827331f1b25bb4fa0c53c15fd376f3ddf37bf3b8c446405e3f2e35df129997bb

Sharing

Copy URL Twitter E-mail

General

Target

827331f1b25bb4fa0c53c15fd376f3ddf37bf3b8c446405e3f2e35df129997bb
Size

126KB
MD5

870080eb189980ad3baecd7469722f80
SHA1

037e5db944db4248b9d4a8700de70ae1b175b23f
SHA256

827331f1b25bb4fa0c53c15fd376f3ddf37bf3b8c446405e3f2e35df129997bb
SHA512

7477dccd65dd0a4da3b1fc45aae2334f903772a88b64daf3ae55adf402ea56efd38c1648aab4d7d53cfdcab3d1a9c99f7cb983e67bd63edf369f246222661ea6
SSDEEP

3072:I9hwDzg1dgL8MwWTkOfNjYtrgI55GiBWJYjpP/YQJeNeTom8O:I9hwPKCLBjsCYjF/YpAToy

Score

1^/10

Malware Config

Signatures

Files

827331f1b25bb4fa0c53c15fd376f3ddf37bf3b8c446405e3f2e35df129997bb
.dll windows:6 windows x64 arch:x64

afce1c36c0bf4330737e3e85cfc9e4e8

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:a4:86:99:36:f8:d6:5a:08:b7:38:e3:f9:03:7b:d5
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

28/08/2023, 00:00

Not After

27/08/2024, 23:59

Subject

CN=HP Inc.,O=HP Inc.,L=Palo Alto,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:dc:45:6a:70:54:e2:2c:8f:b4:e1:61:a4:0e:db:15:21:84:23:57:10:56:ac:5c:2a:be:85:9f:1c:aa:0d:e2
Signer

Actual PE Digest

c6:dc:45:6a:70:54:e2:2c:8f:b4:e1:61:a4:0e:db:15:21:84:23:57:10:56:ac:5c:2a:be:85:9f:1c:aa:0d:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\agent\_work\2\s\tpm-tss-tools\tpm2-tools\Tpm2WinTool\..\..\OUTPUT\x64\Release\tss2-hp-tpm.pdb

Imports

tss2-mu

Tss2_MU_TPM2B_DIGEST_Marshal
Tss2_MU_TPM2B_DIGEST_Unmarshal
Tss2_MU_TPM2B_ENCRYPTED_SECRET_Marshal
Tss2_MU_TPM2B_ENCRYPTED_SECRET_Unmarshal
Tss2_MU_TPM2B_ID_OBJECT_Marshal
Tss2_MU_TPM2B_ID_OBJECT_Unmarshal
Tss2_MU_TPM2B_PRIVATE_Unmarshal
Tss2_MU_TPM2B_PUBLIC_Marshal
Tss2_MU_TPM2B_PUBLIC_Unmarshal
Tss2_MU_TPM2_HANDLE_Marshal

tss2-rc

Tss2_RC_Decode

libcrypto-3-x64

ASN1_BIT_STRING_new
ASN1_BIT_STRING_set
ASN1_BOOLEAN_it
ASN1_INTEGER_get
ASN1_INTEGER_it
ASN1_INTEGER_to_BN
ASN1_OBJECT_it
ASN1_OCTET_STRING_it
ASN1_item_d2i
ASN1_item_free
BIO_ctrl
BIO_f_base64
BIO_free
BIO_free_all
BIO_new
BIO_new_file
BIO_push
BIO_read
BIO_s_mem
BIO_set_flags
BIO_write
BN_bin2bn
BN_free
BN_get_word
BN_is_negative
BN_new
BN_set_word
CRYPTO_free
ERR_error_string
ERR_error_string_n
ERR_get_error
EVP_DecodeBlock
EVP_DigestFinal_ex
EVP_DigestInit
EVP_DigestInit_ex
EVP_DigestUpdate
EVP_EncodeBlock
EVP_MD_CTX_free
EVP_MD_CTX_new
EVP_MD_get_size
EVP_PKEY_assign
EVP_PKEY_free
EVP_PKEY_new
EVP_sha1
EVP_sha256
EVP_sha384
EVP_sha512
EVP_sm3
OBJ_nid2obj
PEM_ASN1_read_bio
PEM_read_bio_X509
PEM_write_bio_RSAPublicKey
RSA_free
RSA_new
RSA_set0_key
SHA256_Final
SHA256_Init
SHA256_Update
X509_ALGOR_free
X509_ALGOR_new
X509_ALGOR_set0
X509_NAME_add_entry_by_txt
X509_REQ_free
X509_REQ_get_subject_name
X509_REQ_new
X509_REQ_set0_signature
X509_REQ_set1_signature_algo
X509_REQ_set_pubkey
X509_REQ_set_version
X509_free
i2d_PublicKey
i2d_X509
i2d_X509_REQ
i2d_re_X509_REQ_tbs

tss2-esys

Esys_ActivateCredential
Esys_ContextLoad
Esys_ContextSave
Esys_Create
Esys_CreatePrimary
Esys_EvictControl
Esys_Finalize
Esys_FlushContext
Esys_Free
Esys_GetCapability
Esys_GetRandom
Esys_GetSysContext
Esys_Hash
Esys_Initialize
Esys_Load
Esys_LoadExternal
Esys_MakeCredential
Esys_NV_DefineSpace
Esys_NV_Read
Esys_NV_ReadPublic
Esys_NV_UndefineSpace
Esys_NV_Write
Esys_PCR_Read
Esys_PolicyGetDigest
Esys_PolicyOR
Esys_PolicyPCR
Esys_PolicySecret
Esys_ReadPublic
Esys_SetTimeout
Esys_Sign
Esys_StartAuthSession
Esys_Startup
Esys_TRSess_GetAttributes
Esys_TRSess_SetAttributes
Esys_TR_Close
Esys_TR_Deserialize
Esys_TR_FromTPMPublic
Esys_TR_GetName
Esys_TR_GetTpmHandle
Esys_TR_SetAuth

tss2-sys

Tss2_Sys_FlushContext_Prepare
Tss2_Sys_GetCommandCode
Tss2_Sys_GetCpBuffer
Tss2_Sys_GetRpBuffer
Tss2_Sys_NV_ReadPublic_Prepare
Tss2_Sys_NV_Read_Prepare
Tss2_Sys_PCR_Read_Prepare

advapi32

RegCloseKey
RegOpenKeyExA

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LocalFree
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenStore
CertVerifyTimeValidity
CryptDecodeObjectEx

libcurl

curl_easy_cleanup
curl_easy_escape
curl_easy_init
curl_easy_perform
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_free
curl_global_cleanup
curl_global_init

tss2-tcti-tbs

Tss2_Tcti_Tbs_Init

tss2-tcti-mssim

Tss2_Tcti_Mssim_Init

vcruntime140

__C_specific_handler
__std_type_info_destroy_list
memchr
memcmp
memcpy
memmove
memset
strchr
strstr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
fclose
feof
ferror
fopen
fputc
fread
fseek
ftell
fwrite
putchar
puts
rewind

api-ms-win-crt-runtime-l1-1-0

_cexit
_configure_narrow_argv
_errno
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_seh_filter_dll
strerror

api-ms-win-crt-string-l1-1-0

_strdup
isxdigit
strcmp
strcpy
strcpy_s
strlen
strncat
strncmp
strtok_s

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc
realloc

api-ms-win-crt-convert-l1-1-0

strtol
strtoul

Exports

Exports

GetPublicRsaKeyDataFromPermanentHandle
TPM2_HP_ActivateCredentials
TPM2_HP_CertificateConvertFromPemToDer
TPM2_HP_CheckKeyPermanentHandleExists
TPM2_HP_CleanUpKeyPermanentHandles
TPM2_HP_CreateAttestationKey
TPM2_HP_CreateCSR
TPM2_HP_CreateContext
TPM2_HP_CreateDeviceIDKey
TPM2_HP_CreateEndorsementKey
TPM2_HP_CreateKeyFromPermanentHandle
TPM2_HP_CreateKeyPermanentHandle
TPM2_HP_CredentialsFromHandle
TPM2_HP_DecodeBase64
TPM2_HP_DeleteKeyPermanentHandle
TPM2_HP_DeletePermanentHandle
TPM2_HP_Delete_NV_Index
TPM2_HP_Digest_FromBuffer
TPM2_HP_Digest_To_Buffer
TPM2_HP_EncodeBase64
TPM2_HP_Encrypted_Secret_FromBuffer
TPM2_HP_Encrypted_Secret_To_Buffer
TPM2_HP_Free
TPM2_HP_GetAttestationKeyBuffer
TPM2_HP_GetContextType
TPM2_HP_GetDeviceIdKeyBuffer
TPM2_HP_GetEndorsementKeyBuffer
TPM2_HP_GetLastErrorString
TPM2_HP_GetPermanentHandlesInUse
TPM2_HP_GetRandomDigest
TPM2_HP_GetTpmLockoutInfo
TPM2_HP_GetX509EndorsementCertificate
TPM2_HP_Hash_SHA256
TPM2_HP_ID_Object_FromBuffer
TPM2_HP_ID_Object_To_Buffer
TPM2_HP_IsNvIndexInUse
TPM2_HP_Load_digest_from_file
TPM2_HP_Load_encrypted_secret_from_file
TPM2_HP_Load_id_object_from_file
TPM2_HP_MakeCredentials
TPM2_HP_MakeCredentialsWithEkAk
TPM2_HP_PublicKeyToDer
TPM2_HP_PublicKeyToPem
TPM2_HP_ReadNvIndex
TPM2_HP_ReleaseContext
TPM2_HP_ReleaseCredentials
TPM2_HP_ReleaseEndorsementKey
TPM2_HP_ReleaseKeyHandle
TPM2_HP_Save_digest_to_file
TPM2_HP_Save_encrypted_secret_to_file
TPM2_HP_Save_id_object_to_file
TPM2_HP_SignDigestWithDeviceIdKey
TPM2_HP_WriteNvIndex
TPM2_HP_WriteX509EndorsementCertificateToFile

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 140B

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

afce1c36c0bf4330737e3e85cfc9e4e8

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0b:a4:86:99:36:f8:d6:5a:08:b7:38:e3:f9:03:7b:d5Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

c6:dc:45:6a:70:54:e2:2c:8f:b4:e1:61:a4:0e:db:15:21:84:23:57:10:56:ac:5c:2a:be:85:9f:1c:aa:0d:e2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

tss2-mu

tss2-rc

libcrypto-3-x64

tss2-esys

tss2-sys

advapi32

kernel32

crypt32

libcurl

tss2-tcti-tbs

tss2-tcti-mssim

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 69KB - Virtual size: 68KB

.rdata Size: 37KB - Virtual size: 36KB

.data Size: 3KB - Virtual size: 5KB

.pdata Size: 2KB - Virtual size: 2KB

.00cfg Size: 512B - Virtual size: 56B

.retplne Size: 512B - Virtual size: 140B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 636B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0b:a4:86:99:36:f8:d6:5a:08:b7:38:e3:f9:03:7b:d5
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

c6:dc:45:6a:70:54:e2:2c:8f:b4:e1:61:a4:0e:db:15:21:84:23:57:10:56:ac:5c:2a:be:85:9f:1c:aa:0d:e2
Signer

.text
Size: 69KB - Virtual size: 68KB

.rdata
Size: 37KB - Virtual size: 36KB

.data
Size: 3KB - Virtual size: 5KB

.pdata
Size: 2KB - Virtual size: 2KB

.00cfg
Size: 512B - Virtual size: 56B

.retplne
Size: 512B - Virtual size: 140B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 636B