0184efe99acd0d3fad931c7a648804cc4316f87c7fd69c27fec8ea8335dae237

Sharing

Copy URL Twitter E-mail

General

Target

0184efe99acd0d3fad931c7a648804cc4316f87c7fd69c27fec8ea8335dae237
Size

67KB
MD5

e8f86267d53d8940b3f420598c9970b4
SHA1

c8a38fa59dc6a4dac2fc2b7e91f5f919a2b76432
SHA256

0184efe99acd0d3fad931c7a648804cc4316f87c7fd69c27fec8ea8335dae237
SHA512

885fad398c485b6c523f9178b20021d9dd87141f28135e1f98240d0dbc9a048a91b27779fb93bcf999bde6dc28b1b8375ecaf9ee5410dfeba4d2e382ff763d58
SSDEEP

1536:qnbzYrycLcDfO06YWEre92ta8HRhulAR55Uf4:qn/YmcW6YEChj5P

Score

1^/10

Malware Config

Signatures

Files

0184efe99acd0d3fad931c7a648804cc4316f87c7fd69c27fec8ea8335dae237
.dll windows:6 windows x64 arch:x64

cc6c2518e05601b3f1dbe82cdb23ff55

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:10:58:84:eb:95:9d:3b:c8:b9:94:f9:18:a7:b6:ee
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2020, 00:00

Not After

11/01/2022, 12:00

Subject

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US,1.2.840.113549.1.9.1=#0c14706b6961646d5f7573406f7261636c652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a8:c0:4c:3c:ea:df:76:a5:b3:e1:26:ee:db:c9:99:5a:30:a4:be:d1:c3:de:5a:dc:e1:41:15:2c:02:be:8f:a2
Signer

Actual PE Digest

a8:c0:4c:3c:ea:df:76:a5:b3:e1:26:ee:db:c9:99:5a:30:a4:be:d1:c3:de:5a:dc:e1:41:15:2c:02:be:8f:a2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

windowsaccessbridge-64.pdb

Imports

kernel32

GetLastError
CloseHandle
EnterCriticalSection
LeaveCriticalSection
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
InitializeCriticalSection
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

user32

CreateDialogParamA
DestroyWindow
PostMessageA
SendMessageA
GetParent
ShowWindow
SendMessageTimeoutA
RegisterWindowMessageA
IsWindow
GetWindowLongA

msvcp140

_Query_perf_counter
_Query_perf_frequency

vcruntime140

memcpy
__std_type_info_destroy_list
__C_specific_handler
_CxxThrowException
memset
__std_exception_copy
__std_exception_destroy

api-ms-win-crt-string-l1-1-0

strcmp
strcpy
strncpy
strlen
wcsncpy

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fopen
__stdio_common_vsprintf
__stdio_common_vfprintf
fclose

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initialize_onexit_table
_cexit
_initialize_narrow_environment
_seh_filter_dll
_initterm_e
_initterm
_configure_narrow_argv

Exports

Exports

Windows_run
activateAccessibleHyperlink
addAccessibilityEventNotification
addAccessibleSelectionFromContext
addJavaEventNotification
clearAccessibleSelectionFromContext
doAccessibleActions
getAccessibleActions
getAccessibleChildFromContext
getAccessibleContextAt
getAccessibleContextFromHWND
getAccessibleContextInfo
getAccessibleContextWithFocus
getAccessibleHyperlink
getAccessibleHyperlinkCount
getAccessibleHypertext
getAccessibleHypertextExt
getAccessibleHypertextLinkIndex
getAccessibleIcons
getAccessibleKeyBindings
getAccessibleParentFromContext
getAccessibleRelationSet
getAccessibleSelectionCountFromContext
getAccessibleSelectionFromContext
getAccessibleTableCellInfo
getAccessibleTableColumn
getAccessibleTableColumnDescription
getAccessibleTableColumnHeader
getAccessibleTableColumnSelectionCount
getAccessibleTableColumnSelections
getAccessibleTableIndex
getAccessibleTableInfo
getAccessibleTableRow
getAccessibleTableRowDescription
getAccessibleTableRowHeader
getAccessibleTableRowSelectionCount
getAccessibleTableRowSelections
getAccessibleTextAttributes
getAccessibleTextInfo
getAccessibleTextItems
getAccessibleTextLineBounds
getAccessibleTextRange
getAccessibleTextRect
getAccessibleTextSelectionInfo
getActiveDescendent
getCaretLocation
getCurrentAccessibleValueFromContext
getEventsWaiting
getHWNDFromAccessibleContext
getMaximumAccessibleValueFromContext
getMinimumAccessibleValueFromContext
getObjectDepth
getParentWithRole
getParentWithRoleElseRoot
getTextAttributesInRange
getTopLevelObject
getVersionInfo
getVirtualAccessibleName
getVisibleChildren
getVisibleChildrenCount
isAccessibleChildSelectedFromContext
isAccessibleTableColumnSelected
isAccessibleTableRowSelected
isJavaWindow
isSameObject
releaseJavaObject
removeAccessibilityEventNotification
removeAccessibleSelectionFromContext
removeJavaEventNotification
requestFocus
selectAllAccessibleSelectionFromContext
selectTextRange
setCaretPosition
setCaretUpdateFP
setFocusGainedFP
setFocusLostFP
setJavaShutdownFP
setMenuCanceledFP
setMenuDeselectedFP
setMenuSelectedFP
setMouseClickedFP
setMouseEnteredFP
setMouseExitedFP
setMousePressedFP
setMouseReleasedFP
setPopupMenuCanceledFP
setPopupMenuWillBecomeInvisibleFP
setPopupMenuWillBecomeVisibleFP
setPropertyActiveDescendentChangeFP
setPropertyCaretChangeFP
setPropertyChangeFP
setPropertyChildChangeFP
setPropertyDescriptionChangeFP
setPropertyNameChangeFP
setPropertySelectionChangeFP
setPropertyStateChangeFP
setPropertyTableModelChangeFP
setPropertyTextChangeFP
setPropertyValueChangeFP
setPropertyVisibleDataChangeFP
setTextContents

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cc6c2518e05601b3f1dbe82cdb23ff55

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

09:10:58:84:eb:95:9d:3b:c8:b9:94:f9:18:a7:b6:eeCertificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

a8:c0:4c:3c:ea:df:76:a5:b3:e1:26:ee:db:c9:99:5a:30:a4:be:d1:c3:de:5a:dc:e1:41:15:2c:02:be:8f:a2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 30KB - Virtual size: 29KB

.rdata Size: 23KB - Virtual size: 23KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 84B

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

09:10:58:84:eb:95:9d:3b:c8:b9:94:f9:18:a7:b6:ee
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

a8:c0:4c:3c:ea:df:76:a5:b3:e1:26:ee:db:c9:99:5a:30:a4:be:d1:c3:de:5a:dc:e1:41:15:2c:02:be:8f:a2
Signer

.text
Size: 30KB - Virtual size: 29KB

.rdata
Size: 23KB - Virtual size: 23KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 84B