2ac57fc76b6830b0aacdae8f32211d77dcc663786246287ad81ef149143ade48[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

2ac57fc76b6830b0aacdae8f32211d77dcc663786246287ad81ef149143ade48.exe
Size

5.5MB
MD5

5c1a770eeb53a1cc04c25eda3e6b0b54
SHA1

6c82653849692f60f46e5e8fdb506a2eb1a1db3e
SHA256

2ac57fc76b6830b0aacdae8f32211d77dcc663786246287ad81ef149143ade48
SHA512

636bc05a98f8f4946aa4680a871d3250ee82c187aaaeced3751bc0ae8ea14dbd1be369da2e1c5e45a6503535afcdeca230a642e427ad4d5c9891f020bea5803f
SSDEEP

98304:eGyZi2evBT6WbZoBqOlHAShIIcRtR7+dyZLAK:eGV2evt6WFoMOmSTcRtxLX

Score

1^/10

Malware Config

Signatures

Files

2ac57fc76b6830b0aacdae8f32211d77dcc663786246287ad81ef149143ade48.exe
.exe windows:6 windows x64 arch:x64

5842498648e6235b14c52019b9eb5c2b

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24:af:94:78:fb:32:b9:1e:1f:17:fb:94:bc:a8:de:c3
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

31/05/2022, 10:39

Not After

31/05/2023, 10:39

Subject

CN=Open Source Developer\, Derick Payne,O=Open Source Developer,L=George,C=ZA,1.2.840.113549.1.9.1=#0c13696e666f4072697a6f6e65736f66742e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

28/07/2022, 08:56

Not After

27/07/2033, 08:56

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

66:89:32:0e:5d:86:8d:bd:18:7f:4b:5f:34:08:aa:58:0d:a1:7d:d8:d5:12:c1:21:5f:8a:c2:18:70:6e:05:f2
Signer

Actual PE Digest

66:89:32:0e:5d:86:8d:bd:18:7f:4b:5f:34:08:aa:58:0d:a1:7d:d8:d5:12:c1:21:5f:8a:c2:18:70:6e:05:f2

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Rizonesoft\Develop\Notepad3\Bin\Release_x64_v143\Notepad3.pdb

Imports

ntdll

RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
RtlCaptureContext
RtlGetNtVersionNumbers
RtlVirtualUnwind
VerSetConditionMask
RtlUnwind

comctl32

ord413
ord410
ImageList_AddMasked
ord8
ImageList_Create
ImageList_Destroy
ord412
InitMUILanguage
InitCommonControlsEx
ImageList_ReplaceIcon
ord381
ImageList_GetIcon

shlwapi

StrCmpNIA
StrFormatByteSizeEx
StrCSpnA
ord157
PathCreateFromUrlW
StrChrIW
UrlIsW
StrSpnW
PathFindFileNameW
PathRemoveExtensionW
StrStrA
StrCmpNA
StrChrA
StrStrIA
StrTrimA
StrCmpLogicalW
UrlCreateFromPathW
StrChrIA
StrRetToBufW
PathMatchSpecW
StrToIntExW
SHAutoComplete
StrStrIW
StrStrW
StrTrimW
StrDupW
StrCmpW
StrCmpNIW
StrCmpIW
PathIsUNCW
PathIsRelativeW
StrRChrW
PathStripToRootW
StrChrW

user32

PostQuitMessage
RegisterWindowMessageW
UpdateWindow
IsIconic
LoadMenuW
GetMenuItemCount
LoadStringA
LoadStringW
SetMenu
DispatchMessageW
PeekMessageW
TranslateMessage
IsCharAlphaNumericA
CharLowerA
IsCharLowerW
GetKeyState
CharUpperW
CharLowerW
GetMenu
DestroyWindow
GetActiveWindow
IsWindow
GetCapture
SetTimer
CloseClipboard
IsCharLowerA
EmptyClipboard
GetDoubleClickTime
IsCharUpperA
SetFocus
CharNextW
GetClipboardData
SetClipboardData
GetComboBoxInfo
CheckMenuItem
IsClipboardFormatAvailable
KillTimer
GetSysColorBrush
EnableMenuItem
ReleaseCapture
ChildWindowFromPoint
IsCharUpperW
GetWindowLongW
GetWindowTextLengthW
DrawAnimatedRects
DeferWindowPos
GetSystemMenu
FindWindowExW
GetWindowRect
GetFocus
GetDC
SetWindowPos
CheckRadioButton
GetPropW
CopyImage
MonitorFromRect
MonitorFromWindow
SetActiveWindow
MessageBoxExW
SetWindowLongPtrW
GetIconInfo
CallNextHookEx
RemovePropW
SetWindowTextW
GetWindowDC
CreatePopupMenu
GetWindowLongPtrW
GetWindowPlacement
TrackPopupMenu
BeginDeferWindowPos
DrawMenuBar
GetClassNameW
TranslateAcceleratorW
MonitorFromPoint
SystemParametersInfoA
CreateIconIndirect
InflateRect
AdjustWindowRectEx
DrawTextW
DrawTextA
CallWindowProcW
GetAncestor
NotifyWinEvent
GetScrollInfo
SetScrollInfo
PtInRect
SetCaretPos
ShowCaret
HideCaret
OffsetRect
GetDlgItemTextA
GetMonitorInfoW
GetDlgCtrlID
ClientToScreen
SetMenuItemInfoW
CharPrevW
MapWindowPoints
SetWindowPlacement
GetSysColor
DialogBoxIndirectParamW
IsWindowEnabled
UnhookWindowsHookEx
DestroyMenu
SetLayeredWindowAttributes
DestroyCaret
CreateCaret
ValidateRect
GetMenuStringW
IsCharAlphaNumericW
LoadCursorW
EndDeferWindowPos
SetWindowsHookExW
InsertMenuW
SetCursor
GetDlgItemInt
SetWindowLongW
GetClientRect
IsZoomed
AppendMenuW
SetRect
DrawIconEx
GetDesktopWindow
CreateDialogIndirectParamW
SetDlgItemInt
SetForegroundWindow
LoadImageW
ReleaseDC
BeginPaint
EndPaint
EnableWindow
GetWindowTextW
SetPropW
SystemParametersInfoW
GetSystemMetrics
SetCursorPos
GetCursorPos
CharUpperBuffW
PostMessageW
SendMessageW
EndDialog
ShowWindow
RedrawWindow
SetDlgItemTextW
GetDlgItemTextW
SendDlgItemMessageW
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
GetParent
InvalidateRect
GetUpdateRgn
SetWindowCompositionAttribute
TrackPopupMenuEx
MsgWaitForMultipleObjects
RegisterClipboardFormatW
GetMessageTime
TrackMouseEvent
GetKeyboardLayout
DestroyCursor
SetCapture
GetCaretBlinkTime
GetMessageW
GetMenuItemInfoW
DefWindowProcW
ModifyMenuW
ShowWindowAsync
CheckMenuRadioItem
IsWindowVisible
SetClipboardViewer
FillRect
CreateWindowExW
ShowOwnedPopups
ScreenToClient
UnregisterClassW
RegisterClassExW
GetMenuBarInfo
LoadAcceleratorsW
GetSubMenu
IsDialogMessageW
DestroyIcon
ChangeClipboardChain
IsChild
CountClipboardFormats
FrameRect
SetMenuDefaultItem
GetForegroundWindow
MessageBeep
EnumWindows
OpenClipboard
GetMenuState

kernel32

SizeofResource
WaitForSingleObject
GetCurrentThreadId
FreeResource
Sleep
FormatMessageW
LockResource
GlobalAlloc
GlobalFree
LoadResource
FindResourceW
GetFileSizeEx
GetTimeFormatEx
SetFileTime
GetDateFormatEx
lstrcmpA
GetLocalTime
LCMapStringW
lstrcmpiA
GetTickCount
GetFileTime
GetOEMCP
GetCPInfo
IsValidCodePage
GetCPInfoExW
GetACP
CreateEventW
SetEvent
ResetEvent
SetThreadUILanguage
GetUserPreferredUILanguages
ResolveLocaleName
SetProcessPreferredUILanguages
IsValidLocaleName
GetStartupInfoW
GlobalHandle
GetCommandLineW
lstrlenW
HeapLock
SignalObjectAndWait
SetErrorMode
GetTempPathW
HeapWalk
FindFirstChangeNotificationW
GetFileAttributesExW
TerminateThread
FindCloseChangeNotification
DeleteFileW
GetSystemInfo
FindResourceExW
VerifyVersionInfoW
SetCurrentDirectoryW
CreateProcessW
GetTempFileNameW
HeapUnlock
UnlockFileEx
GetDateFormatW
SetLastError
FindFirstFileW
FindNextFileW
FindClose
LCIDToLocaleName
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
MapViewOfFile
CreateFileMappingW
LocaleNameToLCID
UnmapViewOfFile
GetVersionExW
GetLocaleInfoW
GlobalSize
GetLocaleInfoA
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
QueryPerformanceFrequency
InitOnceComplete
InitOnceBeginInitialize
TerminateProcess
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
WaitForSingleObjectEx
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExA
VirtualQuery
RaiseException
LoadLibraryExW
GetModuleHandleW
CompareStringOrdinal
VirtualProtect
FlushFileBuffers
MulDiv
GetFileSize
LockFileEx
LocalFree
FindNextChangeNotification
TlsFree
ExitProcess
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
EnumSystemLocalesW
SetStdHandle
GetFileType
GetConsoleOutputCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeW
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointerEx
SetEndOfFile
GetLocaleInfoEx
SetEnvironmentVariableW
GetCurrentProcess
ReadFile
CreateDirectoryW
FreeLibrary
GetProcAddress
GetCurrentDirectoryW
LoadLibraryW
CloseHandle
SetFileAttributesW
GetFileAttributesW
CreateFileW
GetEnvironmentVariableW
GetModuleFileNameW
GetFinalPathNameByHandleW
ExpandEnvironmentStringsW
GetLongPathNameW
SearchPathW
WideCharToMultiByte
GetLastError
HeapReAlloc
MultiByteToWideChar
HeapSize
GlobalUnlock
GetProcessHeap
GlobalLock
HeapAlloc
SetFilePointer
WriteFile
HeapFree
CompareStringW
GetNativeSystemInfo
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
FlsAlloc
FlsGetValue
FlsSetValue
TlsSetValue
FlsFree
InitializeCriticalSectionEx
EncodePointer
TlsAlloc
TlsGetValue
WriteConsoleW
IsValidLocale
GetTimeFormatW
GetUserDefaultLCID

gdi32

LineTo
GetTextMetricsW
CreateFontW
EndDoc
StartPage
SetDIBits
GetDIBits
ExtTextOutW
CreateBitmap
CreateRectRgn
CreateRectRgnIndirect
BitBlt
CreatePatternBrush
EnumFontFamiliesExW
CreatePen
GetTextExtentPoint32A
GetTextExtentExPointA
GetTextExtentExPointW
IntersectClipRect
RestoreDC
RoundRect
SaveDC
StretchBlt
GdiAlphaBlend
CreateDIBSection
ExtCreatePen
ExtTextOutA
Polygon
Polyline
MoveToEx
SetTextAlign
StartDocW
DPtoLP
EndPage
GetStockObject
GetTextExtentPoint32W
SetBkMode
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetDeviceCaps
DeleteDC
GetObjectW
SetMapMode
CreateFontIndirectW
Ellipse
DeleteObject
CreateSolidBrush
CombineRgn
SetBkColor
SetTextColor

comdlg32

PageSetupDlgW
PrintDlgW
ChooseColorW
GetOpenFileNameW
GetSaveFileNameW
ChooseFontW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AllocateAndInitializeSid
CreateWellKnownSid
FreeSid
CheckTokenMembership
GetTokenInformation
IsTextUnicode
AccessCheck
OpenProcessToken
GetFileSecurityW
DuplicateToken
MapGenericMask

shell32

ShellExecuteW
SHAppBarMessage
SHGetFileInfoW
ShellExecuteExW
SHGetDataFromIDListW
SHGetDesktopFolder
SHAddToRecentDocs
DragQueryFileW
Shell_NotifyIconW
DragAcceptFiles
DragFinish
SHOpenFolderAndSelectItems
ord155
SHParseDisplayName
SHGetPathFromIDListW
SHGetKnownFolderPath
SetCurrentProcessExplicitAppUserModelID
ord180
SHBrowseForFolderW

ole32

CLSIDFromProgID
ReleaseStgMedium
DoDragDrop
RevokeDragDrop
RegisterDragDrop
OleInitialize
StringFromGUID2
CoCreateGuid
CoGetObjectContext
CoTaskMemAlloc
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoCreateInstance
OleUninitialize
CoGetApartmentType

oleaut32

SysAllocStringLen
SysFreeString

imm32

ImmReleaseContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmSetCompositionFontW
ImmEscapeW
ImmNotifyIME
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

Exports

Exports

CreateLexer
GetLexerCount
GetLexerFactory
GetLexerName
GetLibraryPropertyNames
GetNameSpace
LexerNameFromID
Scintilla_AdjustWindowRectForDpi
Scintilla_GetSystemMetricsForDpi
Scintilla_GetWindowDPI
Scintilla_InputCodePage
Scintilla_RegisterClasses
Scintilla_ReleaseResources
SetLibraryProperty

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 569KB - Virtual size: 653KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5842498648e6235b14c52019b9eb5c2b

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

24:af:94:78:fb:32:b9:1e:1f:17:fb:94:bc:a8:de:c3Certificate

Extended Key Usages

Key Usages

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

66:89:32:0e:5d:86:8d:bd:18:7f:4b:5f:34:08:aa:58:0d:a1:7d:d8:d5:12:c1:21:5f:8a:c2:18:70:6e:05:f2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

comctl32

shlwapi

user32

kernel32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

imm32

Exports

Exports

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.data Size: 569KB - Virtual size: 653KB

.pdata Size: 75KB - Virtual size: 74KB

.idata Size: 18KB - Virtual size: 18KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 17KB - Virtual size: 17KB

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

24:af:94:78:fb:32:b9:1e:1f:17:fb:94:bc:a8:de:c3
Certificate

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

66:89:32:0e:5d:86:8d:bd:18:7f:4b:5f:34:08:aa:58:0d:a1:7d:d8:d5:12:c1:21:5f:8a:c2:18:70:6e:05:f2
Signer

.text
Size: 2.9MB - Virtual size: 2.9MB

.data
Size: 569KB - Virtual size: 653KB

.pdata
Size: 75KB - Virtual size: 74KB

.idata
Size: 18KB - Virtual size: 18KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 17KB - Virtual size: 17KB