b0cea83925a2988adc06e4b942fb9670N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b0cea83925a2988adc06e4b942fb9670N.exe
Size

4.7MB
MD5

b0cea83925a2988adc06e4b942fb9670
SHA1

b1201dfd532990e2ca3bfa5f501bb7428b5f1d3d
SHA256

9366150823c151dc0cc02ff5b9f9e4f4d09a2c37daf50efe29a2b3525c8528d0
SHA512

8cc8656ef3cd2a8a0e327b793f6a76272dd9632d6b1d21358a2ac20457e6394aab573123a3dbe4a63baa0e7a2dde381e133f348bb90b1f1e002c64cc49dad1e8
SSDEEP

49152:AMLnHQldkqh7BxRp98oAe845SH4EGiRm6ckJRGC3jjQD69x445fxGLnm7MM+Mxk1:sRpSe844Rm6ckWCzEMzxkOjT0URnG

Score

1^/10

Malware Config

Signatures

Files

b0cea83925a2988adc06e4b942fb9670N.exe
.exe windows:6 windows x64 arch:x64

816f3ff37cb4744b986af2e0ff9cea53

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/09/2022, 00:00

Not After

17/09/2025, 23:59

Subject

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:54:05:11:1d:15:88:d9:b8:cd:95:9f:d8:47:07:8c:a8:32:e2:f8:b3:ec:57:62:f6:d8:0f:99:82:19:0b:48
Signer

Actual PE Digest

14:54:05:11:1d:15:88:d9:b8:cd:95:9f:d8:47:07:8c:a8:32:e2:f8:b3:ec:57:62:f6:d8:0f:99:82:19:0b:48

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\AvBugReport.pdb

Imports

rpcrt4

RpcEpUnregister
RpcEpRegisterW
RpcServerUseProtseqEpW
RpcObjectSetType
RpcServerRegisterIf2
RpcServerUnregisterIfEx
RpcAsyncInitializeHandle
RpcBindingToStringBindingW
I_RpcBindingInqLocalClientPID
RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqBegin
RpcIfInqId
RpcMgmtEpEltInqDone
RpcAsyncCancelCall
Ndr64AsyncClientCall
NdrServerCallAll
RpcRevertToSelf
RpcAsyncCompleteCall
UuidCreate
NdrServerCall2
NdrAsyncServerCall
Ndr64AsyncServerCallAll
UuidToStringW
UuidFromStringW
RpcImpersonateClient
NdrClientCall3
RpcBindingFree
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringBindingParseW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

shell32

ord165
SHGetFolderPathW

ntdll

NtClose
NtSetInformationThread
RtlNtStatusToDosError
RtlDllShutdownInProgress
NtOpenKey
NtQueryKey
NtDeleteKey
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
NtSystemDebugControl
VerSetConditionMask
RtlPcToFileHeader
RtlUnwindEx
RtlUnwind

kernel32

GetFileTime
GetVersionExW
LoadLibraryExW
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
DecodePointer
HeapDestroy
UnlockFileEx
LockFileEx
CompareFileTime
SetFilePointerEx
GetFileSizeEx
ReadFile
ResetEvent
ProcessIdToSessionId
WaitForMultipleObjects
GetCurrentThread
UnregisterWaitEx
LocalFree
CompareStringW
CancelIoEx
GetOverlappedResult
ReadDirectoryChangesW
InitializeCriticalSectionAndSpinCount
TerminateThread
ResumeThread
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
QueryThreadCycleTime
GetCurrentDirectoryW
FindNextFileW
K32GetProcessImageFileNameW
GetThreadId
WriteFile
LocalAlloc
FlushFileBuffers
GetFileInformationByHandle
GetFullPathNameW
OutputDebugStringA
FileTimeToSystemTime
GetSystemInfo
ExpandEnvironmentStringsW
GetShortPathNameW
GetSystemWindowsDirectoryW
GetProcessAffinityMask
GetLongPathNameW
VirtualAlloc
VirtualFree
GlobalMemoryStatusEx
GetExitCodeThread
SetFilePointer
SetFileAttributesW
GetFileSize
SetEndOfFile
MoveFileExW
GetWindowsDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
OpenThread
GetFileAttributesExW
CreateDirectoryW
FindFirstFileExW
QueryDosDeviceW
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
GetDateFormatW
GetTimeFormatW
CopyFileW
SetFileInformationByHandle
GetDiskFreeSpaceExW
FindResourceW
LoadResource
LockResource
SizeofResource
K32GetMappedFileNameW
FindFirstVolumeW
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
GetTickCount64
GetStartupInfoW
GetPriorityClass
QueryFullProcessImageNameW
SetEvent
CreateEventW
GetTickCount
RaiseException
FlushInstructionCache
CheckRemoteDebuggerPresent
DeviceIoControl
OpenProcess
VirtualProtect
VirtualQuery
SetLastError
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
CreateThread
SetEnvironmentVariableW
GetEnvironmentVariableW
GetProcessId
FormatMessageW
GetModuleFileNameA
FindClose
GetSystemTimeAsFileTime
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
GetModuleHandleExW
GetCurrentProcess
ReadProcessMemory
DeleteFileW
CreateFileW
FindFirstFileW
VerifyVersionInfoW
GetExitCodeProcess
CreateProcessW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
GetFileAttributesW
FreeLibrary
LoadLibraryW
GetSystemDirectoryW
MultiByteToWideChar
SetErrorMode
ReleaseMutex
CreateMutexW
SetDllDirectoryW
WideCharToMultiByte
WaitForSingleObject
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
GetModuleHandleW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetLastError
IsDebuggerPresent
OutputDebugStringW
InterlockedPushEntrySList
ExitThread
FreeLibraryAndExitThread
GetProcessTimes
GetSystemTimes
DuplicateHandle
GetNativeSystemInfo
UnhandledExceptionFilter
InitializeSListHead
GetCPInfo
FindResourceExW
GetVersion
RegisterWaitForSingleObject
GlobalFree
WriteConsoleW
GetTimeZoneInformation
FreeEnvironmentStringsW
EncodePointer
LCMapStringEx
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
WakeConditionVariable
IsProcessorFeaturePresent
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceComplete
InitOnceBeginInitialize
AcquireSRWLockShared
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetStdHandle
ExitProcess
TerminateProcess
Sleep
GetProcessHandleCount
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
K32GetProcessMemoryInfo
GetThreadTimes
K32EnumProcesses
GetThreadPriority
GetFileType
GetConsoleMode
ReadConsoleW
GetCommandLineW
GetCommandLineA
GetStdHandle
FormatMessageA
GetStringTypeW
AreFileApisANSI
GetFileInformationByHandleEx
WaitForSingleObjectEx
GetLocaleInfoEx
ReleaseSRWLockExclusive
GetConsoleOutputCP

user32

GetGUIThreadInfo
IsHungAppWindow
PeekMessageW
GetSystemMetrics
LoadStringW
RegisterWindowMessageW
PostMessageW
SendMessageW
SetWindowLongPtrW
RegisterClassExW
GetClassInfoExW
SendMessageCallbackW

advapi32

EnumServicesStatusW
QueryServiceStatusEx
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RevertToSelf
RegCloseKey
OpenThreadToken
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegQueryMultipleValuesW
RegDeleteTreeW
RegNotifyChangeKeyValue
CloseServiceHandle
RegQueryInfoKeyW
RegDeleteValueW
RegEnumValueW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
FreeSid
LookupAccountSidW
RegOpenKeyExW
AddAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
ImpersonateSelf
AdjustTokenPrivileges
LookupPrivilegeValueW
CheckTokenMembership
DuplicateToken
EqualSid
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW

ole32

CoCreateGuid

powrprof

CallNtPowerInformation

winhttp

WinHttpAddRequestHeaders
WinHttpSetCredentials
WinHttpSendRequest
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpenRequest
WinHttpOpen
WinHttpSetTimeouts
WinHttpConnect
WinHttpGetProxyForUrl
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpSetOption
WinHttpQueryOption

shlwapi

PathRemoveFileSpecW
PathAppendW
PathMatchSpecW
PathFindFileNameW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CertFreeCertificateContext

ws2_32

WSAAddressToStringW

Exports

Exports

asw_process_storage_allocate_connector
asw_process_storage_deallocate_connector
on_avast_dll_unload
onexit_register_connector_avast_2

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 978KB - Virtual size: 977KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 441KB - Virtual size: 483KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

816f3ff37cb4744b986af2e0ff9cea53

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ffCertificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

14:54:05:11:1d:15:88:d9:b8:cd:95:9f:d8:47:07:8c:a8:32:e2:f8:b3:ec:57:62:f6:d8:0f:99:82:19:0b:48Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

wtsapi32

shell32

ntdll

kernel32

user32

advapi32

ole32

powrprof

winhttp

shlwapi

version

crypt32

ws2_32

Exports

Exports

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 978KB - Virtual size: 977KB

.data Size: 441KB - Virtual size: 483KB

.pdata Size: 152KB - Virtual size: 152KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 26KB - Virtual size: 25KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

09:02:b3:6b:32:51:c3:28:08:3f:77:7c:a0:84:28:ff
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

14:54:05:11:1d:15:88:d9:b8:cd:95:9f:d8:47:07:8c:a8:32:e2:f8:b3:ec:57:62:f6:d8:0f:99:82:19:0b:48
Signer

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 978KB - Virtual size: 977KB

.data
Size: 441KB - Virtual size: 483KB

.pdata
Size: 152KB - Virtual size: 152KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 26KB - Virtual size: 25KB