f64e490301257e3c1e8bc7f4385c3c3f5f8c3b83a61c956ca66b5af9bc6da912

Sharing

Copy URL Twitter E-mail

General

Target

f64e490301257e3c1e8bc7f4385c3c3f5f8c3b83a61c956ca66b5af9bc6da912
Size

14.0MB
MD5

0f5815e1448664d6af5106064c5641e1
SHA1

2d746bd4c063a1ef74c1185ef2ff92caa938688a
SHA256

f64e490301257e3c1e8bc7f4385c3c3f5f8c3b83a61c956ca66b5af9bc6da912
SHA512

bc013ca4bb2ec705474449c04ff8abb069525e5d3eb8a34c86e3ce99261f419db48441e6f459cc17b3eddfec36c9d06aa0a7713277cc57f9734a9e87c670c74d
SSDEEP

98304:6ol67IFjrRBetnr24xwc4TIkaJrJilV9wZaADE5axnwhT/pRc:/lpSnr2VelJFilV9wYADEwnwB0

Score

1^/10

Malware Config

Signatures

Files

f64e490301257e3c1e8bc7f4385c3c3f5f8c3b83a61c956ca66b5af9bc6da912
.dll windows:6 windows x86 arch:x86

108a9876ad87d990aca2c49b958fab4f

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:f9:80:67:6d:7d:7e:8d:5e:b0:42:d2:df:47:78:48
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

23/03/2023, 00:00

Not After

22/03/2026, 23:59

Subject

CN=Sangfor Technologies Inc.,O=Sangfor Technologies Inc.,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f7:cb:df:04:55:14:f8:a5:00:f2:d5:a0:b7:ef:a4:a3:c8:e3:04:ea:46:94:07:fe:cd:6a:da:d2:86:09:f7:95
Signer

Actual PE Digest

f7:cb:df:04:55:14:f8:a5:00:f2:d5:a0:b7:ef:a4:a3:c8:e3:04:ea:46:94:07:fe:cd:6a:da:d2:86:09:f7:95

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
GetConsoleMode
GetEnvironmentStringsW
GetLastError
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
PostQueuedCompletionStatus
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile

msvcrt

__mb_cur_max
_amsg_exit
_beginthread
_errno
_initterm
_iob
_lock
_unlock
abort
atoi
calloc
fputc
free
fwrite
localeconv
malloc
memcpy
memset
realloc
setlocale
strchr
strcpy
strerror
strlen
strncmp
strncpy
vfprintf
wcslen

Exports

Exports

CGetFirstMatchAreaId
CSimpleAreaMatch
_cgo_dummy_export

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 188KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 138B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 242KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 593KB - Virtual size: 593KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/106
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

108a9876ad87d990aca2c49b958fab4f

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

09:f9:80:67:6d:7d:7e:8d:5e:b0:42:d2:df:47:78:48Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

f7:cb:df:04:55:14:f8:a5:00:f2:d5:a0:b7:ef:a4:a3:c8:e3:04:ea:46:94:07:fe:cd:6a:da:d2:86:09:f7:95Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.data Size: 220KB - Virtual size: 219KB

.rdata Size: 2.9MB - Virtual size: 2.9MB

.bss Size: - Virtual size: 188KB

.edata Size: 512B - Virtual size: 138B

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 152KB - Virtual size: 152KB

/4 Size: 1KB - Virtual size: 1KB

/19 Size: 3.0MB - Virtual size: 3.0MB

/31 Size: 15KB - Virtual size: 14KB

/45 Size: 1.1MB - Virtual size: 1.1MB

/57 Size: 242KB - Virtual size: 241KB

/70 Size: 2KB - Virtual size: 1KB

/81 Size: 2.3MB - Virtual size: 2.3MB

/92 Size: 593KB - Virtual size: 593KB

/106 Size: 512B - Virtual size: 48B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

09:f9:80:67:6d:7d:7e:8d:5e:b0:42:d2:df:47:78:48
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

f7:cb:df:04:55:14:f8:a5:00:f2:d5:a0:b7:ef:a4:a3:c8:e3:04:ea:46:94:07:fe:cd:6a:da:d2:86:09:f7:95
Signer

.text
Size: 3.0MB - Virtual size: 3.0MB

.data
Size: 220KB - Virtual size: 219KB

.rdata
Size: 2.9MB - Virtual size: 2.9MB

.bss
Size: - Virtual size: 188KB

.edata
Size: 512B - Virtual size: 138B

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 152KB - Virtual size: 152KB

/4
Size: 1KB - Virtual size: 1KB

/19
Size: 3.0MB - Virtual size: 3.0MB

/31
Size: 15KB - Virtual size: 14KB

/45
Size: 1.1MB - Virtual size: 1.1MB

/57
Size: 242KB - Virtual size: 241KB

/70
Size: 2KB - Virtual size: 1KB

/81
Size: 2.3MB - Virtual size: 2.3MB

/92
Size: 593KB - Virtual size: 593KB

/106
Size: 512B - Virtual size: 48B