb
TLSv1_method
SSL_get_servername
SSL_SESSION_get_id
SSL_CIPHER_is_aead
SSL_CTX_get_default_passwd_cb
SSL_get_wbio
SSL_CIPHER_get_id
i2d_SSL_SESSION
SSL_get_shutdown
SSL_get_rbio
SSL_set_msg_callback
SSL_do_handshake
SSL_get_SSL_CTX
SSL_get_verify_result
SSL_CTX_set_default_passwd_cb_userdata

kernel32

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess

python38

PyUnicode_AsASCIIString
PyErr_WarnFormat
_PyArg_UnpackKeywords
PyExc_ValueError
PyLong_FromUnsignedLong
PyErr_Format
PyModule_AddStringConstant
_Py_FalseStruct
PyFloat_Type
PyErr_SetFromErrno
PyType_IsSubtype
PyExc_OverflowError
_Py_Dealloc
PyModule_GetDict
PyObject_Free
PyErr_ExceptionMatches
PyThread_release_lock
PyModule_AddObject
_PyArg_ParseTuple_SizeT
PyObject_GC_Del
PyErr_Fetch
PyObject_CallFunctionObjArgs
PyLong_AsLong
_PyBytes_Resize
PyUnicode_FromFormat
PyObject_GetBuffer
PyErr_BadArgument
PySet_New
PyList_New
PyModule_Create2
PyType_Ready
PyList_Append
PyUnicode_Decode
PyUnicode_FSConverter
PyDict_SetItem
PyDict_New
_PyTime_AsTimeval_noraise
PyErr_NewExceptionWithDoc
PyMem_Free
PyFrozenSet_New
PyCapsule_Import
PyErr_NoMemory
PyErr_SetFromErrnoWithFilenameObject
PyExc_OSError
PyObject_CallObject
PyErr_CheckSignals
PyObject_GC_Track
PyBytes_FromStringAndSize
_Py_NotImplementedStruct
PyType_FromSpec
PyExc_NotImplementedError
PyGILState_Ensure
_PyObject_MakeTpCall
PyUnicode_FromEncodedObject
_PyObject_New
PyExc_TypeError
PyObject_IsTrue
PyObject_Str
PyUnicode_AsUTF8String
_PyByteArray_empty_string
PyCallable_Check
PyMem_Malloc
PyList_AsTuple
PyExc_UnicodeEncodeError
_PyLong_AsInt
_Py_TrueStruct
_PyObject_GC_New
_Py_fopen_obj
PyUnicode_FromString
PyLong_FromSize_t
PyBuffer_Release
PyByteArray_Type
PyEval_RestoreThread
PyUnicode_FromStringAndSize
PyErr_WriteUnraisable
PyErr_SetString
_Py_CheckFunctionResult
PyList_Size
_PyArg_BadArgument
PyExc_AttributeError
PySet_Add
PyWeakref_GetObject
PyBuffer_FillInfo
_PyTime_GetMonotonicClock
PyThread_acquire_lock
PyDict_SetItemString
_PyArg_NoPositional
PyTuple_New
_Py_NoneStruct
PyGILState_Release
PyBytes_FromString
PyFloat_AsDouble
PyThread_allocate_lock
PyErr_SetFromWindowsErr
PyDict_GetItemWithError
PyExc_MemoryError
PyBuffer_IsContiguous
PyObject_GC_UnTrack
PyLong_FromLong
_PyErr_ChainExceptions
PyEval_SaveThread
PyUnicode_AsUTF8AndSize
PyErr_Occurred
PyBytes_AsString
_PyErr_BadInternalCall
_PyArg_CheckPositional
PyExc_RuntimeWarning
PyModule_AddIntConstant
_PyObject_SetAttrId
_PyObject_CallFunction_SizeT
_Py_BuildValue_SizeT
PyUnicode_DecodeFSDefault
PyBool_FromLong
PyErr_SetObject
PyWeakref_NewRef
PyUnicode_InternFromString
PySequence_List
_PyArg_Parse_SizeT
_PyArg_NoKeywords

vcruntime140

memcpy
memcmp
strchr
memset
__C_specific_handler
__std_type_info_destroy_list
__current_exception
__current_exception_context

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
fclose

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_execute_onexit_table
_seh_filter_dll
_initterm_e
_initterm
_initialize_onexit_table
_register_onexit_function
_errno
_configure_narrow_argv
_crt_atexit
_crt_at_quick_exit
_cexit
terminate

api-ms-win-crt-string-l1-1-0

strcmp

Exports

Exports

PyInit__ssl

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b79895a8cbcbcd520095d0d1fe55e649

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1dCertificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

cd:25:32:25:07:bc:11:d9:ec:c4:e5:b2:90:8e:a7:04:95:f1:5b:d5:25:bf:85:22:a2:aa:4b:95:50:14:ff:9dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

crypt32

libcrypto-3

libssl-3

kernel32

python38

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 53KB

.rdata Size: 73KB - Virtual size: 72KB

.data Size: 32KB - Virtual size: 33KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 4KB

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

cd:25:32:25:07:bc:11:d9:ec:c4:e5:b2:90:8e:a7:04:95:f1:5b:d5:25:bf:85:22:a2:aa:4b:95:50:14:ff:9d
Signer

.text
Size: 53KB - Virtual size: 53KB

.rdata
Size: 73KB - Virtual size: 72KB

.data
Size: 32KB - Virtual size: 33KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 4KB