9520bb4c37fff98eff4b84952afbe46118a9f914802c917632e4252d8396e1cd

Sharing

Copy URL Twitter E-mail

General

Target

9520bb4c37fff98eff4b84952afbe46118a9f914802c917632e4252d8396e1cd
Size

69KB
MD5

2a5a187973f87509d0ebdb44e9a9e318
SHA1

55b74b79843767f7e625f68714c11fa01da736f3
SHA256

9520bb4c37fff98eff4b84952afbe46118a9f914802c917632e4252d8396e1cd
SHA512

35588a8c4a8bb1d4b42b8059bc5d95ad7bbd4040e4b7d8d554b6bcb0d28ed9dfc8c7c197b6f69f6c1237d81d1a7204d4c96a8af60606bf106e680041f4bbf20b
SSDEEP

1536:Fs+35MaqmZQIhr+51g76Df8GgSEQDIuOcPpwamHn7hfiaLa3Fv1L7Sv:W+pMBmZey76DfBgSEQDI5cPpwa8fiaLf

Score

1^/10

Malware Config

Signatures

Files

9520bb4c37fff98eff4b84952afbe46118a9f914802c917632e4252d8396e1cd
.dll windows:6 windows x64 arch:x64

75b57052b1f29d941e76dfab5f8aa9f9

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

14/09/2023, 12:18

Not After

13/09/2026, 12:18

Subject

CN=The Document Foundation,OU=LibreOffice Build Team,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ae:b2:84:81:fe:ec:9b:6d:f8:df:ae:a8:3b:47:7b:9e:bb:36:b9:ec:7f:ef:8c:7d:e0:5b:1d:6d:34:ec:76:e2
Signer

Actual PE Digest

ae:b2:84:81:fe:ec:9b:6d:f8:df:ae:a8:3b:47:7b:9e:bb:36:b9:ec:7f:ef:8c:7d:e0:5b:1d:6d:34:ec:76:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\r\workdir\LinkTarget\Library\proxyfaclo.pdb

Imports

cppu3

typelib_typedescriptionreference_getDescription
uno_type_any_constructAndConvert
typelib_static_type_init
uno_any_destruct
uno_type_copyAndConvertData
uno_type_sequence_destroy
typelib_typedescriptionreference_new
uno_getMapping
typelib_static_type_getByTypeClass
typelib_typedescription_release
typelib_typedescription_newInterfaceMethod
typelib_typedescriptionreference_release
uno_any_assign
typelib_typedescription_new
typelib_static_sequence_type_init
uno_getEnvironment
uno_any_construct
uno_type_sequence_construct
typelib_typedescription_register
typelib_typedescription_newMIInterface
cppu_unsatisfied_iquery_msg
typelib_typedescription_acquire

cppuhelper3msc

?WeakImplHelper_query@cppu@@YA?AVAny@uno@star@sun@com@@AEBVType@3456@PEAUclass_data@1@PEAXPEAVOWeakObject@1@@Z
?throwException@cppu@@YAXAEBVAny@uno@star@sun@com@@@Z
?WeakImplHelper_getTypes@cppu@@YA?AV?$Sequence@VType@uno@star@sun@com@@@uno@star@sun@com@@PEAUclass_data@1@@Z
?queryAdapter@OWeakObject@cppu@@UEAA?AV?$Reference@VXAdapter@uno@star@sun@com@@@uno@star@sun@com@@XZ
?release@OWeakObject@cppu@@UEAAXXZ
?acquire@OWeakObject@cppu@@UEAAXXZ
??1OWeakObject@cppu@@MEAA@XZ
?supportsService@cppu@@YA_NPEAVXServiceInfo@lang@star@sun@com@@AEBVOUString@rtl@@@Z
?getCaughtException@cppu@@YA?AVAny@uno@star@sun@com@@XZ
??1OWeakAggObject@cppu@@MEAA@XZ
?queryAggregation@OWeakAggObject@cppu@@UEAA?AVAny@uno@star@sun@com@@AEBVType@4567@@Z
?setDelegator@OWeakAggObject@cppu@@UEAAXAEBV?$Reference@VXInterface@uno@star@sun@com@@@uno@star@sun@com@@@Z
?queryInterface@OWeakAggObject@cppu@@UEAA?AVAny@uno@star@sun@com@@AEBVType@4567@@Z
?release@OWeakAggObject@cppu@@UEAAXXZ
?acquire@OWeakAggObject@cppu@@UEAAXXZ
??0OWeakAggObject@cppu@@QEAA@XZ
??0OWeakObject@cppu@@QEAA@XZ
??3OWeakObject@cppu@@SAXPEAX@Z
??2OWeakObject@cppu@@SAPEAX_K@Z

sal3

osl_releaseMutex
osl_getGlobalMutex
rtl_freeMemory
rtl_uString_ensureCapacity
sal_detail_logFormat
rtl_uString_release
rtl_uString_newConcatAsciiL
rtl_uString_acquire
osl_acquireMutex
rtl_ustr_valueOfUInt64
rtl_convertStringToUString
rtl_uString_new
rtl_allocateMemory
rtl_uString_newFromLiteral

msvcp140

?_Getdays@_Locinfo@std@@QEBAPEBDXZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getmonths@_Locinfo@std@@QEBAPEBDXZ
_Mbrtowc

kernel32

UnhandledExceptionFilter
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetProcAddress
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
DeleteCriticalSection

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception
__std_terminate
__std_exception_copy
__current_exception_context
__C_specific_handler
memcpy
memset
_CxxThrowException
__std_type_info_destroy_list
__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
calloc

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initialize_onexit_table
_crt_atexit
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
terminate
_crt_at_quick_exit
_cexit
_execute_onexit_table
_initialize_narrow_environment

Exports

Exports

stoc_FactoryImpl_get_implementation

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75b57052b1f29d941e76dfab5f8aa9f9

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1dCertificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

ae:b2:84:81:fe:ec:9b:6d:f8:df:ae:a8:3b:47:7b:9e:bb:36:b9:ec:7f:ef:8c:7d:e0:5b:1d:6d:34:ec:76:e2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

cppu3

cppuhelper3msc

sal3

msvcp140

kernel32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 31KB - Virtual size: 31KB

.rdata Size: 18KB - Virtual size: 18KB

.data Size: 1KB - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 200B

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

ae:b2:84:81:fe:ec:9b:6d:f8:df:ae:a8:3b:47:7b:9e:bb:36:b9:ec:7f:ef:8c:7d:e0:5b:1d:6d:34:ec:76:e2
Signer

.text
Size: 31KB - Virtual size: 31KB

.rdata
Size: 18KB - Virtual size: 18KB

.data
Size: 1KB - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 200B