Um0x5sZzyb[.]exe

Resubmissions

04/07/2024, 03:09

240704-dnwxzstbqh 9

04/07/2024, 03:07

240704-dmk44a1emm 9

Sharing

Copy URL Twitter E-mail

General

Target

Um0x5sZzyb.exe
Size

3.6MB
MD5

d37afb42d8ba84390b4f266411c8fb16
SHA1

f9c6407bd340a2ce90e2bc2af51b47443fb2c061
SHA256

36fb813c3ea284e2374b0fbfe421907f2be8858cebfc15ea9f4d3ad352570fa4
SHA512

c58a37bf286278591a3cf219cec7da1e86a2ccbb6f6bc192a0465a1b052327a7d57485353c5ce4cd3d578319858e68a4516f50c6e0dfed3d231dbfa8e76e736e
SSDEEP

49152:+Z3MmgYs5OCBLSgcdg9PZQW69L8xY4cQSgBlZSzX70qUWLf621/5XuzFVgoBL3aF:QMZIz3X9Lmd3SaqD70vOP/5XmXx3/BlO

Score

1^/10

Malware Config

Signatures

Files

Um0x5sZzyb.exe
.exe windows:6 windows x64 arch:x64

2eabe9054cad5152567f0699947a2c5b

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:dd:df:41:be:4a:a8:e1:9e:36:93:d8:92:90:9b:eb
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2017, 00:00

Not After

02/02/2018, 12:00

Subject

CN=Manthe Industries\, LLC,O=Manthe Industries\, LLC,L=Appleton,ST=Wisconsin,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f6:9c:a7:81:ce:30:8c:ed:61:7e:61:d7:74:c5:41:33:a7:59:c4:40
Signer

Actual PE Digest

f6:9c:a7:81:ce:30:8c:ed:61:7e:61:d7:74:c5:41:33:a7:59:c4:40

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrcpy

Exports

Exports

?tim@@YA_KPEAX@Z
main

Sections

Size: 714KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 4.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bcdumniw
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

edpqbeir
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 43KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

2eabe9054cad5152567f0699947a2c5b

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:dd:df:41:be:4a:a8:e1:9e:36:93:d8:92:90:9b:ebCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

f6:9c:a7:81:ce:30:8c:ed:61:7e:61:d7:74:c5:41:33:a7:59:c4:40Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

Size: 714KB - Virtual size: 1.3MB

.rsrc Size: 512B - Virtual size: 480B

.idata Size: 512B - Virtual size: 4KB

Size: 512B - Virtual size: 4.9MB

bcdumniw Size: 2.8MB - Virtual size: 2.8MB

edpqbeir Size: 512B - Virtual size: 4KB

.pdata Size: 43KB - Virtual size: 44KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:dd:df:41:be:4a:a8:e1:9e:36:93:d8:92:90:9b:eb
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

f6:9c:a7:81:ce:30:8c:ed:61:7e:61:d7:74:c5:41:33:a7:59:c4:40
Signer

.rsrc
Size: 512B - Virtual size: 480B

.idata
Size: 512B - Virtual size: 4KB

bcdumniw
Size: 2.8MB - Virtual size: 2.8MB

edpqbeir
Size: 512B - Virtual size: 4KB

.pdata
Size: 43KB - Virtual size: 44KB