openXJV-0[.]7[.]0-x86_64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

openXJV-0.7.0-x86_64.exe
Size

148.1MB
MD5

a6544474a81532cf83ecc262201d7f12
SHA1

f76af39ee3368ce3cbfcdd4e428423db19155c80
SHA256

807d311f084e795a87a8f5b087fd2fdef07b9f19344c1f21c23a47176d3eb0e1
SHA512

443213f7a8bb26ae10d8812d450b8e29a85a354cf64ed992edf5a86541a63be7ebea4d62865cc1bfd3dae0153b60b83d8a335da2a130c89bb506240ed33554a7
SSDEEP

3145728:1muFc36PTMM0r6cerPWREbVeMsKHDZp/VSHPtV3YwtR1oECx64BJqlMi:1mucKJ3WR+Fl7SHQwnqECs46lMi

Score

1^/10

Malware Config

Signatures

Files

openXJV-0.7.0-x86_64.exe
.exe windows:4 windows x86 arch:x86

c4dfd81799750b8216e23427ad6f5f1c

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:8c:04:c5:45:a8:a7:b6:80:d1:5e:2a:bd:d3:3e:c7
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

07/03/2024, 12:55

Not After

07/03/2025, 12:55

Subject

CN=Open Source Developer\, Björn Seipel,O=Open Source Developer,L=Oberursel (Taunus),ST=Hesse,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:70:c2:ce:3d:6e:72:de:35:4f:de:80:29:d3:db:7f:26:01:73:88:6f:7a:c0:69:df:01:62:81:c1:e5:7c:97
Signer

Actual PE Digest

2c:70:c2:ce:3d:6e:72:de:35:4f:de:80:29:d3:db:7f:26:01:73:88:6f:7a:c0:69:df:01:62:81:c1:e5:7c:97

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

system
setlocale
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_controlfp
memcpy
memset
log10
_wfopen
fseek
fclose
wcsncpy
wcslen
wcscpy
wcscat
wcscmp
memmove
memcmp
_stricmp
sscanf
atoi
strlen
strcpy
strcat
sprintf
malloc
free
_wstat
_wcsdup
strcmp
_isnan
_finite
fread
longjmp
_setjmp3
ftell
_wcsicmp
wcsncmp
_snwprintf
tolower
floor
localtime
mktime
_wcsnicmp
_itow
gmtime
pow
??3@YAXPAX@Z
wcsstr
ceil
_CIpow
calloc
_errno
strrchr
strchr
strncpy
memchr
strncmp
_strdup
_close
_lseeki64
realloc
_snprintf
abort
_wopen
_setmode
wcschr
_open_osfhandle
wctomb
_get_osfhandle
_open
toupper
mbstowcs
time
qsort
ctime
strcspn
strftime
frexp
modf
fopen
strerror
atof
fflush
fwrite
__p__iob
fprintf
getenv
_stati64
_ftime
_vsnwprintf
cos
fmod
sin
abs

kernel32

GetSystemInfo
GetDiskFreeSpaceExW
HeapDestroy
ExitProcess
GetUserDefaultLangID
GetModuleHandleW
HeapCreate
CreateMutexW
LoadLibraryW
GetLastError
CloseHandle
FindResourceW
LoadResource
FreeLibrary
SizeofResource
LockResource
ExpandEnvironmentStringsW
GetCurrentProcess
GetStartupInfoA
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateThread
HeapAlloc
HeapFree
Sleep
CreateFileW
GetFileSize
ReadFile
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableW
SetEnvironmentVariableW
DuplicateHandle
CreatePipe
GetStdHandle
CreateProcessW
GetModuleFileNameW
GetProfileStringW
SetFilePointer
WideCharToMultiByte
MultiByteToWideChar
SetEndOfFile
WriteFile
DeleteFileW
HeapReAlloc
GetVersionExW
SetLastError
FindFirstFileW
FindNextFileW
FindClose
SetFileAttributesW
RemoveDirectoryW
GetDriveTypeW
GetFileAttributesW
CopyFileW
GetTempPathW
MulDiv
GetLocalTime
TlsSetValue
TlsGetValue
TlsAlloc
GlobalFree
GlobalAlloc
TlsFree
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
HeapSize
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetFileType
PeekNamedPipe
GetFileInformationByHandle
GetFileAttributesA
CreateFileA
GetExitCodeProcess
GetFullPathNameW
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject

user32

SendMessageW
GetSysColor
RedrawWindow
SetRect
GetWindowTextLengthW
GetWindowLongW
GetDlgCtrlID
GetActiveWindow
DestroyIcon
SetWindowLongW
UpdateLayeredWindow
IsWindowEnabled
IsWindowVisible
ExitWindowsEx
LoadIconW
RegisterClassExW
CreateWindowExW
BeginPaint
EndPaint
DefWindowProcW
MessageBoxW
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
EnableWindow
EnumWindows
SetWindowPos
GetWindowTextW
GetWindowRect
GetParent
MapWindowPoints
MoveWindow
InvalidateRect
DestroyWindow
GetDC
GetSystemMetrics
ReleaseDC
ScreenToClient
ClientToScreen
SetFocus
ShowWindow
CallWindowProcW
GetClientRect
FillRect
LoadCursorW
SetClassLongW
GetIconInfo
UpdateWindow
ReleaseCapture
DrawStateW
SetCapture
GetSysColorBrush
DrawTextW
ValidateRect
RemovePropW
SetPropW
GetWindow
GetAsyncKeyState
SetWindowTextW
GetPropW
SetScrollPos
InflateRect
GetWindowDC
SystemParametersInfoW
GetFocus
GetClassNameW
EnumPropsExW
RegisterClassW
AdjustWindowRectEx
UnregisterClassW
CreateAcceleratorTableW
GetMenu
DestroyAcceleratorTable
SetActiveWindow
IsZoomed
IsIconic
SetTimer
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
KillTimer
DefFrameProcW
EnumChildWindows
GetKeyState
IsChild
RegisterWindowMessageW
CreateIconFromResourceEx
CreateIconFromResource
CharLowerW
DrawIconEx

gdi32

StartDocW
GetMapMode
SetMapMode
GetDeviceCaps
DPtoLP
StartPage
EndPage
EndDoc
SetBkColor
GetStockObject
CreateDCW
SelectObject
GetTextExtentPoint32W
GetObjectType
GetObjectW
DeleteObject
SetTextColor
ExcludeClipRect
CreateFontIndirectW
CreateSolidBrush
SelectClipRgn
CreateRectRgnIndirect
GetClipRgn
ExtSelectClipRgn
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
GdiGetBatchLimit
GdiSetBatchLimit
BitBlt
SetStretchBltMode
SetBrushOrgEx
StretchBlt
CreateDIBSection
CreateBitmap
SetPixel
GetDIBits
CreateFontW
SetBkMode
SetTextAlign
TextOutW
GetTextMetricsW
GetPixel

comdlg32

PrintDlgW

advapi32

RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetUserNameW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptCreateHash

ole32

CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateInstance
CoCreateGuid
StringFromGUID2
RevokeDragDrop

shell32

ord165
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW
SHBrowseForFolderW
ExtractIconW
ShellExecuteExW

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY

comctl32

InitCommonControlsEx
ImageList_Replace
ImageList_Add
ImageList_ReplaceIcon
ImageList_Remove
ImageList_AddMasked
ImageList_Destroy
ImageList_Create

Sections

.text
Size: 777KB - Virtual size: 776KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4dfd81799750b8216e23427ad6f5f1c

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

1c:8c:04:c5:45:a8:a7:b6:80:d1:5e:2a:bd:d3:3e:c7Certificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

2c:70:c2:ce:3d:6e:72:de:35:4f:de:80:29:d3:db:7f:26:01:73:88:6f:7a:c0:69:df:01:62:81:c1:e5:7c:97Signer

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

comdlg32

advapi32

ole32

shell32

gdiplus

comctl32

Sections

.text Size: 777KB - Virtual size: 776KB

.rdata Size: 90KB - Virtual size: 90KB

.eh_fram Size: 22KB - Virtual size: 21KB

.data Size: 56KB - Virtual size: 63KB

.rsrc Size: 73KB - Virtual size: 72KB

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

1c:8c:04:c5:45:a8:a7:b6:80:d1:5e:2a:bd:d3:3e:c7
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

2c:70:c2:ce:3d:6e:72:de:35:4f:de:80:29:d3:db:7f:26:01:73:88:6f:7a:c0:69:df:01:62:81:c1:e5:7c:97
Signer

.text
Size: 777KB - Virtual size: 776KB

.rdata
Size: 90KB - Virtual size: 90KB

.eh_fram
Size: 22KB - Virtual size: 21KB

.data
Size: 56KB - Virtual size: 63KB

.rsrc
Size: 73KB - Virtual size: 72KB