5009983e0c60a4b7e8eef37ec3243320N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5009983e0c60a4b7e8eef37ec3243320N.exe
Size

364KB
MD5

5009983e0c60a4b7e8eef37ec3243320
SHA1

da10974a2293aa8058ce8855c9a51708b5ff8fc5
SHA256

33eb277478673779798f65b963adb01534a0619fbc256bff293ad025798331e0
SHA512

393256e51eff268dcc7530eb1986eb5a632549ff3b50d4d9f9a9f0160637092485bf25e4f50b300bef473fe077bc7392d1522de67e89f12a114ab773688cb184
SSDEEP

6144:iL2qFS72RMtbtn+Gj0rM6us0pr3hKz4jluj1IsGXQP5:iKqFS7Mebtvdh1lC1IsGY5

Score

1^/10

Malware Config

Signatures

Files

5009983e0c60a4b7e8eef37ec3243320N.exe
.dll windows:4 windows x86 arch:x86

90e1a4143f27ee32245c3878d629b62f

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:28:de:b1:e0:8c:35:ba:d4:52:8a:f5:64:4e:27:5e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/05/2023, 00:00

Not After

08/05/2026, 23:59

Subject

CN=Zhejiang Dahua Technology Co.\, Ltd.,O=Zhejiang Dahua Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:28:de:b1:e0:8c:35:ba:d4:52:8a:f5:64:4e:27:5e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/05/2023, 00:00

Not After

08/05/2026, 23:59

Subject

CN=Zhejiang Dahua Technology Co.\, Ltd.,O=Zhejiang Dahua Technology Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:18:bd:4d:c2:d5:15:21:a2:ab:0f:57:08:8e:05:3a:33:2d:c8:97:63:96:33:48:47:6b:a3:f7:db:d6:a6:72
Signer

Actual PE Digest

52:18:bd:4d:c2:d5:15:21:a2:ab:0f:57:08:8e:05:3a:33:2d:c8:97:63:96:33:48:47:6b:a3:f7:db:d6:a6:72

Digest Algorithm

sha256

PE Digest Matches

true

ea:8b:ba:30:b2:57:59:63:45:08:e6:6d:c0:3d:45:d3:68:b4:9f:68
Signer

Actual PE Digest

ea:8b:ba:30:b2:57:59:63:45:08:e6:6d:c0:3d:45:d3:68:b4:9f:68

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAddAtomA
GetLocaleInfoA
GetCPInfo
GetOEMCP
HeapAlloc
HeapReAlloc
GetTimeFormatA
GetDateFormatA
VirtualAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCommandLineA
GetProcessHeap
RtlUnwind
RaiseException
HeapSize
ExitProcess
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
GlobalFindAtomA
IsValidCodePage
Sleep
GetTimeZoneInformation
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GlobalDeleteAtom
GetVersionExA
GetFileTime
GetFileAttributesA
FileTimeToLocalFileTime
lstrcmpW
InterlockedIncrement
GlobalGetAtomNameA
GetCurrentProcessId
GlobalFlags
SetErrorMode
GetCurrentThreadId
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
EnterCriticalSection
LocalUnlock
LocalLock
MoveFileExA
TlsGetValue
LeaveCriticalSection
LocalAlloc
FreeLibrary
InterlockedDecrement
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
CreateFileA
GetModuleFileNameA
GetFullPathNameA
GetVolumeInformationA
GetSystemDirectoryA
CreateFileW
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
CloseHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
LoadLibraryA
lstrcmpA
GlobalReAlloc
SetLastError
GlobalFree
GlobalAlloc
FormatMessageA
LocalFree
FileTimeToSystemTime
GetThreadLocale
GlobalLock
GlobalUnlock
DeleteFileA
CopyFileA
MultiByteToWideChar
GetLastError
InterlockedExchange
CompareStringW
FindResourceA
WideCharToMultiByte
CompareStringA
lstrlenA
GetVersion
LoadResource
LockResource
GetACP
SizeofResource

user32

DefWindowProcA
CallWindowProcA
SystemParametersInfoA
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
LoadCursorA
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
SetWindowPos
SetWindowLongA
GetClassInfoExA
GetDlgItem
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
MessageBoxA
GetFocus
GetParent
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassInfoA
GetWindowLongA
GetClassNameA
PtInRect
CreateWindowExA
PostMessageA
GetMenu
GetClientRect
CopyRect
AdjustWindowRectEx
RegisterClassA
IsWindow
SetWindowTextA
UnregisterClassA
SetWindowsHookExA
CallNextHookEx
DispatchMessageA
SetForegroundWindow
MapWindowPoints
GetMessagePos
GetMessageTime
DestroyWindow
GetTopWindow
GetForegroundWindow
RemovePropA
GetPropA
SetPropA
GetClassLongA
GetCapture
WinHelpA
LoadIconA
RegisterWindowMessageA
DestroyMenu
PostQuitMessage
SendMessageA
GetKeyState
PeekMessageA
ValidateRect
UnhookWindowsHookEx
GetSystemMetrics
GetDesktopWindow
EnableWindow
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowTextA
CharUpperA
IsIconic
wsprintfA

gdi32

ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
CreateBitmap
GetStockObject
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
DeleteObject

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

comdlg32

GetFileTitleA

ole32

CLSIDFromString
CoCreateInstance
OleUninitialize
OleInitialize
OleRun
CLSIDFromProgID

oleaut32

SysFreeString
SysStringLen
SysAllocStringLen
SafeArrayGetElement
VariantChangeType
VariantInit
VariantClear
SafeArrayDestroy
SafeArrayCreate
VariantTimeToSystemTime
SafeArrayPutElement
SysAllocString

odbc32

ord17
ord41
ord10
ord2
ord1
ord5
ord51
ord50
ord45
ord44
ord68
ord43
ord59
ord13
ord18
ord46
ord12
ord19
ord11
ord49
ord48
ord8
ord20
ord16
ord61
ord3
ord14
ord9
ord15

shlwapi

PathFindExtensionA
PathFindFileNameA
PathIsUNCA
PathStripToRootA

oleacc

CreateStdAccessibleObject
LresultFromObject

Exports

Exports

CheckModule
ClearModule
FileOperation_Check_Write
FileOperation_CloseAllExcel
FileOperation_CloseExcel
FileOperation_CreateExcel
FileOperation_OpenExcel
FileOperation_Read
FileOperation_ReadExcel
FileOperation_SaveExcel
FileOperation_Write
FileOperation_WriteExcel
InitModule
LoadImplObjects

Sections

.text
Size: 248KB - Virtual size: 245KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90e1a4143f27ee32245c3878d629b62f

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

01:28:de:b1:e0:8c:35:ba:d4:52:8a:f5:64:4e:27:5eCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

01:28:de:b1:e0:8c:35:ba:d4:52:8a:f5:64:4e:27:5eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

52:18:bd:4d:c2:d5:15:21:a2:ab:0f:57:08:8e:05:3a:33:2d:c8:97:63:96:33:48:47:6b:a3:f7:db:d6:a6:72Signer

ea:8b:ba:30:b2:57:59:63:45:08:e6:6d:c0:3d:45:d3:68:b4:9f:68Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

ole32

oleaut32

odbc32

shlwapi

oleacc

Exports

Exports

Sections

.text Size: 248KB - Virtual size: 245KB

.rdata Size: 48KB - Virtual size: 45KB

.data Size: 12KB - Virtual size: 23KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 28KB - Virtual size: 24KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

01:28:de:b1:e0:8c:35:ba:d4:52:8a:f5:64:4e:27:5e
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

01:28:de:b1:e0:8c:35:ba:d4:52:8a:f5:64:4e:27:5e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

52:18:bd:4d:c2:d5:15:21:a2:ab:0f:57:08:8e:05:3a:33:2d:c8:97:63:96:33:48:47:6b:a3:f7:db:d6:a6:72
Signer

ea:8b:ba:30:b2:57:59:63:45:08:e6:6d:c0:3d:45:d3:68:b4:9f:68
Signer

.text
Size: 248KB - Virtual size: 245KB

.rdata
Size: 48KB - Virtual size: 45KB

.data
Size: 12KB - Virtual size: 23KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 28KB - Virtual size: 24KB