056967904ff7ea3efde043c32339d6f5cd19e5a6801ba4f79854681626900dcc

Sharing

Copy URL

Twitter E-mail

General

Target

056967904ff7ea3efde043c32339d6f5cd19e5a6801ba4f79854681626900dcc
Size

170KB
MD5

11761610edfdd75009f461c28febf137
SHA1

48b31b62ff07695e3d5856931d0cafe4b4599748
SHA256

056967904ff7ea3efde043c32339d6f5cd19e5a6801ba4f79854681626900dcc
SHA512

caa96736d0bfb4dee87080129fb5454c0f0ac4ac75266655f24eae418f48a90c8997e61ed1f40ded252fb18a7dda5abeac5552d72e4dcd25c71971f83a321f6f
SSDEEP

3072:/5ynY/+JTKlLASVxYN+ca3sMilE97fotVDtc+L727rU+jEi1WVEJWzi+:/5yY/EKlLAOmN+caalE97fo3Dqs03jET

Score

1^/10

Malware Config

Signatures

Files

056967904ff7ea3efde043c32339d6f5cd19e5a6801ba4f79854681626900dcc
.dll windows:6 windows x64 arch:x64

f57c35656839482a9cd763209c610a0e

Code Sign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13-01-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28-07-2021 00:00

Not After

27-07-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:9c:12:44:48:06:1e:99:e6:9c:d9:5d:57:c8:07:a6
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

27-06-2024 00:00

Not After

15-10-2024 23:59

Subject

SERIALNUMBER=4969967,CN=Zoom Video Communications\, Inc.,O=Zoom Video Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13-01-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28-07-2021 00:00

Not After

27-07-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:9c:12:44:48:06:1e:99:e6:9c:d9:5d:57:c8:07:a6
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

27-06-2024 00:00

Not After

15-10-2024 23:59

Subject

SERIALNUMBER=4969967,CN=Zoom Video Communications\, Inc.,O=Zoom Video Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:50:47:0a:dc:d7:77:01:f8:c9:3d:d8:73:0e:3c:12:ac:90:68:07
Signer

Actual PE Digest

08:50:47:0a:dc:d7:77:01:f8:c9:3d:d8:73:0e:3c:12:ac:90:68:07

Digest Algorithm

sha1

PE Digest Matches

true

c4:01:48:ab:50:66:f5:ae:87:aa:26:3b:58:e2:38:dd:d9:7b:ae:91:0d:66:af:48:47:b9:44:84:c3:29:24:1c
Signer

Actual PE Digest

c4:01:48:ab:50:66:f5:ae:87:aa:26:3b:58:e2:38:dd:d9:7b:ae:91:0d:66:af:48:47:b9:44:84:c3:29:24:1c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

htons
__WSAFDIsSet
getservbyport
gethostname
getservbyname
ntohs
WSASocketW
bind
closesocket
connect
ioctlsocket
htonl
recv
recvfrom
send
setsockopt
socket
WSAGetLastError
getsockname
ntohl
WSADuplicateSocketW
WSAIoctl

advapi32

RegCloseKey
RegQueryValueExA
SystemFunction036
RegEnumKeyExA
RegOpenKeyExA

iphlpapi

GetUnicastIpAddressTable
if_nametoindex
if_indextoname
GetBestRoute2
FreeMibTable
GetAdaptersAddresses

kernel32

RtlCaptureContext
SetLastError
GetVersionExA
GetProcAddress
RtlLookupFunctionEntry
GetCurrentProcessId
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
GetModuleHandleA
ExpandEnvironmentStringsA
GetLastError
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
WaitForSingleObject
CreateThread
GetTickCount
SetHandleInformation
CreateIoCompletionPort

vcruntime140

__C_specific_handler
__std_type_info_destroy_list
memset
strchr
memmove
memcpy
memcmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

fclose
fopen
fread
fseek
ftell
__stdio_common_vsprintf
ferror
fgets
__acrt_iob_func
setvbuf
fflush
__stdio_common_vfprintf

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

strtoul
atoi

api-ms-win-crt-runtime-l1-1-0

_errno
_initterm
_cexit
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table

api-ms-win-crt-utility-l1-1-0

rand
qsort
srand

api-ms-win-crt-string-l1-1-0

isupper
strcmp
strncmp
_stricmp
isspace
isdigit
isxdigit
strncat
_strnicmp
tolower

api-ms-win-crt-heap-l1-1-0

realloc
free
malloc

Exports

Exports

ares_cancel
ares_create_query
ares_destroy
ares_destroy_options
ares_dns_addr_to_ptr
ares_dns_class_fromstr
ares_dns_class_tostr
ares_dns_opcode_tostr
ares_dns_opt_get_datatype
ares_dns_opt_get_name
ares_dns_parse
ares_dns_pton
ares_dns_rcode_tostr
ares_dns_rec_type_fromstr
ares_dns_rec_type_tostr
ares_dns_record_create
ares_dns_record_destroy
ares_dns_record_get_flags
ares_dns_record_get_id
ares_dns_record_get_opcode
ares_dns_record_get_rcode
ares_dns_record_query_add
ares_dns_record_query_cnt
ares_dns_record_query_get
ares_dns_record_rr_add
ares_dns_record_rr_cnt
ares_dns_record_rr_del
ares_dns_record_rr_get
ares_dns_rr_get_addr
ares_dns_rr_get_addr6
ares_dns_rr_get_bin
ares_dns_rr_get_class
ares_dns_rr_get_keys
ares_dns_rr_get_name
ares_dns_rr_get_opt
ares_dns_rr_get_opt_byid
ares_dns_rr_get_opt_cnt
ares_dns_rr_get_str
ares_dns_rr_get_ttl
ares_dns_rr_get_type
ares_dns_rr_get_u16
ares_dns_rr_get_u32
ares_dns_rr_get_u8
ares_dns_rr_key_datatype
ares_dns_rr_key_to_rec_type
ares_dns_rr_key_tostr
ares_dns_rr_set_addr
ares_dns_rr_set_addr6
ares_dns_rr_set_bin
ares_dns_rr_set_opt
ares_dns_rr_set_str
ares_dns_rr_set_u16
ares_dns_rr_set_u32
ares_dns_rr_set_u8
ares_dns_section_tostr
ares_dns_write
ares_dup
ares_expand_name
ares_expand_string
ares_fds
ares_free_data
ares_free_hostent
ares_free_string
ares_freeaddrinfo
ares_get_servers
ares_get_servers_csv
ares_get_servers_ports
ares_getaddrinfo
ares_gethostbyaddr
ares_gethostbyname
ares_gethostbyname_file
ares_getnameinfo
ares_getsock
ares_inet_ntop
ares_inet_pton
ares_init
ares_init_options
ares_library_cleanup
ares_library_init
ares_library_init_mem
ares_library_initialized
ares_mkquery
ares_parse_a_reply
ares_parse_aaaa_reply
ares_parse_caa_reply
ares_parse_mx_reply
ares_parse_naptr_reply
ares_parse_ns_reply
ares_parse_ptr_reply
ares_parse_soa_reply
ares_parse_srv_reply
ares_parse_txt_reply
ares_parse_txt_reply_ext
ares_parse_uri_reply
ares_process
ares_process_fd
ares_query
ares_queue_active_queries
ares_queue_wait_empty
ares_reinit
ares_save_options
ares_search
ares_send
ares_set_local_dev
ares_set_local_ip4
ares_set_local_ip6
ares_set_servers
ares_set_servers_csv
ares_set_servers_ports
ares_set_servers_ports_csv
ares_set_socket_callback
ares_set_socket_configure_callback
ares_set_socket_functions
ares_set_sortlist
ares_strerror
ares_threadsafety
ares_timeout
ares_version

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f57c35656839482a9cd763209c610a0e

Code Sign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8fCertificate

Extended Key Usages

Key Usages

03:9c:12:44:48:06:1e:99:e6:9c:d9:5d:57:c8:07:a6Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8fCertificate

Extended Key Usages

Key Usages

03:9c:12:44:48:06:1e:99:e6:9c:d9:5d:57:c8:07:a6Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

08:50:47:0a:dc:d7:77:01:f8:c9:3d:d8:73:0e:3c:12:ac:90:68:07Signer

c4:01:48:ab:50:66:f5:ae:87:aa:26:3b:58:e2:38:dd:d9:7b:ae:91:0d:66:af:48:47:b9:44:84:c3:29:24:1cSigner

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

advapi32

iphlpapi

kernel32

vcruntime140

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 110KB - Virtual size: 110KB

.rdata Size: 24KB - Virtual size: 24KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 8KB - Virtual size: 8KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 128B

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

03:9c:12:44:48:06:1e:99:e6:9c:d9:5d:57:c8:07:a6
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

03:9c:12:44:48:06:1e:99:e6:9c:d9:5d:57:c8:07:a6
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

08:50:47:0a:dc:d7:77:01:f8:c9:3d:d8:73:0e:3c:12:ac:90:68:07
Signer

c4:01:48:ab:50:66:f5:ae:87:aa:26:3b:58:e2:38:dd:d9:7b:ae:91:0d:66:af:48:47:b9:44:84:c3:29:24:1c
Signer

.text
Size: 110KB - Virtual size: 110KB

.rdata
Size: 24KB - Virtual size: 24KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 128B