9ea8f98414200162b43494c1e92f9fc0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

9ea8f98414200162b43494c1e92f9fc0N.exe
Size

119KB
MD5

9ea8f98414200162b43494c1e92f9fc0
SHA1

6c247dc9a4ea4b6961f8ceedfb2bae6dadcec189
SHA256

59539e40c8965b1dceb8eb2f086d5a1412f0da5111a4f5b92f359c058c34adde
SHA512

4c357d7ee9fbb692788ec48eb2ff907c47507d58fb5293035100494342e89af0b760474f182a3c645b6d081bd28592e48c50771693827fdef409d8d7fa26744a
SSDEEP

3072:GN8bqy6tp3/wtrj+LYBYSm3MPGeLZMO6hjhFI1fSJT:68bJ6PPCjvYSqe2O6BgOT

Score

1^/10

Malware Config

Signatures

Files

9ea8f98414200162b43494c1e92f9fc0N.exe
.dll windows:6 windows x64 arch:x64

a085147544f33ddadc1de8a21790871f

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

14/09/2023, 12:18

Not After

13/09/2026, 12:18

Subject

CN=The Document Foundation,OU=LibreOffice Build Team,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

94:6f:4f:a0:ea:c4:01:53:94:ab:68:b0:64:17:a2:43:43:c6:c3:ae:09:ae:75:10:37:46:3d:77:5c:52:0e:89
Signer

Actual PE Digest

94:6f:4f:a0:ea:c4:01:53:94:ab:68:b0:64:17:a2:43:43:c6:c3:ae:09:ae:75:10:37:46:3d:77:5c:52:0e:89

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\r\workdir\LinkTarget\Library\scnlo.pdb

Imports

cppu3

typelib_static_type_init
uno_any_destruct
uno_type_sequence_destroy
typelib_typedescriptionreference_new
typelib_static_type_getByTypeClass
typelib_typedescription_newInterfaceMethod
uno_type_assignData
typelib_typedescriptionreference_release
typelib_typedescription_new
typelib_static_sequence_type_init
typelib_typedescription_register
typelib_typedescription_newMIInterface
typelib_typedescription_release
uno_type_sequence_construct
uno_type_sequence_reference2One

cppuhelper3msc

?WeakImplHelper_query@cppu@@YA?AVAny@uno@star@sun@com@@AEBVType@3456@PEAUclass_data@1@PEAXPEAVOWeakObject@1@@Z
?WeakImplHelper_getTypes@cppu@@YA?AV?$Sequence@VType@uno@star@sun@com@@@uno@star@sun@com@@PEAUclass_data@1@@Z
?queryAdapter@OWeakObject@cppu@@UEAA?AV?$Reference@VXAdapter@uno@star@sun@com@@@uno@star@sun@com@@XZ
?release@OWeakObject@cppu@@UEAAXXZ
?acquire@OWeakObject@cppu@@UEAAXXZ
??1OWeakObject@cppu@@MEAA@XZ
?supportsService@cppu@@YA_NPEAVXServiceInfo@lang@star@sun@com@@AEBVOUString@rtl@@@Z
??BOWeakObject@cppu@@QEAA?AV?$Reference@VXInterface@uno@star@sun@com@@@uno@star@sun@com@@XZ
??3OWeakObject@cppu@@SAXPEAX@Z
??2OWeakObject@cppu@@SAPEAX_K@Z
??0OWeakObject@cppu@@QEAA@XZ

mergedlo

?Reschedule@Application@@SA_N_N@Z
?PostUserEvent@Application@@SAPEAUImplSVEvent@@AEBV?$Link@PEAXX@@PEAX_N@Z
?getProcessComponentContext@comphelper@@YA?AV?$Reference@VXComponentContext@uno@star@sun@com@@@uno@star@sun@com@@XZ
??0SvMemoryStream@@QEAA@PEAX_KW4StreamMode@@@Z
?GetData@SvMemoryStream@@MEAA_KPEAX_K@Z
?release@VclReferenceBase@@QEBAXXZ
?SeekPos@SvMemoryStream@@MEAA_K_K@Z
?SetSize@SvMemoryStream@@MEAAX_K@Z
?FlushData@SvMemoryStream@@MEAAXXZ
??1SvMemoryStream@@UEAA@XZ
?ResetError@SvMemoryStream@@UEAAXXZ
?IncModalCount@Window@vcl@@QEAAXXZ
?DecModalCount@Window@vcl@@QEAAXXZ
?WriteUInt32@SvStream@@QEAAAEAV1@K@Z
?WriteChar@SvStream@@QEAAAEAV1@D@Z
?get@NamedValueCollection@comphelper@@QEBAAEBVAny@uno@star@sun@com@@AEBVOUString@rtl@@@Z
?has@NamedValueCollection@comphelper@@QEBA_NAEBVOUString@rtl@@@Z
??1NamedValueCollection@comphelper@@QEAA@XZ
??0NamedValueCollection@comphelper@@QEAA@AEBV?$Sequence@VAny@uno@star@sun@com@@@uno@star@sun@com@@@Z
?GetWindow@VCLUnoHelper@@SAPEAVWindow@vcl@@AEBV?$Reference@VXWindow@awt@star@sun@com@@@uno@star@sun@com@@@Z
?acquire@VclReferenceBase@@QEBAXXZ
?TellEnd@SvMemoryStream@@UEAA_KXZ
?PutData@SvMemoryStream@@MEAA_KPEBX_K@Z

sal3

osl_releaseMutex
osl_destroyMutex
osl_getGlobalMutex
rtl_freeMemory
rtl_uString_newFromLiteral
rtl_allocateMemory
osl_createMutex
rtl_uString_new
osl_acquireMutex
rtl_uString_release
rtl_string_release
rtl_uString_alloc
sal_detail_log
osl_terminateThread
rtl_string2UString
rtl_ustr_asciil_reverseEquals_WithLength
osl_joinWithThread
osl_setCondition
rtl_uString2String
rtl_uString_ensureCapacity
osl_createCondition
rtl_convertStringToUString
osl_suspendThread
sal_detail_log_report
rtl_ustr_valueOfUInt64
rtl_uString_acquire
rtl_bootstrap_expandMacros
osl_resetCondition
osl_getSystemPathFromFileURL
osl_resumeThread
osl_scheduleThread
rtl_uString_newConcatAsciiL
osl_waitCondition
osl_checkCondition
osl_destroyCondition

salhelper3msc

?onTerminated@Thread@salhelper@@EEAAXXZ
?run@Thread@salhelper@@EEAAXXZ
??1Thread@salhelper@@MEAA@XZ
?launch@Thread@salhelper@@QEAAXXZ
??0Thread@salhelper@@QEAA@PEBD@Z
??3Thread@salhelper@@SAXPEAX@Z
??2Thread@salhelper@@SAPEAX_K@Z
?release@SimpleReferenceObject@salhelper@@QEAAXXZ
?acquire@SimpleReferenceObject@salhelper@@QEAAXXZ

user32

PostMessageW
MsgWaitForMultipleObjects
PeekMessageW

msvcp140

?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?_Xlength_error@std@@YAXPEBD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?uncaught_exceptions@std@@YAHXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getdays@_Locinfo@std@@QEBAPEBDXZ
?_Getmonths@_Locinfo@std@@QEBAPEBDXZ
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?rdstate@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?setf@ios_base@std@@QEAAHH@Z
?setf@ios_base@std@@QEAAHHH@Z
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ

kernel32

SetUnhandledExceptionFilter
UnmapViewOfFile
DuplicateHandle
GetLastError
GetCurrentThread
CloseHandle
CreateProcessW
MapViewOfFile
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception
memmove
__std_exception_destroy
__std_terminate
__std_exception_copy
__C_specific_handler
__current_exception_context
_CxxThrowException
__std_type_info_destroy_list
memcpy
memset

api-ms-win-crt-heap-l1-1-0

calloc
_callnewh
malloc
free

api-ms-win-crt-runtime-l1-1-0

_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm
_initterm_e
terminate
_invalid_parameter_noinfo_noreturn
abort
_cexit

Exports

Exports

extensions_ScannerManager_get_implementation

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a085147544f33ddadc1de8a21790871f

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1dCertificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

94:6f:4f:a0:ea:c4:01:53:94:ab:68:b0:64:17:a2:43:43:c6:c3:ae:09:ae:75:10:37:46:3d:77:5c:52:0e:89Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

cppu3

cppuhelper3msc

mergedlo

sal3

salhelper3msc

user32

msvcp140

kernel32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 61KB - Virtual size: 61KB

.rdata Size: 35KB - Virtual size: 34KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 6KB - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 344B

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

94:6f:4f:a0:ea:c4:01:53:94:ab:68:b0:64:17:a2:43:43:c6:c3:ae:09:ae:75:10:37:46:3d:77:5c:52:0e:89
Signer

.text
Size: 61KB - Virtual size: 61KB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 344B