5rLRUNgfyZXO8gl8KtOF7kGfgTWLYL6P[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5rLRUNgfyZXO8gl8KtOF7kGfgTWLYL6P.exe
Size

14.1MB
MD5

65dfa1306dfe9ac377bb8b6439dbadfb
SHA1

5017ed4fd8e7a7caa408e7a881874f1ac8078005
SHA256

7be4e562cb92a1209e7b4ed00b147f465bb0de7fe7ce2dafa05056fed18ea6ea
SHA512

87f83794c393d5a840e29ac931649f31a09e9d73001da80dbb846fa5b23047c18c90dc1795f78ce297ca700058b76d2fdca8ed076890b2cc1c61ff7733e43a94
SSDEEP

196608:ySGhKM3FhMyPcpUi1PdbuzfRfzCR/QrDiEU8teuKamyR0N2gyzs9BcNNtujEOw2q:ySKKsFrPcpUM9InruYezsKS74

Score

1^/10

Malware Config

Signatures

Files

5rLRUNgfyZXO8gl8KtOF7kGfgTWLYL6P.exe
.exe windows:6 windows x64 arch:x64

4565b0e794b938e1333e41744dc7a264

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:d4:1a:66:69:21:53:ff:be:5d:ef:e8:73:ad:ff:6a
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01/07/2021, 00:00

Not After

15/08/2024, 23:59

Subject

CN=Hugh Bailey,O=Hugh Bailey,L=Temecula,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

72:3f:9b:55:9e:8e:66:c1:fe:55:51:2d:52:e0:37:14:56:30:e1:cb:47:c9:cb:22:66:03:86:eb:76:d0:b3:9f:07:b8:ad:cb:ff:83:c1:40:a8:05:4f:b7:72:12:33:6b:22:d6:ba:b4:76:50:e1:bb:bb:8a:08:3f:a3:cb:40:43
Signer

Actual PE Digest

72:3f:9b:55:9e:8e:66:c1:fe:55:51:2d:52:e0:37:14:56:30:e1:cb:47:c9:cb:22:66:03:86:eb:76:d0:b3:9f:07:b8:ad:cb:ff:83:c1:40:a8:05:4f:b7:72:12:33:6b:22:d6:ba:b4:76:50:e1:bb:bb:8a:08:3f:a3:cb:40:43

Digest Algorithm

sha512

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrcmpiW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetCursorPos

advapi32

OpenProcessToken

shell32

ShellExecuteA

msvcp140

??1_Lockit@std@@QEAA@XZ

imm32

ImmGetContext

wininet

InternetReadFile

urlmon

URLDownloadToFileA

d3d9

Direct3DCreate9

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-runtime-l1-1-0

_initterm_e

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

fmodf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

Sections

.text
Size: - Virtual size: 274KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.h<e
Size: - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.&pV
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.>`j
Size: 13.9MB - Virtual size: 13.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 263KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4565b0e794b938e1333e41744dc7a264

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

06:d4:1a:66:69:21:53:ff:be:5d:ef:e8:73:ad:ff:6aCertificate

Extended Key Usages

Key Usages

72:3f:9b:55:9e:8e:66:c1:fe:55:51:2d:52:e0:37:14:56:30:e1:cb:47:c9:cb:22:66:03:86:eb:76:d0:b3:9f:07:b8:ad:cb:ff:83:c1:40:a8:05:4f:b7:72:12:33:6b:22:d6:ba:b4:76:50:e1:bb:bb:8a:08:3f:a3:cb:40:43Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcp140

imm32

wininet

urlmon

d3d9

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 274KB

.rdata Size: - Virtual size: 220KB

.data Size: - Virtual size: 202KB

.pdata Size: - Virtual size: 9KB

.h<e Size: - Virtual size: 8.0MB

.&pV Size: 4KB - Virtual size: 3KB

.>`j Size: 13.9MB - Virtual size: 13.9MB

.reloc Size: 512B - Virtual size: 296B

.rsrc Size: 263KB - Virtual size: 262KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

06:d4:1a:66:69:21:53:ff:be:5d:ef:e8:73:ad:ff:6a
Certificate

72:3f:9b:55:9e:8e:66:c1:fe:55:51:2d:52:e0:37:14:56:30:e1:cb:47:c9:cb:22:66:03:86:eb:76:d0:b3:9f:07:b8:ad:cb:ff:83:c1:40:a8:05:4f:b7:72:12:33:6b:22:d6:ba:b4:76:50:e1:bb:bb:8a:08:3f:a3:cb:40:43
Signer

.text
Size: - Virtual size: 274KB

.rdata
Size: - Virtual size: 220KB

.data
Size: - Virtual size: 202KB

.pdata
Size: - Virtual size: 9KB

.h<e
Size: - Virtual size: 8.0MB

.&pV
Size: 4KB - Virtual size: 3KB

.>`j
Size: 13.9MB - Virtual size: 13.9MB

.reloc
Size: 512B - Virtual size: 296B

.rsrc
Size: 263KB - Virtual size: 262KB