b0894017378b6a639830db794d6948b0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b0894017378b6a639830db794d6948b0N.exe
Size

18KB
MD5

b0894017378b6a639830db794d6948b0
SHA1

3a0038fa4614e928adb8ded53be249fa4093a35b
SHA256

c7e92bc1d86f8d63e1fb388d5cdd52ed87c18e47fb76e808b9a45caea6d28bea
SHA512

413e31e536a715e2588ce66d3fecbb3f5a48f7e56753008405ca2ea0d6c0f6a2f7c58adaa1ab1469ed7e8589e9289a747d80e9a5e0f20605edf6be9c63c6cd4c
SSDEEP

384:/WEhWkR4Zq0GftpBjyNjxT4bHRN7Iyl9QkjG:vD47i6j6bjzjG

Score

1^/10

Malware Config

Signatures

Files

b0894017378b6a639830db794d6948b0N.exe
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c6:78:80:36:01:75:1a:69:72:00:00:00:00:00:c6
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2016, 20:17

Not After

02/11/2017, 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/11/2016, 22:09

Not After

17/02/2018, 22:09

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:37:e6:81:a0:14:23:41:7b:95:ea:50:b2:a9:2d:60:84:1c:2a:89:08:9f:21:70:be:d9:80:71:a9:c7:88:0f
Signer

Actual PE Digest

68:37:e6:81:a0:14:23:41:7b:95:ea:50:b2:a9:2d:60:84:1c:2a:89:08:9f:21:70:be:d9:80:71:a9:c7:88:0f

Digest Algorithm

sha256

PE Digest Matches

true

00:4b:63:e9:48:76:07:ef:e3:9a:28:79:d9:ce:67:fb:7e:24:f2:45
Signer

Actual PE Digest

00:4b:63:e9:48:76:07:ef:e3:9a:28:79:d9:ce:67:fb:7e:24:f2:45

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

api-ms-win-core-timezone-l1-1-0.pdb

Exports

Exports

FileTimeToSystemTime
GetDynamicTimeZoneInformation
GetTimeZoneInformation
GetTimeZoneInformationForYear
SetDynamicTimeZoneInformation
SetTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime

Sections

.text
Size: 1024B - Virtual size: 1003B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:00:c6:78:80:36:01:75:1a:69:72:00:00:00:00:00:c6Certificate

Extended Key Usages

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

68:37:e6:81:a0:14:23:41:7b:95:ea:50:b2:a9:2d:60:84:1c:2a:89:08:9f:21:70:be:d9:80:71:a9:c7:88:0fSigner

00:4b:63:e9:48:76:07:ef:e3:9a:28:79:d9:ce:67:fb:7e:24:f2:45Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 1003B

.rsrc Size: 1024B - Virtual size: 1016B

33:00:00:00:c6:78:80:36:01:75:1a:69:72:00:00:00:00:00:c6
Certificate

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

68:37:e6:81:a0:14:23:41:7b:95:ea:50:b2:a9:2d:60:84:1c:2a:89:08:9f:21:70:be:d9:80:71:a9:c7:88:0f
Signer

00:4b:63:e9:48:76:07:ef:e3:9a:28:79:d9:ce:67:fb:7e:24:f2:45
Signer

.text
Size: 1024B - Virtual size: 1003B

.rsrc
Size: 1024B - Virtual size: 1016B