c1bce25d24862af99673bfd1f77ffa1a48a87191bea825754ac4c7be58cd7da4

Sharing

Copy URL

Twitter E-mail

General

Target

c1bce25d24862af99673bfd1f77ffa1a48a87191bea825754ac4c7be58cd7da4
Size

7.6MB
MD5

a8b4e15aafc7c1956bbe3c57573d1bc7
SHA1

5ccaa8f9123d3c1f2228452250f1818e29eb79aa
SHA256

c1bce25d24862af99673bfd1f77ffa1a48a87191bea825754ac4c7be58cd7da4
SHA512

1d2a148d5f5005d60bad2c671302f2855ff6f3078d76db9ab042a40a23efee7759162b7b0432f70588a4f3b33e203371d0aebfc1b400a77760efb98ba126a9c9
SSDEEP

196608:MhFOg0/7wFAVxvkbErsUyX8bmuqOnN033+pG7cwq+U:MhIggP63rOnNX079qv

Score

1^/10

Malware Config

Signatures

Files

c1bce25d24862af99673bfd1f77ffa1a48a87191bea825754ac4c7be58cd7da4
.exe windows:5 windows x86 arch:x86

3c629f9928a51ed1038c5709d48035af

Code Sign

1c:b9:00:c4:b2:06:fa:99:4b:bc:cd:93:a6:c2:76:06
Certificate

Issuer

CN=ASUS VivoBook EU 16X M3604YA-MB248 90NB11A1-M00B80

Not Before

12-06-2024 15:28

Not After

13-06-2034 15:28

Subject

CN=ASUS VivoBook EU 16X M3604YA-MB248 90NB11A1-M00B80

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:34:68:8c:63:33:5e:16:22:70:c7:aa:5c:ea:38:bb:6f:7b:1b:2f:37:8f:1d:12:9d:3a:9e:85:f2:87:a4:de
Signer

Actual PE Digest

6a:34:68:8c:63:33:5e:16:22:70:c7:aa:5c:ea:38:bb:6f:7b:1b:2f:37:8f:1d:12:9d:3a:9e:85:f2:87:a4:de

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__CxxFrameHandler3
memcmp
strlen
_EH_prolog
strncpy
malloc
_wtoi64
atexit
??_V@YAXPAX@Z
memchr
strcpy_s
strtok_s
memmove
strchr
memcpy
strcat
??_U@YAPAXI@Z
wcslen
memset

kernel32

IsProcessorFeaturePresent
LoadLibraryW
ExitProcess
GetCurrentProcess
HeapAlloc
GetProcessHeap
lstrlenA
HeapFree
SetThreadContext
WriteProcessMemory
ResumeThread
VirtualAllocEx
ReadProcessMemory
CreateProcessA
VirtualQueryEx
OpenProcess
GetComputerNameA
FileTimeToSystemTime
CloseHandle
WaitForSingleObject
CreateThread
GetDriveTypeA
GetLogicalDriveStringsA
CreateDirectoryA
LoadLibraryA
GetStringTypeW
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
GetModuleFileNameW
GetStdHandle
WriteFile
Sleep
GetCurrentThreadId
SetLastError
GetModuleHandleW
GetThreadContext
RaiseException
EncodePointer
GetLastError
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsSetValue
GetProcAddress
GetSystemTimeAsFileTime
CreateEventA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
HeapAlloc
HeapFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery

user32

wsprintfW
CharToOemA

advapi32

GetCurrentHwProfileA
GetUserNameA
RegOpenKeyExA
RegGetValueA

shell32

SHFileOperationA

ole32

CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysFreeString
VariantClear
VariantInit
SysAllocString

shlwapi

ord155

crypt32

CryptStringToBinaryA

Sections

.text
Size: - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmpX.
Size: - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmpX.
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmpX.
Size: 7.6MB - Virtual size: 7.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3c629f9928a51ed1038c5709d48035af

Code Sign

1c:b9:00:c4:b2:06:fa:99:4b:bc:cd:93:a6:c2:76:06Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

6a:34:68:8c:63:33:5e:16:22:70:c7:aa:5c:ea:38:bb:6f:7b:1b:2f:37:8f:1d:12:9d:3a:9e:85:f2:87:a4:deSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

Sections

.text Size: - Virtual size: 135KB

.rdata Size: - Virtual size: 45KB

.data Size: - Virtual size: 2.1MB

.vmpX. Size: - Virtual size: 4.3MB

.vmpX. Size: 1KB - Virtual size: 1KB

.vmpX. Size: 7.6MB - Virtual size: 7.6MB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 68KB - Virtual size: 67KB

1c:b9:00:c4:b2:06:fa:99:4b:bc:cd:93:a6:c2:76:06
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

6a:34:68:8c:63:33:5e:16:22:70:c7:aa:5c:ea:38:bb:6f:7b:1b:2f:37:8f:1d:12:9d:3a:9e:85:f2:87:a4:de
Signer

.text
Size: - Virtual size: 135KB

.rdata
Size: - Virtual size: 45KB

.data
Size: - Virtual size: 2.1MB

.vmpX.
Size: - Virtual size: 4.3MB

.vmpX.
Size: 1KB - Virtual size: 1KB

.vmpX.
Size: 7.6MB - Virtual size: 7.6MB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 68KB - Virtual size: 67KB