14670fa5b5668f1ed7d605a53b2cf680N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

14670fa5b5668f1ed7d605a53b2cf680N.exe
Size

40KB
MD5

14670fa5b5668f1ed7d605a53b2cf680
SHA1

fee7ea7c50feaa9411d176541c6d31df0a2f4921
SHA256

c0a1ecea184aa47a1528fea5299a0eb887a674a4cd4af83f731ca6f555f8cbe2
SHA512

1e998751295f99d741767f44991d318be40b32ef57d2b94414b964ebba160870bc1ea576cdcc7fd6f4ff154e668670594210461d8fca455e8a26cb7888bf2fe4
SSDEEP

384:YJXDXZFGrBxcfuSR2VXWUyWH3RAP+CcWlGsNz:6XDp8Bxc9UHlUws

Score

1^/10

Malware Config

Signatures

Files

14670fa5b5668f1ed7d605a53b2cf680N.exe
.exe windows:10 windows

0dd5bdff1edae5680e13ceebb64bd9b3

Code Sign

33:00:00:03:83:ea:db:bb:d9:6f:21:b8:fa:00:00:00:00:03:83
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2020, 19:10

Not After

23/09/2021, 19:10

Subject

CN=Microsoft Windows Kits Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

75:d7:15:d7:6c:6e:8f:5c:28:c5:45:fb:bc:3d:61:33:42:a4:b0:3c:48:3d:72:38:bf:8c:1b:21:fa:3a:25:bf
Signer

Actual PE Digest

75:d7:15:d7:6c:6e:8f:5c:28:c5:45:fb:bc:3d:61:33:42:a4:b0:3c:48:3d:72:38:bf:8c:1b:21:fa:3a:25:bf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

FiltReg.pdb

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryInfoKeyW

kernel32

HeapSetInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
Sleep

msvcrt

exit
__wgetmainargs
_cexit
__setusermatherr
_initterm
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
_amsg_exit
_XcptFilter
printf
_wcsicmp
__set_app_type
_exit
wcslen

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 1006B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0dd5bdff1edae5680e13ceebb64bd9b3

Code Sign

33:00:00:03:83:ea:db:bb:d9:6f:21:b8:fa:00:00:00:00:03:83Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

75:d7:15:d7:6c:6e:8f:5c:28:c5:45:fb:bc:3d:61:33:42:a4:b0:3c:48:3d:72:38:bf:8c:1b:21:fa:3a:25:bfSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

ntdll

Sections

.text Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 580B

.pdata Size: 4KB - Virtual size: 256B

.idata Size: 4KB - Virtual size: 1006B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 276B

33:00:00:03:83:ea:db:bb:d9:6f:21:b8:fa:00:00:00:00:03:83
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

75:d7:15:d7:6c:6e:8f:5c:28:c5:45:fb:bc:3d:61:33:42:a4:b0:3c:48:3d:72:38:bf:8c:1b:21:fa:3a:25:bf
Signer

.text
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 580B

.pdata
Size: 4KB - Virtual size: 256B

.idata
Size: 4KB - Virtual size: 1006B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 276B