0542a1e11f67253f7a993361a744a8e0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0542a1e11f67253f7a993361a744a8e0N.exe
Size

76KB
MD5

0542a1e11f67253f7a993361a744a8e0
SHA1

9da27cb49d5b8202352abfae07e78c0038f005de
SHA256

07df136fdd82293228f83d0b33df1c28cf58b3febb3bcf815fd656a1a31b2a4f
SHA512

8472d14486b898899f15f1eab5cb26fc0fb43614dc9c351881a9e03ba3ca21a425fa5b00165c369d0242dd268418116bbc3e6d72b1523eb2a3aad646fcb6259f
SSDEEP

1536:ZtuJsLf9ka0gS6AC6HTKcOpSF4T0m/cnFU1L7SS:ZfBkavZf6HTmSWTfknFU1fSS

Score

1^/10

Malware Config

Signatures

Files

0542a1e11f67253f7a993361a744a8e0N.exe
.exe windows:6 windows x64 arch:x64

d678bec59e839aa0fdfa3dc637dfc55f

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

14/09/2023, 12:18

Not After

13/09/2026, 12:18

Subject

CN=The Document Foundation,OU=LibreOffice Build Team,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:0d:2f:e9:7a:8b:7f:25:c2:2b:7f:60:42:9c:6d:dc:99:1d:b3:32:63:10:b2:ec:21:72:2c:0a:ba:6f:ad:ae
Signer

Actual PE Digest

39:0d:2f:e9:7a:8b:7f:25:c2:2b:7f:60:42:9c:6d:dc:99:1d:b3:32:63:10:b2:ec:21:72:2c:0a:ba:6f:ad:ae

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\r\workdir\LinkTarget\Executable\mar.pdb

Imports

crypt32

CryptImportPublicKeyInfo
CryptQueryObject
CertFreeCertificateContext

nspr4

PR_Close
PR_GetSpecialFD
PR_fprintf
PR_Open
PR_Read
PR_Assert

nss3

PK11_ProtectedAuthenticationPath
PORT_Free
PORT_ZAlloc
SGN_Update
PK11_SetPasswordFunc
SGN_End
PK11_GetTokenName
BTOA_DataToAscii
SECKEY_DestroyPrivateKey
PK11_FindCertFromNickname
CERT_DestroyCertificate
ATOB_AsciiToData
SGN_Begin
SECITEM_FreeItem
NSS_Shutdown
PORT_Strdup
SGN_DestroyContext
NSS_Initialize
SGN_NewContext
PK11_SignatureLen
PK11_FindKeyByAnyCert

advapi32

CryptHashData
CryptDestroyKey
CryptAcquireContextA
CryptCreateHash
CryptVerifySignatureA

ws2_32

htonl
ntohl

kernel32

QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess

vcruntime140

__current_exception_context
strrchr
__std_type_info_destroy_list
__std_terminate
__C_specific_handler
memset
memcpy
__current_exception

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

_ftelli64
fread
_fseeki64
fwrite
__stdio_common_vsprintf
feof
ferror
_fileno
_wfopen_s
fgets
_isatty
fgetc
rewind
ftell
__stdio_common_vfprintf
fseek
fclose
fflush
_open
fopen
_set_fmode
__p__commode
__acrt_iob_func

api-ms-win-crt-string-l1-1-0

strncmp
strcmp
_strdup

api-ms-win-crt-filesystem-l1-1-0

remove
_chdir
_stat64i32
_mkdir

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_set_app_type
_initialize_onexit_table
_register_onexit_function
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_execute_onexit_table
__p___argc
_seh_filter_exe
_exit
exit
_initterm_e
_configure_narrow_argv
_crt_atexit
_initialize_narrow_environment
_initterm
_crt_at_quick_exit
_get_initial_narrow_environment
__p___argv
perror
terminate
_wperror

api-ms-win-crt-math-l1-1-0

__setusermatherr
_fdopen

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

PL_strdup
PL_strfree
PL_strlen
PL_strndup
PL_strnlen

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d678bec59e839aa0fdfa3dc637dfc55f

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1dCertificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

39:0d:2f:e9:7a:8b:7f:25:c2:2b:7f:60:42:9c:6d:dc:99:1d:b3:32:63:10:b2:ec:21:72:2c:0a:ba:6f:ad:aeSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

nspr4

nss3

advapi32

ws2_32

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 42KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 52B

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

39:0d:2f:e9:7a:8b:7f:25:c2:2b:7f:60:42:9c:6d:dc:99:1d:b3:32:63:10:b2:ec:21:72:2c:0a:ba:6f:ad:ae
Signer

.text
Size: 43KB - Virtual size: 42KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 52B