604b28f232313b8727b77a21ecffc9e0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

604b28f232313b8727b77a21ecffc9e0N.exe
Size

306KB
MD5

604b28f232313b8727b77a21ecffc9e0
SHA1

feb98a5c280913b7993ba4d023093b4ee8c98a49
SHA256

9904359366bc5754aa2f9954866026ed3a81c483edd27c9bd990e90f0ae1b853
SHA512

a9e590b76b20573dfe2570c328f22c80a0fdbd8de0947ca3879bcfd81625709a15634e0a6cc8d18d09ac2a47c3ccfde6a59718bfaad34e1a446c02ad64019754
SSDEEP

6144:XG6ZUon6GVSYmykGHEvlMMac59+xfbzlBV+UdvrEFp7hKP:XG6ZblPmy/kNMewfFBjvrEH7s

Score

1^/10

Malware Config

Signatures

Files

604b28f232313b8727b77a21ecffc9e0N.exe
.dll windows:6 windows x86 arch:x86

bb81c947192ed43ff0f8c66b8bfbf11f

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/10/2014, 18:06

Not After

01/01/2016, 18:06

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:d1:52:56:28:17:64:9a:9b:d2:45:46:d5:9a:ce:cc:ed:94:ed:ee:08:33:c8:d8:df:96:96:22:88:88:b3:9a
Signer

Actual PE Digest

80:d1:52:56:28:17:64:9a:9b:d2:45:46:d5:9a:ce:cc:ed:94:ed:ee:08:33:c8:d8:df:96:96:22:88:88:b3:9a

Digest Algorithm

sha256

PE Digest Matches

false

b9:92:5d:89:a6:90:4c:b2:2b:79:41:00:bb:61:ff:10:24:83:9d:e7
Signer

Actual PE Digest

b9:92:5d:89:a6:90:4c:b2:2b:79:41:00:bb:61:ff:10:24:83:9d:e7

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

sqmapi.pdb

Imports

msvcrt

ungetc
realloc
__pioinfo
__badioinfo
_read
wcstombs
iswctype
wctomb
__mb_cur_max
mbtowc
localeconv
calloc
_fileno
isleadbyte
isxdigit
isdigit
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
iswalpha
fread
fseek
fwprintf
fwrite
fclose
_wfopen
ceil
memcpy
memcmp
_CxxThrowException
_wcsnicmp
wcsstr
wcsncmp
wcschr
_vsnprintf
_wtoi64
_wtoi
_purecall
_strtoui64
_wcsicmp
wcsrchr
memset
_vsnwprintf
_callnewh
malloc
free
__CxxFrameHandler
time
rand
_errno
srand

advapi32

OpenThreadToken
RegEnumKeyExW
RegEnumKeyW
RegDeleteKeyW
CreateWellKnownSid
SetEntriesInAclW
SetSecurityDescriptorDacl
SetFileSecurityW
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
GetFileSecurityW
ConvertSidToStringSidW
SetNamedSecurityInfoW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
OpenProcessToken
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage

user32

MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW

kernel32

CreateThread
DuplicateHandle
SetFilePointer
WideCharToMultiByte
FileTimeToSystemTime
GetSystemWow64DirectoryW
FindResourceW
lstrlenW
GlobalFree
SizeofResource
LockResource
LoadResource
LoadLibraryExW
FreeResource
OpenFileMappingW
VirtualFree
FreeLibraryAndExitThread
GetThreadPriority
SetThreadPriority
Sleep
CreateEventW
WaitForMultipleObjectsEx
WaitForSingleObject
ResetEvent
SetEvent
GetTempPathW
WriteFile
SetFilePointerEx
SetFileAttributesW
GetTempFileNameW
GetLongPathNameW
GetFileSizeEx
GetFileAttributesW
CopyFileW
LocalAlloc
GetModuleHandleExW
InterlockedExchange
GetNativeSystemInfo
GetSystemDefaultLCID
GetUserGeoID
InitializeCriticalSection
ReleaseMutex
CreateMutexW
DelayLoadFailureHook
OpenMutexW
OutputDebugStringA
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
CompareStringW
SetErrorMode
GetVersionExW
GetModuleFileNameW
GetProcAddress
VerifyVersionInfoW
LoadLibraryExA
VirtualAlloc
GetSystemDirectoryW
GetTickCount
ReadFile
GetFileSize
GetFileAttributesExW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CompareFileTime
ExpandEnvironmentStringsW
GetEnvironmentVariableW
VerSetConditionMask
SystemTimeToFileTime
LoadLibraryW
LocalFree
FreeLibrary
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
CreateFileW
CloseHandle
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
GetCurrentProcess
GetCurrentThread
GetSystemTime
CreateDirectoryW

ntdll

RtlGetVersion
RtlFreeHeap
RtlAllocateHeap
NtQuerySystemTime

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreateSequential

Exports

Exports

SqmAddToAverage
SqmAddToStream
SqmAddToStreamDWord
SqmAddToStreamDWord64
SqmAddToStreamString
SqmAddToStreamV
SqmCheckEscalationAddToStreamDWord
SqmCheckEscalationAddToStreamDWord64
SqmCheckEscalationAddToStreamString
SqmCheckEscalationSetDWord
SqmCheckEscalationSetDWord64
SqmCheckEscalationSetString
SqmCleanup
SqmClearFlags
SqmCreateNewId
SqmEndSession
SqmEndSessionEx
SqmFlushSession
SqmGetEnabled
SqmGetEscalationRuleStatus
SqmGetFlags
SqmGetInstrumentationProperty
SqmGetLastUploadTime
SqmGetMachineId
SqmGetSession
SqmGetSessionStartTime
SqmGetUserId
SqmIncrement
SqmIsNamespaceEnabled
SqmIsWindowsOptedIn
SqmLoadEscalationManifest
SqmReadSharedMachineId
SqmReadSharedUserId
SqmSet
SqmSetAppId
SqmSetAppVersion
SqmSetBits
SqmSetBool
SqmSetCurrentTimeAsUploadTime
SqmSetDWord64
SqmSetEnabled
SqmSetEscalationInfo
SqmSetFlags
SqmSetIfMax
SqmSetIfMin
SqmSetMachineId
SqmSetString
SqmSetUserId
SqmStartSession
SqmStartUpload
SqmStartUploadEx
SqmSysprepCleanup
SqmSysprepGeneralize
SqmSysprepSpecialize
SqmTimerAccumulate
SqmTimerAddToAverage
SqmTimerRecord
SqmTimerStart
SqmUnattendedSetup
SqmUnloadEscalationManifest
SqmWaitForUploadComplete
SqmWriteSharedMachineId
SqmWriteSharedUserId

Sections

.text
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb81c947192ed43ff0f8c66b8bfbf11f

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70Certificate

Extended Key Usages

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:caCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7bCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

80:d1:52:56:28:17:64:9a:9b:d2:45:46:d5:9a:ce:cc:ed:94:ed:ee:08:33:c8:d8:df:96:96:22:88:88:b3:9aSigner

b9:92:5d:89:a6:90:4c:b2:2b:79:41:00:bb:61:ff:10:24:83:9d:e7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

user32

kernel32

ntdll

rpcrt4

Exports

Exports

Sections

.text Size: 194KB - Virtual size: 193KB

.data Size: 2KB - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 11KB - Virtual size: 10KB

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:7b:a2:81:0b:87:11:ab:e7:fc:00:00:00:00:00:7b
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

80:d1:52:56:28:17:64:9a:9b:d2:45:46:d5:9a:ce:cc:ed:94:ed:ee:08:33:c8:d8:df:96:96:22:88:88:b3:9a
Signer

b9:92:5d:89:a6:90:4c:b2:2b:79:41:00:bb:61:ff:10:24:83:9d:e7
Signer

.text
Size: 194KB - Virtual size: 193KB

.data
Size: 2KB - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 11KB - Virtual size: 10KB