4cf6b80616f70cf42913f337bc20f6d0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

4cf6b80616f70cf42913f337bc20f6d0N.exe
Size

196KB
MD5

4cf6b80616f70cf42913f337bc20f6d0
SHA1

2c1826af86ba447cce850b7b9a15c5330cd01e74
SHA256

f36e201eeaf0fe039d3871805915067d7f1f9fc2fa833f6fba432528a6055e28
SHA512

7287ce4c5447382274fa4d94319bad471816a1a10d7df0e1a0cf6a5e68b350d7271e1356ce2dde91393ebb52a6adbc2b4d6dcda5acc3c5882d6235c82c6304e4
SSDEEP

6144:XFHARigoFO6tbkik6kfN7U/S/rsg7R4nJ:w6O69s7PsZJ

Score

1^/10

Malware Config

Signatures

Files

4cf6b80616f70cf42913f337bc20f6d0N.exe
.dll windows:6 windows x64 arch:x64

e2299fb793baa04788dc50bd3fab8b6d

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32 UTC

Not After

18/05/2036, 05:32 UTC

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

14/09/2023, 12:18 UTC

Not After

13/09/2026, 12:18 UTC

Subject

CN=The Document Foundation,OU=LibreOffice Build Team,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32 UTC

Not After

30/10/2034, 08:32 UTC

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32 UTC

Not After

18/05/2036, 05:32 UTC

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43 UTC

Not After

17/09/2029, 06:43 UTC

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:d1:3b:6b:fb:f2:c9:05:5b:03:e2:b7:d4:69:c5:8b:e4:14:e3:01:96:36:8f:27:f8:ad:19:c6:f8:81:ba:ec
Signer

Actual PE Digest

63:d1:3b:6b:fb:f2:c9:05:5b:03:e2:b7:d4:69:c5:8b:e4:14:e3:01:96:36:8f:27:f8:ad:19:c6:f8:81:ba:ec

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\r\workdir\LinkTarget\Library\loglo.pdb

Imports

cppu3

uno_type_any_assign
uno_type_sequence_reference2One
cppu_unsatisfied_iquery_msg
cppu_unsatisfied_iset_msg
uno_type_sequence_assign
uno_type_sequence_construct
typelib_typedescription_release
uno_type_any_construct
typelib_static_sequence_type_init
typelib_typedescription_new
typelib_typedescriptionreference_release
uno_type_assignData
typelib_typedescription_newInterfaceMethod
typelib_static_type_getByTypeClass
typelib_typedescriptionreference_new
uno_type_sequence_destroy
uno_any_destruct
typelib_static_type_init
typelib_typedescription_register
typelib_typedescription_newMIInterface

cppuhelper3msc

?removeEventListener@WeakComponentImplHelperBase@cppu@@UEAAXAEBV?$Reference@VXEventListener@lang@star@sun@com@@@uno@star@sun@com@@@Z
?addEventListener@WeakComponentImplHelperBase@cppu@@UEAAXAEBV?$Reference@VXEventListener@lang@star@sun@com@@@uno@star@sun@com@@@Z
?dispose@WeakComponentImplHelperBase@cppu@@UEAAXXZ
?release@WeakComponentImplHelperBase@cppu@@UEAAXXZ
?acquire@WeakComponentImplHelperBase@cppu@@UEAAXXZ
??1WeakComponentImplHelperBase@cppu@@UEAA@XZ
??0WeakComponentImplHelperBase@cppu@@IEAA@AEAVMutex@osl@@@Z
?queryAdapter@OWeakObject@cppu@@UEAA?AV?$Reference@VXAdapter@uno@star@sun@com@@@uno@star@sun@com@@XZ
?supportsService@cppu@@YA_NPEAVXServiceInfo@lang@star@sun@com@@AEBVOUString@rtl@@@Z
??3WeakComponentImplHelperBase@cppu@@SAXPEAX@Z
??2WeakComponentImplHelperBase@cppu@@SAPEAX_K@Z
??BOWeakObject@cppu@@QEAA?AV?$Reference@VXInterface@uno@star@sun@com@@@uno@star@sun@com@@XZ
?WeakImplHelper_query@cppu@@YA?AVAny@uno@star@sun@com@@AEBVType@3456@PEAUclass_data@1@PEAXPEAVOWeakObject@1@@Z
?WeakImplHelper_getTypes@cppu@@YA?AV?$Sequence@VType@uno@star@sun@com@@@uno@star@sun@com@@PEAUclass_data@1@@Z
?release@OWeakObject@cppu@@UEAAXXZ
?WeakComponentImplHelper_getTypes@cppu@@YA?AV?$Sequence@VType@uno@star@sun@com@@@uno@star@sun@com@@PEAUclass_data@1@@Z
?acquire@OWeakObject@cppu@@UEAAXXZ
??1OWeakObject@cppu@@MEAA@XZ
??0OWeakObject@cppu@@QEAA@XZ
??3OWeakObject@cppu@@SAXPEAX@Z
??2OWeakObject@cppu@@SAPEAX_K@Z
?get@WeakReferenceHelper@uno@star@sun@com@@QEBA?AV?$Reference@VXInterface@uno@star@sun@com@@@2345@XZ
??4WeakReferenceHelper@uno@star@sun@com@@QEAAAEAV01234@AEBV?$Reference@VXInterface@uno@star@sun@com@@@1234@@Z
??1WeakReferenceHelper@uno@star@sun@com@@QEAA@XZ
??0WeakReferenceHelper@uno@star@sun@com@@QEAA@XZ
?WeakComponentImplHelper_query@cppu@@YA?AVAny@uno@star@sun@com@@AEBVType@3456@PEAUclass_data@1@PEAXPEAVWeakComponentImplHelperBase@1@@Z

mergedlo

?get_ensureType@NamedValueCollection@comphelper@@AEBA_NAEBVOUString@rtl@@PEAXAEBVType@uno@star@sun@com@@@Z
??0NamedValueCollection@comphelper@@QEAA@AEBV?$Sequence@UNamedValue@beans@star@sun@com@@@uno@star@sun@com@@@Z
??1NamedValueCollection@comphelper@@QEAA@XZ
?removeInterface@OInterfaceContainerHelper2@comphelper@@QEAAJAEBV?$Reference@VXInterface@uno@star@sun@com@@@uno@star@sun@com@@@Z
?getLength@OInterfaceContainerHelper2@comphelper@@QEBAJXZ
??1OInterfaceContainerHelper2@comphelper@@QEAA@XZ
??0OInterfaceContainerHelper2@comphelper@@QEAA@AEAVMutex@osl@@@Z
?remove@OInterfaceIteratorHelper2@comphelper@@QEAAXXZ
?next@OInterfaceIteratorHelper2@comphelper@@QEAAPEAVXInterface@uno@star@sun@com@@XZ
??1OInterfaceIteratorHelper2@comphelper@@QEAA@XZ
??0OInterfaceIteratorHelper2@comphelper@@QEAA@AEAVOInterfaceContainerHelper2@1@@Z
?hasMoreElements@OInterfaceIteratorHelper2@comphelper@@QEBA_NXZ
?addInterface@OInterfaceContainerHelper2@comphelper@@QEAAJAEBV?$Reference@VXInterface@uno@star@sun@com@@@uno@star@sun@com@@@Z

sal3

rtl_uString_newFromLiteral
rtl_freeMemory
rtl_ustr_valueOfInt64
rtl_allocateMemory
osl_releaseMutex
rtl_string_new
rtl_string_release
rtl_uString_ensureCapacity
osl_createMutex
rtl_uString_new
rtl_convertStringToUString
rtl_ustr_valueOfUInt64
osl_acquireMutex
rtl_uString_acquire
rtl_uString_newConcatAsciiL
rtl_uString_release
rtl_uString_new_WithLength
sal_detail_logFormat
rtl_uStringbuffer_insert_ascii
rtl_str_getLength
rtl_uStringBuffer_makeStringAndClear
osl_destroyMutex
rtl_uStringbuffer_ensureCapacity
rtl_uStringbuffer_insert
rtl_uString_assign
rtl_uString_alloc
osl_getDirectoryItem
osl_writeFile
osl_syncFile
osl_getFileStatus
osl_openFile
osl_getThreadTextEncoding
osl_getThreadIdentifier
rtl_getMimeCharsetFromTextEncoding
rtl_uString2String
rtl_getTextEncodingFromMimeCharset
osl_getDateTimeFromTimeValue
osl_getProcessInfo
rtl_ustr_indexOfStr_WithLength
rtl_uString_newFromStr_WithLength
osl_getSystemTime
rtl_uString_newReplaceStrAtUtf16L
rtl_ustr_asciil_reverseEquals_WithLength
rtl_uString_newFromAscii
rtl_ustr_compare_WithLength
osl_releaseDirectoryItem
osl_getGlobalMutex
osl_removeFile
osl_closeFile

msvcp140

?_Getmonths@_Locinfo@std@@QEBAPEBDXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getdays@_Locinfo@std@@QEBAPEBDXZ
_Mbrtowc
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_Xbad_alloc@std@@YAXXZ

kernel32

GetModuleHandleW
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetCurrentProcess
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy
__std_exception_copy
__std_terminate
__current_exception
__current_exception_context
__C_specific_handler
memset
_CxxThrowException
__std_type_info_destroy_list
memcpy

api-ms-win-crt-heap-l1-1-0

malloc
calloc
_callnewh
free

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vsprintf
fflush
__stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_crt_atexit
_cexit
terminate
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_at_quick_exit

Exports

Exports

com_sun_star_comp_extensions_ConsoleHandler
com_sun_star_comp_extensions_CsvFormatter
com_sun_star_comp_extensions_FileHandler
com_sun_star_comp_extensions_LoggerPool
com_sun_star_comp_extensions_PlainTextFormatter
com_sun_star_comp_extensions_SimpleTextFormatter

Sections

.text
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2299fb793baa04788dc50bd3fab8b6d

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1dCertificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

63:d1:3b:6b:fb:f2:c9:05:5b:03:e2:b7:d4:69:c5:8b:e4:14:e3:01:96:36:8f:27:f8:ad:19:c6:f8:81:ba:ecSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

cppu3

cppuhelper3msc

mergedlo

sal3

msvcp140

kernel32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 119KB - Virtual size: 119KB

.rdata Size: 46KB - Virtual size: 46KB

.data Size: 3KB - Virtual size: 5KB

.pdata Size: 13KB - Virtual size: 12KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 660B

We care about your privacy.

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

63:d1:3b:6b:fb:f2:c9:05:5b:03:e2:b7:d4:69:c5:8b:e4:14:e3:01:96:36:8f:27:f8:ad:19:c6:f8:81:ba:ec
Signer

.text
Size: 119KB - Virtual size: 119KB

.rdata
Size: 46KB - Virtual size: 46KB

.data
Size: 3KB - Virtual size: 5KB

.pdata
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 660B