cb516a62737d2185bd5dde19e77044d45e9713653e8e819befeb7b9ce53d36ef[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

cb516a62737d2185bd5dde19e77044d45e9713653e8e819befeb7b9ce53d36ef.exe
Size

3.3MB
MD5

45353492ec7f02bcbf629df7da26855e
SHA1

52b706e1310df9533df7aa4d3744ec25eb539f6c
SHA256

cb516a62737d2185bd5dde19e77044d45e9713653e8e819befeb7b9ce53d36ef
SHA512

076a9ec51f405f2d3cfc2ec167b9645975026b382c16116d41f3efa551022158c02bb36f102e14dc6eda25ab2ff8a66e9ff0d2415e7ec03a71b932f929173a97
SSDEEP

49152:j2cPplo3PKqGUGQlDUm5xDx7Ffnxl/T81VBZxs7seNe5IaAtp9b+PekBMct:aWlEPVxseNmi+Pe6

Score

1^/10

Malware Config

Signatures

Files

cb516a62737d2185bd5dde19e77044d45e9713653e8e819befeb7b9ce53d36ef.exe
.exe windows:6 windows x64 arch:x64

90c7b5cb1ceedf6818d462eac519fe2f

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:1f:0b:bc:82:f3:ac:fa:b6:52:fd:7c:cd:5c:48:e1
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11/05/2023, 00:00

Not After

12/05/2026, 23:59

Subject

SERIALNUMBER=I033405,CN=Infocus LLC,O=Infocus LLC,L=Madison,ST=Wisconsin,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1309576973636f6e73696e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8b:d7:10:80:7d:88:70:49:87:7c:de:f3:c3:03:d9:aa:d8:02:a6:96
Signer

Actual PE Digest

8b:d7:10:80:7d:88:70:49:87:7c:de:f3:c3:03:d9:aa:d8:02:a6:96

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Exclusions\earlybird-rs-master\target\release\deps\earlybird_rs.pdb

Imports

ntdll

RtlVirtualUnwind
RtlGetVersion
NtQuerySystemInformation
RtlCaptureContext
NtCreateFile
RtlLookupFunctionEntry
RtlNtStatusToDosError
NtQueryInformationProcess
NtDeviceIoControlFile
NtCancelIoFileEx

kernel32

GetCurrentProcessId
SetHandleInformation
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
VirtualFree
SetFileCompletionNotificationModes
GetLastError
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
OpenProcess
HeapAlloc
GetProcessHeap
InitializeProcThreadAttributeList
CloseHandle
SleepConditionVariableSRW
AcquireSRWLockShared
HeapFree
FlushInstructionCache
LoadLibraryA
GetProcAddress
FreeLibrary
WaitForSingleObject
WriteConsoleW
FormatMessageW
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
CreateThread
GetCurrentProcess
GetTickCount64
GlobalMemoryStatusEx
GetLogicalDrives
GetDiskFreeSpaceExW
GetProcessTimes
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
LocalFree
GetSystemTimes
GetProcessIoCounters
IsProcessorFeaturePresent
VirtualQueryEx
ReadProcessMemory
CreateFileW
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleW
GetConsoleMode
GetSystemInfo
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
GetFinalPathNameByHandleW
ReleaseMutex
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
Sleep
GetCurrentThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetStdHandle
QueryPerformanceCounter
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceFrequency
HeapReAlloc
WaitForSingleObjectEx
CreateMutexA
GetModuleHandleA

user32

MessageBoxA

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
IsValidSid
GetLengthSid
CopySid
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetKernelObjectSecurity
LookupAccountSidW
OpenProcessToken
GetTokenInformation

ole32

CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoInitializeSecurity
CoInitializeEx

iphlpapi

GetIfTable2
FreeMibTable
GetIfEntry2
GetAdaptersAddresses
CreateIpForwardEntry

ws2_32

WSASocketW
getpeername
getsockname
recv
connect
WSASend
setsockopt
WSAIoctl
WSAGetLastError
bind
closesocket
ioctlsocket
getsockopt
send
shutdown
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo

secur32

LsaFreeReturnBuffer
LsaEnumerateLogonSessions
FreeContextBuffer
EncryptMessage
AcceptSecurityContext
DecryptMessage
ApplyControlToken
DeleteSecurityContext
LsaGetLogonSessionData
QueryContextAttributesW
FreeCredentialsHandle
AcquireCredentialsHandleA
InitializeSecurityContextW

crypt32

CertDuplicateCertificateChain
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertAddCertificateContextToStore
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertOpenStore
CertCloseStore
CertDuplicateStore
CertGetCertificateChain
CertFreeCertificateContext

oleaut32

SysStringLen
SysAllocStringLen
SafeArrayUnaccessData
GetErrorInfo
SysFreeString
VariantClear
SysAllocString
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound

pdh

PdhRemoveCounter
PdhAddEnglishCounterW
PdhOpenQueryA
PdhCloseQuery
PdhGetFormattedCounterValue
PdhCollectQueryData

powrprof

CallNtPowerInformation

shell32

CommandLineToArgvW

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo
NetUserGetLocalGroups

bcrypt

BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider

psapi

GetPerformanceInfo
GetModuleFileNameExW

vcruntime140

memset
__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
memcmp
memmove
memcpy
__CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

__setusermatherr
atan
tan

api-ms-win-crt-string-l1-1-0

strlen
wcslen

api-ms-win-crt-heap-l1-1-0

realloc
_set_new_mode
free

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_crt_atexit
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
terminate
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_c_exit
__p___argc
__p___argv
_cexit

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90c7b5cb1ceedf6818d462eac519fe2f

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:1f:0b:bc:82:f3:ac:fa:b6:52:fd:7c:cd:5c:48:e1Certificate

Extended Key Usages

Key Usages

8b:d7:10:80:7d:88:70:49:87:7c:de:f3:c3:03:d9:aa:d8:02:a6:96Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

kernel32

user32

advapi32

ole32

iphlpapi

ws2_32

secur32

crypt32

oleaut32

pdh

powrprof

shell32

netapi32

bcrypt

psapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 12KB - Virtual size: 12KB

.pdata Size: 130KB - Virtual size: 130KB

.rsrc Size: 1024B - Virtual size: 536B

.reloc Size: 19KB - Virtual size: 19KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:1f:0b:bc:82:f3:ac:fa:b6:52:fd:7c:cd:5c:48:e1
Certificate

8b:d7:10:80:7d:88:70:49:87:7c:de:f3:c3:03:d9:aa:d8:02:a6:96
Signer

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 12KB - Virtual size: 12KB

.pdata
Size: 130KB - Virtual size: 130KB

.rsrc
Size: 1024B - Virtual size: 536B

.reloc
Size: 19KB - Virtual size: 19KB