4c5e320e73ebe15bcbe7c1febecc1850N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

4c5e320e73ebe15bcbe7c1febecc1850N.exe
Size

428KB
MD5

4c5e320e73ebe15bcbe7c1febecc1850
SHA1

0c22a4e336ae3505efb069ad51e4488bcb24807a
SHA256

7eb18e3cea3007b0bb663eb3fb634b2f92d54c8f67e22c5b36ce6b392acfeb0c
SHA512

9596cbecd1190afb214761f5a33c9aeafdf1ff2f4cc697d28aa174d89c8d6f39c2d0d7488def2c3ce49fe769863ff8278968313d6b42ed6c56225845bf740b7c
SSDEEP

6144:hthyhH5PJmqEGvA9sIaSQ9N7QapILn8m+KpPE4:PsXPJmqEGaT5oI7pD

Score

1^/10

Malware Config

Signatures

Files

4c5e320e73ebe15bcbe7c1febecc1850N.exe
.dll windows:6 windows x64 arch:x64

e059fffe1f5dabf44ce45d42910843fd

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19-05-2021 05:32

Not After

18-05-2036 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

14-09-2023 12:18

Not After

13-09-2026 12:18

Subject

CN=The Document Foundation,OU=LibreOffice Build Team,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02-11-2023 08:32

Not After

30-10-2034 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19-05-2021 05:32

Not After

18-05-2036 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31-05-2021 06:43

Not After

17-09-2029 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

31:07:95:1e:57:1e:54:2c:1f:fa:ed:80:21:90:0e:25:b9:83:1e:d9:05:2a:b0:4b:19:a2:48:1d:59:57:95:9a
Signer

Actual PE Digest

31:07:95:1e:57:1e:54:2c:1f:fa:ed:80:21:90:0e:25:b9:83:1e:d9:05:2a:b0:4b:19:a2:48:1d:59:57:95:9a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\r\workdir\LinkTarget\Library\UAccCOM.pdb

Imports

cppu3

typelib_typedescriptionreference_newByAsciiName
typelib_typedescriptionreference_release
uno_type_assignData
uno_type_sequence_construct
typelib_typedescription_release
uno_type_any_assign
uno_type_sequence_assign
uno_any_construct
uno_type_sequence_reference2One
typelib_typedescription_newEnum
uno_type_any_construct
typelib_static_type_getByTypeClass
typelib_static_type_init
typelib_typedescriptionreference_new
typelib_typedescription_register
typelib_static_sequence_type_init
uno_type_sequence_destroy
uno_any_destruct
typelib_typedescription_newStruct

mergedlo

?getProductName@ConfigManager@utl@@SA?AVOUString@rtl@@XZ
?GetSolarMutex@Application@@SAAEAVSolarMutex@comphelper@@XZ
?release@SolarMutex@comphelper@@QEAAK_N@Z
?acquire@SolarMutex@comphelper@@QEAAXK@Z
?getProductVersion@ConfigManager@utl@@SA?AVOUString@rtl@@XZ
?GetIAccessible2TextAttributes@AccessibleTextAttributeHelper@@SA?AVOUString@rtl@@V?$Reference@VXAccessibleText@accessibility@star@sun@com@@@uno@star@sun@com@@W4IA2AttributeType@@JAEAJ2@Z
?GetkeyBindingStrByXkeyBinding@comphelper@@YA?AVOUString@rtl@@AEBV?$Sequence@UKeyStroke@awt@star@sun@com@@@uno@star@sun@com@@@Z

sal3

rtl_ustr_toBoolean
rtl_uString_newFromLiteral
rtl_allocateMemory
rtl_freeMemory
rtl_ustr_indexOfChar_WithLength
rtl_uString_getToken
rtl_uString_acquire
rtl_ustr_indexOfAscii_WithLength
rtl_uString_newFromStr
rtl_uString_newFromSubString
sal_detail_log
sal_detail_log_report
rtl_uString_newConcat
rtl_uString_alloc
rtl_uString_release
rtl_ustr_toFloat
rtl_ustr_toInt32
rtl_uString_assign
rtl_uString_new

advapi32

RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExA
RegSetValueExA

kernel32

IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CloseHandle
lstrcmpiA
WideCharToMultiByte
QueryPerformanceCounter
GetProcAddress
LoadResource
IsDBCSLeadByte
DisableThreadLibraryCalls
GetModuleHandleA
FindResourceA
EncodePointer
LoadLibraryExA
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
DeleteCriticalSection
GetCurrentProcessId
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
GetStartupInfoW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
OutputDebugStringW
FreeLibrary
SizeofResource

ole32

CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc

oleacc

AccessibleObjectFromWindow

oleaut32

VarUI4FromStr
SysFreeString
VariantInit
VariantClear
LoadRegTypeLi
SysAllocString
SysStringLen
LoadTypeLi

user32

UnregisterClassA
CharNextA

msvcp140

?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?good@ios_base@std@@QEBA_NXZ
?rdstate@ios_base@std@@QEBAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Xlength_error@std@@YAXPEBD@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?flags@ios_base@std@@QEBAHXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?uncaught_exceptions@std@@YAHXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getdays@_Locinfo@std@@QEBAPEBDXZ
?_Getmonths@_Locinfo@std@@QEBAPEBDXZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_purecall
strstr
memmove
memset
__current_exception
__current_exception_context
_CxxThrowException
__std_type_info_destroy_list
__RTDynamicCast
memcmp
__std_terminate

api-ms-win-crt-heap-l1-1-0

_callnewh
calloc
free
_recalloc
malloc

api-ms-win-crt-runtime-l1-1-0

abort
_resetstkoflw
_invalid_parameter_noinfo
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_execute_onexit_table
_initialize_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_invalid_parameter_noinfo_noreturn
_errno
_initterm_e
_initterm
_register_onexit_function

api-ms-win-crt-string-l1-1-0

strncpy_s

Exports

Exports

?UAccCOMCreateInstance@@YAPEAUIMAccessible@@XZ
DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e059fffe1f5dabf44ce45d42910843fd

Code Sign

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1dCertificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

31:07:95:1e:57:1e:54:2c:1f:fa:ed:80:21:90:0e:25:b9:83:1e:d9:05:2a:b0:4b:19:a2:48:1d:59:57:95:9aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

cppu3

mergedlo

sal3

advapi32

kernel32

ole32

oleacc

oleaut32

user32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 222KB - Virtual size: 221KB

.rdata Size: 139KB - Virtual size: 138KB

.data Size: 8KB - Virtual size: 10KB

.pdata Size: 21KB - Virtual size: 21KB

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 3KB - Virtual size: 2KB

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

5f:fb:e1:bc:42:2d:8b:c2:da:b2:b3:79:d6:4b:ea:1d
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

31:07:95:1e:57:1e:54:2c:1f:fa:ed:80:21:90:0e:25:b9:83:1e:d9:05:2a:b0:4b:19:a2:48:1d:59:57:95:9a
Signer

.text
Size: 222KB - Virtual size: 221KB

.rdata
Size: 139KB - Virtual size: 138KB

.data
Size: 8KB - Virtual size: 10KB

.pdata
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 3KB - Virtual size: 2KB