8e00b07a041f9685804d8e8abd210a40N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8e00b07a041f9685804d8e8abd210a40N.exe
Size

398KB
MD5

8e00b07a041f9685804d8e8abd210a40
SHA1

e14fe4ba06d81233ee4819e258ab2ba6bb23684a
SHA256

afc62d022f72279c4609d3a90473166a048b5a19371d1bb0942eca58bd5f9cdb
SHA512

89ae8149c02ef30399d263ba0a38124b636d35df4f89e3265eec248a1560d1899ea02a01f7eaeb80fa0ad5f12a5083f5b75b41850479341bd33097db855265be
SSDEEP

12288:0dGN6c/S84mB5iDdgKbg9HTO24Q1UAt73pKHhPy+TAkJP2u5hg:B6UOmDiq0HE1JtTpUh12u5hg

Score

1^/10

Malware Config

Signatures

Files

8e00b07a041f9685804d8e8abd210a40N.exe
.dll regsvr32 windows:6 windows x64 arch:x64

5b43cd13dbda3f830e640d5830882695

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

14/09/2023, 12:18

Not After

13/09/2026, 12:18

Subject

CN=The Document Foundation,OU=LibreOffice Build Team,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f1:c2:dc:c3:4c:26:39:bf:3b:bf:bc:39:27:80:4a:87:39:0c:e2:80:9e:c1:7c:6a:90:4e:95:e9:1f:4c:fc:52
Signer

Actual PE Digest

f1:c2:dc:c3:4c:26:39:bf:3b:bf:bc:39:27:80:4a:87:39:0c:e2:80:9e:c1:7c:6a:90:4e:95:e9:1f:4c:fc:52

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\r\workdir\LinkTarget\Library\ooofilt.pdb

Imports

kernel32

GetSystemDefaultLCID
DisableThreadLibraryCalls
GetModuleHandleExW
GetShortPathNameW
MultiByteToWideChar
GetLastError
WideCharToMultiByte
LocalFree
FormatMessageA
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InitializeSListHead
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
GetStartupInfoW
GetModuleHandleW
RtlCaptureContext
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

ole32

CoTaskMemAlloc
CoTaskMemFree

user32

LoadStringW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_purecall
__std_exception_copy
__current_exception
__C_specific_handler
__current_exception_context
memcmp
memcpy
__std_type_info_destroy_list
memset
_CxxThrowException
__std_exception_destroy
__std_terminate
memmove

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initterm_e
terminate
_crt_at_quick_exit
_initterm
_cexit
_errno
_register_onexit_function
_crt_atexit
_seh_filter_dll
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

_stricmp
_wcsicmp

api-ms-win-crt-stdio-l1-1-0

_wfsopen
ftell
fclose
__acrt_iob_func
fseek
fread
__stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

malloc
realloc
free
_callnewh

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-utility-l1-1-0

rand_s

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b43cd13dbda3f830e640d5830882695

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1dCertificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

f1:c2:dc:c3:4c:26:39:bf:3b:bf:bc:39:27:80:4a:87:39:0c:e2:80:9e:c1:7c:6a:90:4e:95:e9:1f:4c:fc:52Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcp140

ole32

user32

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 285KB - Virtual size: 285KB

.rdata Size: 77KB - Virtual size: 77KB

.data Size: 1KB - Virtual size: 6KB

.pdata Size: 19KB - Virtual size: 18KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

f1:c2:dc:c3:4c:26:39:bf:3b:bf:bc:39:27:80:4a:87:39:0c:e2:80:9e:c1:7c:6a:90:4e:95:e9:1f:4c:fc:52
Signer

.text
Size: 285KB - Virtual size: 285KB

.rdata
Size: 77KB - Virtual size: 77KB

.data
Size: 1KB - Virtual size: 6KB

.pdata
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB