5462714386750618ae3e5b5220d87610N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5462714386750618ae3e5b5220d87610N.exe
Size

221KB
MD5

5462714386750618ae3e5b5220d87610
SHA1

770a6c22a267cdde414e2bdf9b1d91233073cefe
SHA256

be02577ecd7d44699f01dba20fc3f2414b25705927d1551c20aeac81f774371c
SHA512

d4e7c7539e47be94aa5e8f8a290e335a896cc22698376b17eaf7e1302ac5cb49bdd8de4eb31fbc021e1b7b577762452e7fd74a703c01ed90a9a1225fdc0c04e4
SSDEEP

3072:jsLIUKoE/92Y/sG/qYRsqhcw2EW+kF46J6XZbZ65z:jskvoE/Pndn2EWz46J6XEz

Score

1^/10

Malware Config

Signatures

Files

5462714386750618ae3e5b5220d87610N.exe
.dll windows:10 windows x64 arch:x64

b627f996739411ec86e779b42fc90c0d

Code Sign

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:51

Not After

16/10/2024, 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

db:df:12:64:5e:5e:67:92:00:72:bb:0a:74:71:5d:88:94:aa:76:97:48:f1:9d:67:05:a3:60:81:73:e5:81:db
Signer

Actual PE Digest

db:df:12:64:5e:5e:67:92:00:72:bb:0a:74:71:5d:88:94:aa:76:97:48:f1:9d:67:05:a3:60:81:73:e5:81:db

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\e\src\out\Release_x64\wdag.dll.pdb

Imports

kernel32

AcquireSRWLockExclusive
CloseHandle
CopyFileW
CreateDirectoryW
CreateHardLinkW
CreateThread
DisableThreadLibraryCalls
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesW
GetLastError
GetModuleHandleW
GetPrivateProfileIntW
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LoadLibraryExA
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable

vcruntime140

_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_destroy_list
__uncaught_exceptions
memchr
memcmp
memcpy
memmove
memset

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_l_func
__pctype_func
_configthreadlocale
_create_locale
_free_locale
setlocale

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vsscanf
fflush
fputwc
fwrite
getc
getwc
ungetc
ungetwc

api-ms-win-crt-runtime-l1-1-0

__sys_nerr
_cexit
_configure_narrow_argv
_crt_atexit
_errno
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
_seh_filter_dll
strerror_s

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc
realloc

api-ms-win-crt-string-l1-1-0

_isctype_l
_iswlower_l
_strdup
mbrlen
strcmp
strlen
tolower
toupper
wcslen

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-time-l1-1-0

_strftime_l

api-ms-win-crt-convert-l1-1-0

_strtod_l
_strtof_l
_strtoi64_l
_strtold_l
_strtoui64_l
mbrtowc
mbsrtowcs
wcrtomb
wcrtomb_s

Exports

Exports

?WdagCreateContainerProxy@@YAPEAVContainer@internals@wdag@@PEAUErrorHandler@23@PEB_W1_N111@Z
?WdagDestroyContainerProxy@@YAXPEAVContainer@internals@wdag@@@Z
?WdagFileHasMarkOfTheContainer@@YA_NPEB_W@Z
?WdagGetHvSocketCapability@@YAPEB_WXZ
?WdagGetHvSocketGuid@@YA?AU_GUID@@W4Channel@internals@wdag@@@Z
?WdagSuppressHvsiSplashDialog@@YAXXZ
WdagCreateContainerProxy
WdagDestroyContainerProxy
WdagFileHasMarkOfTheContainer
WdagGetHvSocketCapability
WdagGetHvSocketGuid
WdagSuppressHvsiSplashDialog

Sections

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 140B

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b627f996739411ec86e779b42fc90c0d

Code Sign

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

db:df:12:64:5e:5e:67:92:00:72:bb:0a:74:71:5d:88:94:aa:76:97:48:f1:9d:67:05:a3:60:81:73:e5:81:dbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 146KB - Virtual size: 146KB

.rdata Size: 46KB - Virtual size: 45KB

.data Size: 5KB - Virtual size: 12KB

.pdata Size: 8KB - Virtual size: 8KB

.retplne Size: 512B - Virtual size: 140B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

db:df:12:64:5e:5e:67:92:00:72:bb:0a:74:71:5d:88:94:aa:76:97:48:f1:9d:67:05:a3:60:81:73:e5:81:db
Signer

.text
Size: 146KB - Virtual size: 146KB

.rdata
Size: 46KB - Virtual size: 45KB

.data
Size: 5KB - Virtual size: 12KB

.pdata
Size: 8KB - Virtual size: 8KB

.retplne
Size: 512B - Virtual size: 140B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB