b2ebd40ab92c0c5cd6ae235cac75c695c9b18d42a4ed062fc5bf472481e8595e

Sharing

Copy URL

Twitter E-mail

General

Target

b2ebd40ab92c0c5cd6ae235cac75c695c9b18d42a4ed062fc5bf472481e8595e
Size

802KB
MD5

bf94cc91bdd6075caf600fb62bbde39b
SHA1

8b077ebcc614b369cd58e8a5d8073825b8a4db07
SHA256

b2ebd40ab92c0c5cd6ae235cac75c695c9b18d42a4ed062fc5bf472481e8595e
SHA512

ce412e717d755d70138247a16d284da4460f679febbff597d149c1ace1bb3be1d8d7956d4c4a538c82b8b884d0504b9366169f004508e44b3bd78ba40a5ed4f4
SSDEEP

24576:TDs6xpxYy3/3A0ARiAfryrF7ulYZexuM9rEH7I:lpj3/3AfryDZexu6

Score

1^/10

Malware Config

Signatures

Files

b2ebd40ab92c0c5cd6ae235cac75c695c9b18d42a4ed062fc5bf472481e8595e
.dll windows:5 windows x86 arch:x86

1ccb58c346cfdbea2a72089746034496

Code Sign

44:82:06:ac:63:f0:b2:b4:be:d6:75:fa:ce:06:89:47
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08-10-2018 00:00

Not After

28-12-2021 23:59

Subject

CN=Famatech Corp.,O=Famatech Corp.,L=Road Town,ST=Tortola,C=VG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a5:19:10:ff:56:d8:d9:10:23:a3:3d:e8:b5:e9:11:c5:ae:00:f2:19:9e:5b:b6:8c:1f:a2:7f:81:c7:5a:73:6e
Signer

Actual PE Digest

a5:19:10:ff:56:d8:d9:10:23:a3:3d:e8:b5:e9:11:c5:ae:00:f2:19:9e:5b:b6:8c:1f:a2:7f:81:c7:5a:73:6e

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Z:\MyUtil\Release\Shelper.pdb

Imports

kernel32

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
GetVersion
GetCurrentThreadId
GetFileType
GetStdHandle
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
GetVersionExA
FlushConsoleInputBuffer
GetFullPathNameW
WriteConsoleW
HeapSize
SetEnvironmentVariableA
LCMapStringW
GetStringTypeW
OutputDebugStringW
RaiseException
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
SetFilePointerEx
SetStdHandle
FlushFileBuffers
GetConsoleCP
ReadConsoleW
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetCPInfo
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
DeleteFileW
CreateFileW
GetDriveTypeW
GetModuleHandleA
GetModuleFileNameW
LoadLibraryA
CloseHandle
FindClose
SetEndOfFile
ReadFile
WriteFile
GetFileSize
SetLastError
GetLastError
GetProcAddress
FreeLibrary
InterlockedCompareExchange
InterlockedExchange
GetCurrentDirectoryW
HeapFree
RtlUnwind
HeapAlloc
HeapReAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
ExitProcess
GetModuleHandleExW
AreFileApisANSI
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetTimeZoneInformation
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
FileTimeToSystemTime
CreateThread
ExitThread
ResumeThread
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP

user32

MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW

advapi32

CryptSignHashA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
CryptEnumProvidersA
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextA

crypt32

CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
CertFreeCertificateContext

Exports

Exports

SHelper_AllocBuffer
SHelper_CChannel_CreateClient
SHelper_CChannel_CreateServer
SHelper_CChannel_DecryptBuffer
SHelper_CChannel_Delete
SHelper_CChannel_EncryptBuffer
SHelper_CChannel_SetKeyDec
SHelper_CChannel_SetKeyEnc
SHelper_CheckAPIVersion
SHelper_CheckExeFileSignature
SHelper_CheckNetworkProtocolVersion
SHelper_CreateClient
SHelper_CreateInvalidBuffer
SHelper_CreateServer
SHelper_Delete
SHelper_FreeBuffer
SHelper_GenerateUserParams
SHelper_GetKey
SHelper_GetMaxPacketSize
SHelper_GetName
SHelper_GetNetworkProtocolVersion
SHelper_GetNextBuffer
SHelper_Init
SHelper_RSAHelper_CreateWithPrivateKey
SHelper_RSAHelper_CreateWithPublicKey
SHelper_RSAHelper_DecryptBuffer_Private
SHelper_RSAHelper_DecryptBuffer_Public
SHelper_RSAHelper_Delete
SHelper_RSAHelper_EncryptBuffer_Private
SHelper_RSAHelper_EncryptBuffer_Public
SHelper_RSession_CreateClient
SHelper_RSession_CreateServer
SHelper_RSession_Delete
SHelper_RSession_GetClientDataOnServer
SHelper_RSession_GetKey
SHelper_RSession_GetNextBuffer
SHelper_RSession_GetServerDataOnClient
SHelper_SetUserParams

Sections

.text
Size: 516KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ccb58c346cfdbea2a72089746034496

Code Sign

44:82:06:ac:63:f0:b2:b4:be:d6:75:fa:ce:06:89:47Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

a5:19:10:ff:56:d8:d9:10:23:a3:3d:e8:b5:e9:11:c5:ae:00:f2:19:9e:5b:b6:8c:1f:a2:7f:81:c7:5a:73:6eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

crypt32

Exports

Exports

Sections

.text Size: 516KB - Virtual size: 516KB

.rdata Size: 164KB - Virtual size: 163KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 24KB

44:82:06:ac:63:f0:b2:b4:be:d6:75:fa:ce:06:89:47
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

a5:19:10:ff:56:d8:d9:10:23:a3:3d:e8:b5:e9:11:c5:ae:00:f2:19:9e:5b:b6:8c:1f:a2:7f:81:c7:5a:73:6e
Signer

.text
Size: 516KB - Virtual size: 516KB

.rdata
Size: 164KB - Virtual size: 163KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 24KB