42eebaf5f8aa5ae94917c090b5deb840N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

42eebaf5f8aa5ae94917c090b5deb840N.exe
Size

1.7MB
MD5

42eebaf5f8aa5ae94917c090b5deb840
SHA1

87ceb4d3e04353b523c6ca1aceb1507ecae279bb
SHA256

2243ccfff725bb8acdb9422b8b703417f065fe647349d8d827df4570980fd7e9
SHA512

353a598bfe59bbfc54fc7f754359f248615a6780befadc84dc4a9d9d1bd88b10cbcedac7312ac1c02e9a8ba44ca3f046a1fcbe13319e26113fe29284fe7babf6
SSDEEP

49152:ksFyGoinwJPRyZxQsCgEwsWqbszN8v1uH3:ryGoinwJJyZxzMwxqy

Score

1^/10

Malware Config

Signatures

Files

42eebaf5f8aa5ae94917c090b5deb840N.exe
.dll windows:5 windows x86 arch:x86

f62efa69d5fafc8c9191df41b76f8df3

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:18:7f:d7:df:d2:40:ff:87:b8:cc:9c
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

21/05/2021, 07:38

Not After

21/05/2024, 07:38

Subject

SERIALNUMBER=200111-0632202,CN=OORT Inc.,O=OORT Inc.,STREET=61\, Geumbong-ro,L=Gwangsan-gu,ST=Gwangju,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

28/01/2021, 11:08

Not After

01/03/2032, 11:08

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:18:7f:d7:df:d2:40:ff:87:b8:cc:9c
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

21/05/2021, 07:38

Not After

21/05/2024, 07:38

Subject

SERIALNUMBER=200111-0632202,CN=OORT Inc.,O=OORT Inc.,STREET=61\, Geumbong-ro,L=Gwangsan-gu,ST=Gwangju,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

28/01/2021, 11:08

Not After

01/03/2032, 11:08

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

97:32:24:22:0a:82:86:eb:3d:9d:40:50:51:b3:e2:7b:d3:22:e7:ce:c6:f4:0b:fd:71:f4:30:20:6b:ca:c4:ca
Signer

Actual PE Digest

97:32:24:22:0a:82:86:eb:3d:9d:40:50:51:b3:e2:7b:d3:22:e7:ce:c6:f4:0b:fd:71:f4:30:20:6b:ca:c4:ca

Digest Algorithm

sha256

PE Digest Matches

false

a8:78:69:06:80:ee:fc:12:08:8b:80:a8:6e:82:0c:61:fd:f8:03:8e
Signer

Actual PE Digest

a8:78:69:06:80:ee:fc:12:08:8b:80:a8:6e:82:0c:61:fd:f8:03:8e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Project\ocam\bin\x86\FFMpegEncoder.pdb

Imports

kernel32

LoadLibraryW
GetProcAddress
TryEnterCriticalSection
WaitForSingleObject
SetEvent
InitializeCriticalSection
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
ResetEvent
CreateSemaphoreW
GetExitCodeThread
CreateEventW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
CreateEventA
WaitForSingleObjectEx
LoadLibraryExA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
HeapFree
HeapAlloc
CreateThread
GetCurrentThreadId
ExitThread
LoadLibraryExW
GetCommandLineA
RtlUnwind
GetCPInfo
FatalAppExitA
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
FreeLibrary
GetModuleHandleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsDebuggerPresent
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
GetProcessHeap
GetCurrentThread
GetStdHandle
WriteFile
GetModuleFileNameW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
SetFilePointerEx
GetFileType
GetModuleFileNameA
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
SetConsoleCtrlHandler
GetTimeZoneInformation
CreateFileW
OutputDebugStringW
SetStdHandle
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableA
Sleep
DeleteCriticalSection
DecodePointer
GetLastError
RaiseException
GetTickCount
WaitForMultipleObjects
SwitchToThread
SetErrorMode
FindNextFileW
FindFirstFileW
GetFileAttributesW
FindClose
LocalFree
FormatMessageA
SystemTimeToFileTime
InitializeCriticalSectionAndSpinCount
CreateWaitableTimerA
GetModuleHandleA
GetLogicalProcessorInformation
GetSystemInfo
ResumeThread
SetWaitableTimer
OpenEventA
WaitForMultipleObjectsEx

user32

UnregisterClassW
GetClientRect
GetSystemMetrics

ole32

CoTaskMemFree
StringFromCLSID

avcodec-ocam-57

av_cpb_properties_alloc
av_fast_padded_malloc
av_init_packet
av_new_packet
av_packet_get_side_data
av_packet_new_side_data
av_packet_rescale_ts
av_packet_unref
avcodec_alloc_context3
avcodec_close
avcodec_encode_audio2
avcodec_encode_video2
avcodec_fill_audio_frame
avcodec_find_encoder
avcodec_find_encoder_by_name
avcodec_free_context
avcodec_open2
avcodec_register

avformat-ocam-57

av_codec_get_id
av_interleaved_write_frame
av_register_all
av_write_trailer
avformat_alloc_output_context2
avformat_free_context
avformat_new_stream
avformat_write_header
avio_close
avio_open

avutil-ocam-55

av_default_item_name
av_fifo_alloc
av_fifo_free
av_fifo_freep
av_fifo_generic_read
av_fifo_generic_write
av_fifo_reset
av_fifo_size
av_frame_alloc
av_frame_free
av_frame_get_buffer
av_frame_unref
av_free
av_freep
av_get_bytes_per_sample
av_get_default_channel_layout
av_image_alloc
av_image_copy
av_image_copy_plane
av_image_fill_linesizes
av_image_fill_pointers
av_log
av_log_default_callback
av_log_format_line
av_log_set_callback
av_malloc
av_mallocz
av_opt_set
av_opt_set_bin
av_realloc_array
av_reduce
av_rescale_q
av_rescale_rnd
av_sample_fmt_is_planar
av_samples_alloc
av_samples_get_buffer_size

swscale-ocam-4

sws_freeContext
sws_getContext
sws_scale

swresample-ocam-2

swr_alloc_set_opts
swr_convert
swr_free
swr_init

avfilter-ocam-6

av_buffersink_get_frame_flags
av_buffersrc_add_frame
av_buffersrc_add_frame_flags
avfilter_get_by_name
avfilter_graph_alloc
avfilter_graph_config
avfilter_graph_create_filter
avfilter_graph_free
avfilter_graph_parse2
avfilter_graph_request_oldest
avfilter_inout_free
avfilter_link
avfilter_register_all

advapi32

RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey

Exports

Exports

CreateFFMpegBGR24Scale
CreateFFMpegEncoderInstance
CreateFFMpegImageScale
CreateFFMpegPCMStreamMix
CreateFFMpegPaletteHelper

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

IPPCODE
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f62efa69d5fafc8c9191df41b76f8df3

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

14:18:7f:d7:df:d2:40:ff:87:b8:cc:9cCertificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

14:18:7f:d7:df:d2:40:ff:87:b8:cc:9cCertificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

97:32:24:22:0a:82:86:eb:3d:9d:40:50:51:b3:e2:7b:d3:22:e7:ce:c6:f4:0b:fd:71:f4:30:20:6b:ca:c4:caSigner

a8:78:69:06:80:ee:fc:12:08:8b:80:a8:6e:82:0c:61:fd:f8:03:8eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

avcodec-ocam-57

avformat-ocam-57

avutil-ocam-55

swscale-ocam-4

swresample-ocam-2

avfilter-ocam-6

advapi32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

IPPCODE Size: 43KB - Virtual size: 42KB

.rodata Size: 4KB - Virtual size: 4KB

.rdata Size: 240KB - Virtual size: 240KB

.data Size: 20KB - Virtual size: 49KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 51KB - Virtual size: 50KB

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

14:18:7f:d7:df:d2:40:ff:87:b8:cc:9c
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

14:18:7f:d7:df:d2:40:ff:87:b8:cc:9c
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

97:32:24:22:0a:82:86:eb:3d:9d:40:50:51:b3:e2:7b:d3:22:e7:ce:c6:f4:0b:fd:71:f4:30:20:6b:ca:c4:ca
Signer

a8:78:69:06:80:ee:fc:12:08:8b:80:a8:6e:82:0c:61:fd:f8:03:8e
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

IPPCODE
Size: 43KB - Virtual size: 42KB

.rodata
Size: 4KB - Virtual size: 4KB

.rdata
Size: 240KB - Virtual size: 240KB

.data
Size: 20KB - Virtual size: 49KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 51KB - Virtual size: 50KB