3a9b8ec83ac4038bf19250dafcb020a0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3a9b8ec83ac4038bf19250dafcb020a0N.exe
Size

18KB
MD5

3a9b8ec83ac4038bf19250dafcb020a0
SHA1

bb267d7ccd6863691b70c107501cffccc953db3b
SHA256

7124dbfd6881136c3f24a6d2a960072dd2cfd3ee4bd559f561ed379a901e8c2d
SHA512

7dda2b6a3a2ebd2ae95c92a8c950e54b12948a02f52a9feb91a253fd5990ba0a80ba5227322e81fe42acf59c97f43a887e26f1491d7feef6249b3761624d7685
SSDEEP

192:y2Ie4WrAOhvfcm5HYyzVcx+hUipPIKfhignDiG1g2MvqTEeTC5B1W7l:y2Ie/fhd4GyypwKThECTEqs2

Score

1^/10

Malware Config

Signatures

Files

3a9b8ec83ac4038bf19250dafcb020a0N.exe
.dll windows:6 windows x64 arch:x64

31c4748474fbbff2ebaa5242e02d1ea0

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

10/11/2021, 00:00

Not After

09/11/2024, 23:59

Subject

CN=Hangil IT Co.\, Ltd,O=Hangil IT Co.\, Ltd,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b5:42:48:d8:e9:37:be:8b:ba:38:51:67:0d:01:07:af:ba:d7:6e:d7
Signer

Actual PE Digest

b5:42:48:d8:e9:37:be:8b:ba:38:51:67:0d:01:07:af:ba:d7:6e:d7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Mevas\source\repos\Dll1\x64\Release\Dll1.pdb

Imports

kernel32

CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
GetCurrentProcessId
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
IsDebuggerPresent

user32

MessageBoxW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

_CxxThrowException
memcpy
__std_type_info_destroy_list
__std_exception_destroy
__C_specific_handler
__std_exception_copy
memset

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_configure_narrow_argv
_execute_onexit_table
_initterm_e
_initterm
_cexit
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_seh_filter_dll

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

31c4748474fbbff2ebaa5242e02d1ea0

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

b5:42:48:d8:e9:37:be:8b:ba:38:51:67:0d:01:07:af:ba:d7:6e:d7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 660B

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 512B - Virtual size: 80B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

b5:42:48:d8:e9:37:be:8b:ba:38:51:67:0d:01:07:af:ba:d7:6e:d7
Signer

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 660B

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 512B - Virtual size: 80B