e75572c06a4fdf8e928d8eb014b23db0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

e75572c06a4fdf8e928d8eb014b23db0N.exe
Size

402KB
MD5

e75572c06a4fdf8e928d8eb014b23db0
SHA1

d2e3b7b4d444340aa6d9447e64df62ca1b943a54
SHA256

da72732639533d54e226a276c51a5071f369009bbaff298fd09ae9c989f6e07f
SHA512

110e39d3ffdf540fdd4e816b3df99e6c5d760fd99c1681b8e50b46e777d25689b21cf18603e189b27057bd10c237bc2987a99cdd6c3f967aa283d6c29aa9a4af
SSDEEP

12288:zrHaP2pmuxq99HT8N4ypfhetx2pyLVhQBafob:BmuQkXpotcpIhGb

Score

1^/10

Malware Config

Signatures

Files

e75572c06a4fdf8e928d8eb014b23db0N.exe
.dll windows:6 windows x64 arch:x64

7e14441ac65db2b6564b58f094a32514

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19-05-2021 05:32

Not After

18-05-2036 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

14-09-2023 12:18

Not After

13-09-2026 12:18

Subject

CN=The Document Foundation,OU=LibreOffice Build Team,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02-11-2023 08:32

Not After

30-10-2034 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19-05-2021 05:32

Not After

18-05-2036 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31-05-2021 06:43

Not After

17-09-2029 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

eb:c8:e3:5b:cb:27:38:00:8f:0a:a4:88:39:23:8d:d7:f4:ec:d3:fc:f3:fc:94:15:ba:44:31:23:05:bb:fb:d1
Signer

Actual PE Digest

eb:c8:e3:5b:cb:27:38:00:8f:0a:a4:88:39:23:8d:d7:f4:ec:d3:fc:f3:fc:94:15:ba:44:31:23:05:bb:fb:d1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\r\workdir\LinkTarget\Library\propertyhdl.pdb

Imports

kernel32

GetSystemDefaultLCID
GetModuleHandleExW
GetShortPathNameW
MultiByteToWideChar
GetLastError
WideCharToMultiByte
LocalFree
FormatMessageA
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetSystemTimeAsFileTime
RtlCaptureContext

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

ole32

PropVariantClear

oleaut32

SysAllocString

propsys

PSCoerceToCanonicalValue
PSCreateMemoryPropertyStore

user32

LoadStringW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_destroy_list
__std_exception_copy
memset
__current_exception_context
__current_exception
memcmp
memcpy
_CxxThrowException
__C_specific_handler
memmove
_purecall
__std_exception_destroy
__std_terminate

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_initterm
_cexit
_errno
terminate
_seh_filter_dll
_crt_at_quick_exit
_execute_onexit_table
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fclose
fread
__stdio_common_vfprintf
_wfsopen
ftell
fseek

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-heap-l1-1-0

realloc
_callnewh
malloc
free

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-utility-l1-1-0

rand_s

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 258KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e14441ac65db2b6564b58f094a32514

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1dCertificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

eb:c8:e3:5b:cb:27:38:00:8f:0a:a4:88:39:23:8d:d7:f4:ec:d3:fc:f3:fc:94:15:ba:44:31:23:05:bb:fb:d1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcp140

ole32

oleaut32

propsys

user32

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 258KB - Virtual size: 257KB

.rdata Size: 112KB - Virtual size: 112KB

.data Size: 1KB - Virtual size: 5KB

.pdata Size: 16KB - Virtual size: 15KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

eb:c8:e3:5b:cb:27:38:00:8f:0a:a4:88:39:23:8d:d7:f4:ec:d3:fc:f3:fc:94:15:ba:44:31:23:05:bb:fb:d1
Signer

.text
Size: 258KB - Virtual size: 257KB

.rdata
Size: 112KB - Virtual size: 112KB

.data
Size: 1KB - Virtual size: 5KB

.pdata
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB