0be25cc27c1bbd50855d45173dfb44a0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

0be25cc27c1bbd50855d45173dfb44a0N.exe
Size

60KB
MD5

0be25cc27c1bbd50855d45173dfb44a0
SHA1

db7851860399a98c552ede0f14b1790196a16da9
SHA256

c5b8023264a639e2c3d81426e9c2068bc72858b46438194c30c99c1eefb14841
SHA512

0d9a2963b62d12da63cf9ba06fca4bde2c851d5a9f126b3765c1b10b006c6e1e7fdaeca815a3d7d4133b34170c2e305d9b17076442e5598ed02862e47d02432b
SSDEEP

1536:mDcDoleB43BclYPabix7+dRKkP5tqkIk5V6uzaE1fKBL78b9m:QG+X+dRTP5tqqVfKBf8b0

Score

1^/10

Malware Config

Signatures

Files

0be25cc27c1bbd50855d45173dfb44a0N.exe
.dll windows:4 windows x64 arch:x64

e529cae93c27342ae1ee2d1f05db0589

Code Sign

04:44:c0
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

22/10/2008, 12:07

Not After

31/12/2029, 12:07

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:39:f3:4d:41:bc:f8:cb:7e:0f:a9:8c:ec:d9:43:dd
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

26/01/2024, 07:18

Not After

25/01/2025, 07:18

Subject

CN=Open Source Developer\, Michał Trojnara,O=Open Source Developer,L=Warszawa,ST=mazowieckie,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2e:e1:0f:77:15:15:d5:d7:bb:2a:e4:c5:f9:88:bb:03:c8:82:56:62:82:37:d3:df:b0:a9:8a:4f:a9:d9:f2:2b
Signer

Actual PE Digest

2e:e1:0f:77:15:15:d5:d7:bb:2a:e4:c5:f9:88:bb:03:c8:82:56:62:82:37:d3:df:b0:a9:8a:4f:a9:d9:f2:2b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

libcrypto-3-x64

BIO_free
BIO_new_file
BIO_new_fp
BIO_printf
BIO_snprintf
BIO_vprintf
BN_bin2bn
BN_free
BN_new
BN_set_word
CRYPTO_free
CRYPTO_get_ex_new_index
CRYPTO_malloc
CRYPTO_set_mem_functions
CRYPTO_strdup
CRYPTO_zalloc
DSA_OpenSSL
DSA_SIG_new
DSA_SIG_set0
DSA_free
DSA_get0_engine
DSA_get_ex_data
DSA_meth_free
DSA_meth_get_bn_mod_exp
DSA_meth_get_mod_exp
DSA_meth_get_verify
DSA_meth_new
DSA_meth_set_bn_mod_exp
DSA_meth_set_finish
DSA_meth_set_mod_exp
DSA_meth_set_sign
DSA_meth_set_verify
DSA_new_method
DSA_set0_key
DSA_set0_pqg
DSA_set_ex_data
ENGINE_get_ex_data
ENGINE_get_static_state
ENGINE_set_DSA
ENGINE_set_RSA
ENGINE_set_cmd_defns
ENGINE_set_ctrl_function
ENGINE_set_destroy_function
ENGINE_set_ex_data
ENGINE_set_finish_function
ENGINE_set_flags
ENGINE_set_id
ENGINE_set_init_function
ENGINE_set_load_privkey_function
ENGINE_set_load_ssl_client_cert_function
ENGINE_set_name
ERR_add_error_data
ERR_get_next_error_library
ERR_load_strings
ERR_new
ERR_set_debug
ERR_set_error
ERR_unload_strings
EVP_PKEY_assign
EVP_PKEY_new
OPENSSL_cleanse
OPENSSL_init_crypto
OPENSSL_sk_free
OPENSSL_sk_new_null
OPENSSL_sk_num
OPENSSL_sk_push
OPENSSL_sk_value
PEM_write_bio_X509
RSA_PKCS1_OpenSSL
RSA_free
RSA_get0_engine
RSA_get_ex_data
RSA_meth_free
RSA_meth_get_bn_mod_exp
RSA_meth_get_mod_exp
RSA_meth_get_pub_dec
RSA_meth_get_pub_enc
RSA_meth_new
RSA_meth_set_bn_mod_exp
RSA_meth_set_finish
RSA_meth_set_mod_exp
RSA_meth_set_priv_dec
RSA_meth_set_priv_enc
RSA_meth_set_pub_dec
RSA_meth_set_pub_enc
RSA_meth_set_sign
RSA_new_method
RSA_set0_key
RSA_set_ex_data
RSA_size
X509_NAME_cmp
X509_NAME_print_ex
X509_check_purpose
X509_free
X509_get_ex_data
X509_get_issuer_name
X509_get_subject_name
X509_print_ex
X509_set_ex_data
d2i_X509

advapi32

CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptEnumProvidersW
CryptExportKey
CryptGetProvParam
CryptGetUserKey
CryptReleaseContext
CryptSetHashParam
CryptSignHashW

crypt32

CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
memcpy
realloc
strcmp
strlen
strncmp
vfprintf
wcscmp
wcslen

libssp-0

__stack_chk_fail
__stack_chk_guard

Exports

Exports

bind_engine
v_check

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 336B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 89B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e529cae93c27342ae1ee2d1f05db0589

Code Sign

04:44:c0Certificate

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

61:39:f3:4d:41:bc:f8:cb:7e:0f:a9:8c:ec:d9:43:ddCertificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

2e:e1:0f:77:15:15:d5:d7:bb:2a:e4:c5:f9:88:bb:03:c8:82:56:62:82:37:d3:df:b0:a9:8a:4f:a9:d9:f2:2bSigner

Headers

DLL Characteristics

File Characteristics

Imports

libcrypto-3-x64

advapi32

crypt32

kernel32

msvcrt

libssp-0

Exports

Exports

Sections

.text Size: 23KB - Virtual size: 22KB

.data Size: 1024B - Virtual size: 688B

.rdata Size: 5KB - Virtual size: 4KB

.pdata Size: 1KB - Virtual size: 1KB

.xdata Size: 1024B - Virtual size: 940B

.bss Size: - Virtual size: 336B

.edata Size: 512B - Virtual size: 89B

.idata Size: 6KB - Virtual size: 6KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 224B

04:44:c0
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

61:39:f3:4d:41:bc:f8:cb:7e:0f:a9:8c:ec:d9:43:dd
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

2e:e1:0f:77:15:15:d5:d7:bb:2a:e4:c5:f9:88:bb:03:c8:82:56:62:82:37:d3:df:b0:a9:8a:4f:a9:d9:f2:2b
Signer

.text
Size: 23KB - Virtual size: 22KB

.data
Size: 1024B - Virtual size: 688B

.rdata
Size: 5KB - Virtual size: 4KB

.pdata
Size: 1KB - Virtual size: 1KB

.xdata
Size: 1024B - Virtual size: 940B

.bss
Size: - Virtual size: 336B

.edata
Size: 512B - Virtual size: 89B

.idata
Size: 6KB - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 224B