5e010cb65561e5d2e85b41bdcb1cbcf0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5e010cb65561e5d2e85b41bdcb1cbcf0N.exe
Size

3.0MB
MD5

5e010cb65561e5d2e85b41bdcb1cbcf0
SHA1

734f0ec2f658b7a84d2de07d379c1dd4707fd6f4
SHA256

d9fc00de6f5e2231dde98ba4867c007af2106e2635bdac32a4afa98338221780
SHA512

c111a5bed5a08ca16025ef89a573675f0f0a61fd99fcb00413cf9250dd9c78525ad3e1cc80cc814d55d6e2b25b6ef76090849a52c1afb0fdfccfd78210df0d8f
SSDEEP

49152:9xSPu5ygamMImEtkFTt/V/rOkTgqlbBy9UV/PC8o4bxqIV3Tat8H7lDtOrX7Wjp1:9oPwyOMIpWFJ/V/akTgqlE+V/K8dbxqu

Score

1^/10

Malware Config

Signatures

Files

5e010cb65561e5d2e85b41bdcb1cbcf0N.exe
.exe windows:5 windows x86 arch:x86

fedc75f6e767e20b6972bf95bc08bdf6

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

22:97:b8:88:9b:ff:ed:16:c1:1e:60:38
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

27/07/2022, 06:56

Not After

30/08/2024, 13:54

Subject

SERIALNUMBER=U40100TN2010PTC075961,CN=ZOHO CORPORATION PRIVATE LIMITED,O=ZOHO CORPORATION PRIVATE LIMITED,L=Chennai,ST=Tamil Nadu,C=IN,1.2.840.113549.1.9.1=#0c1470726162687570407a6f686f636f72702e636f6d,1.3.6.1.4.1.311.60.2.1.2=#130a54616d696c204e616475,1.3.6.1.4.1.311.60.2.1.3=#1302494e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2a:96:6d:d9:00:6e:ea:e5:51:ef:45:65:46:7e:1b:bc:58:ca:d3:75
Signer

Actual PE Digest

2a:96:6d:d9:00:6e:ea:e5:51:ef:45:65:46:7e:1b:bc:58:ca:d3:75

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\File_Transfer\27-May-24\mycomputeractivex\8406988\mycomp\ZohoTray\Workspace\Release\ZohoTray.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

GetProfileIntW
InterlockedPopEntrySList
ReleaseSemaphore
SizeofResource
HeapFree
GetCurrentProcess
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
LocalAlloc
HeapSize
GetLastError
LockResource
GlobalAlloc
GlobalFree
HeapReAlloc
CloseHandle
RaiseException
LoadResource
FindResourceW
HeapAlloc
DecodePointer
GetCurrentProcessId
GetProcessHeap
MultiByteToWideChar
DeleteCriticalSection
GetCurrentDirectoryW
WideCharToMultiByte
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
FormatMessageW
GetModuleHandleW
CreateDirectoryW
CreateFileW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
LocalFree
CopyFileW
MoveFileW
ReadFile
SetLastError
WriteFile
GetCurrentThreadId
Sleep
GetFileSize
FlushFileBuffers
GetComputerNameExW
GetComputerNameW
GetTempPathW
WaitForSingleObject
LoadLibraryW
CreateThread
GetProcAddress
FreeLibrary
GetTempFileNameW
GetVersionExW
ProcessIdToSessionId
GetSystemInfo
VerSetConditionMask
VerifyVersionInfoW
TerminateProcess
GetTickCount
GetCommandLineW
InterlockedDecrement
lstrlenW
CreateEventW
GetUserDefaultUILanguage
GetLocaleInfoW
FindResourceExW
GetStdHandle
CreateMutexW
ReleaseMutex
SetCurrentDirectoryW
IsBadStringPtrW
FindFirstFileW
FindNextFileW
IsBadReadPtr
SetFilePointer
FindClose
GetUserDefaultLangID
OpenEventW
GetModuleHandleA
SetEvent
SetDllDirectoryA
LoadLibraryA
ResetEvent
LoadLibraryExW
FreeResource
InterlockedIncrement
SetErrorMode
InitializeCriticalSection
CancelSynchronousIo
GlobalSize
GlobalLock
GlobalUnlock
MulDiv
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
lstrcmpA
OutputDebugStringA
EncodePointer
GetSystemDirectoryW
GlobalDeleteAtom
lstrcmpW
GlobalAddAtomW
GlobalFindAtomW
CompareStringW
GetFullPathNameW
GetVolumeInformationW
LockFile
SetEndOfFile
UnlockFile
DuplicateHandle
lstrcmpiW
GetThreadLocale
SetThreadPriority
ResumeThread
GetCurrentThread
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GlobalGetAtomNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetSystemDefaultUILanguage
GlobalFlags
VirtualProtect
lstrcpyW
GetFileAttributesExW
GetFileSizeEx
GetFileTime
GetWindowsDirectoryW
SearchPathW
GetUserDefaultLCID
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
VirtualQuery
LoadLibraryExA
VirtualFree
VirtualAlloc
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
LCMapStringW
GetCPInfo
SetFilePointerEx
FindFirstFileExW
SwitchToThread
GetModuleHandleExW
QueueUserWorkItem
QueryPerformanceFrequency
GetStringTypeW
OutputDebugStringW
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
GetCommandLineA
ExitProcess
GetFileType
GetTimeZoneInformation
GetDriveTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
WriteConsoleW
EnumSystemLocalesW
IsValidLocale
SetEnvironmentVariableA
ReadConsoleW
GetACP
HeapQueryInformation
ExitThread
GetConsoleMode
GetConsoleCP
SetStdHandle
InterlockedPushEntrySList

oleaut32

LoadTypeLi
VarBstrFromDate
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VariantInit
SysStringLen
SysAllocStringLen
SysFreeString
SysAllocString
VariantClear
OleCreateFontIndirect

oledlg

OleUIBusyW

wintrust

WinVerifyTrust

gdiplus

GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipDeleteGraphics
GdipCreateBitmapFromHBITMAP
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipGetImagePixelFormat
GdipDrawImageI
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipGetImageHeight

winmm

PlaySoundW

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 506KB - Virtual size: 506KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fedc75f6e767e20b6972bf95bc08bdf6

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

22:97:b8:88:9b:ff:ed:16:c1:1e:60:38Certificate

Extended Key Usages

Key Usages

2a:96:6d:d9:00:6e:ea:e5:51:ef:45:65:46:7e:1b:bc:58:ca:d3:75Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

kernel32

oleaut32

oledlg

wintrust

gdiplus

winmm

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 506KB - Virtual size: 506KB

.data Size: 36KB - Virtual size: 68KB

.rsrc Size: 288KB - Virtual size: 287KB

.reloc Size: 169KB - Virtual size: 169KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

22:97:b8:88:9b:ff:ed:16:c1:1e:60:38
Certificate

2a:96:6d:d9:00:6e:ea:e5:51:ef:45:65:46:7e:1b:bc:58:ca:d3:75
Signer

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 506KB - Virtual size: 506KB

.data
Size: 36KB - Virtual size: 68KB

.rsrc
Size: 288KB - Virtual size: 287KB

.reloc
Size: 169KB - Virtual size: 169KB