3d5663b8023b46a368c8af95783af340N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

3d5663b8023b46a368c8af95783af340N.exe
Size

213KB
MD5

3d5663b8023b46a368c8af95783af340
SHA1

935cd8abdea9e1582e820127ab80853fb1ab2a00
SHA256

6786f3ec8a0f03d300edd512621c4baaba54a3f05fe122ab6c90f26017b7d20b
SHA512

04bd56ad54352321f2190b4837e7a35e1770cdefbe310dff4a9cdc52f5c5515561d0a6e79b1acf31aec8d83d227231fddfb40af7d620c6e42a14a3ff3c710de9
SSDEEP

3072:+4g9usXErboCqZ+LvqF6zjFONF9QSFRYsPjSDqTpoXwteJW1YHAduZlPDuAg0FuJ:+49wCqZ+OuFEek7rSDGmwtew1G2AOV/

Score

1^/10

Malware Config

Signatures

Files

3d5663b8023b46a368c8af95783af340N.exe
.exe windows:6 windows x86 arch:x86

13c02dfab392fa7c416332cf65b58cce

Code Sign

0c:c9:bf:34:fa:5c:83:94:3b:dc:01:23:d1:bd:cb:77
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-12-2020 00:00

Not After

02-03-2022 23:59

Subject

SERIALNUMBER=000681038,CN=Bitsum Technologies (Bitsum LLC),O=Bitsum Technologies (Bitsum LLC),L=Morristown,ST=Tennessee,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130954656e6e6573736565,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ed:b6:40:1e:37:3d:04:c5:57:84:ba:06:bf:4e:51:b3:ab:2c:c4:60:df:56:f0:14:1d:a5:e2:d8:3f:f6:de:f4
Signer

Actual PE Digest

ed:b6:40:1e:37:3d:04:c5:57:84:ba:06:bf:4e:51:b3:ab:2c:c4:60:df:56:f0:14:1d:a5:e2:d8:3f:f6:de:f4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\dev\projs\MakeService\Release\MakeService.pdb

Imports

kernel32

GetModuleHandleW
GetCurrentProcess
GetModuleFileNameW
CreateFileW
GetStartupInfoW
GetCurrentProcessId
SetLastError
GetProcAddress
RaiseException
DecodePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
WideCharToMultiByte
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
GetCurrentDirectoryW
GetFileAttributesW
FindResourceW
FindResourceExW
LoadResource
LockResource
SizeofResource
GetProcessHeap
WriteConsoleW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
Sleep
GetLastError
CloseHandle
LeaveCriticalSection
EnterCriticalSection
SetEnvironmentVariableW
SetStdHandle
InitializeCriticalSectionEx
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetFileType
GetCommandLineW
GetCommandLineA
EncodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile

advapi32

DeleteService
CreateServiceW
StartServiceW
ControlService
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13c02dfab392fa7c416332cf65b58cce

Code Sign

0c:c9:bf:34:fa:5c:83:94:3b:dc:01:23:d1:bd:cb:77Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

ed:b6:40:1e:37:3d:04:c5:57:84:ba:06:bf:4e:51:b3:ab:2c:c4:60:df:56:f0:14:1d:a5:e2:d8:3f:f6:de:f4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Sections

.text Size: 140KB - Virtual size: 140KB

.rdata Size: 59KB - Virtual size: 58KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

0c:c9:bf:34:fa:5c:83:94:3b:dc:01:23:d1:bd:cb:77
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

ed:b6:40:1e:37:3d:04:c5:57:84:ba:06:bf:4e:51:b3:ab:2c:c4:60:df:56:f0:14:1d:a5:e2:d8:3f:f6:de:f4
Signer

.text
Size: 140KB - Virtual size: 140KB

.rdata
Size: 59KB - Virtual size: 58KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB