046af5428a3ddfeb10a94b5494df21dedd2937df148f2711b2484b4d7ae79951

Sharing

Copy URL Twitter E-mail

General

Target

046af5428a3ddfeb10a94b5494df21dedd2937df148f2711b2484b4d7ae79951
Size

233KB
MD5

5066471f310b198468ccd1614a35aff7
SHA1

07b8af7f7afb9e1a52328ec808a279c3cf1d36ed
SHA256

046af5428a3ddfeb10a94b5494df21dedd2937df148f2711b2484b4d7ae79951
SHA512

4be2ea442360e72d2e0048935a876cc193ab42cc53a4ffbe283e151bd49893e85381a7edc4a07baba466625382ba2f007ac9088e58fbdb7ebbd6df742a42d47a
SSDEEP

3072:T8SbKulac1R31hOgCpe4b6JCcZKZdBNTaE0B+VUEztSad15fhVdxhjFSKIo:Q+KV0JfOgCp4Yb/m/+UErdXhj3jF7

Score

1^/10

Malware Config

Signatures

Files

046af5428a3ddfeb10a94b5494df21dedd2937df148f2711b2484b4d7ae79951
.dll windows:5 windows x86 arch:x86

8b20260c5a3faa708bce08853b7f65cc

Code Sign

6d:13:5e:34:79:aa:13:49:e7:53:ba:ab:9a:47:87:3d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09/07/2020, 00:00

Not After

08/07/2021, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f0:a5:1e:19:66:36:33:cd:65:3a:ce:85:4f:e9:2d:ba:02:7c:f9:2a
Signer

Actual PE Digest

f0:a5:1e:19:66:36:33:cd:65:3a:ce:85:4f:e9:2d:ba:02:7c:f9:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

comctl32

InitCommonControlsEx

wininet

InternetQueryOptionA
InternetSetStatusCallback
InternetGetLastResponseInfoA
DeleteUrlCacheEntry

ws2_32

gethostbyname
inet_addr
WSACleanup
WSAStartup
inet_ntoa
gethostbyaddr

kernel32

GetFileSize
GetLastError
IsBadReadPtr
CreateMutexA
SetEndOfFile
WriteFile
GetLocalTime
GetCurrentProcessId
SetFileAttributesA
GetFileAttributesA
GetWindowsDirectoryA
GetSystemDirectoryA
GlobalFree
GetModuleFileNameA
VirtualProtect
GetProcAddress
GetModuleHandleA
CreateDirectoryA
WaitForMultipleObjects
CreateThread
FreeLibrary
LoadLibraryA
GetTickCount
CopyFileA
MoveFileExA
DeleteFileA
FlushFileBuffers
lstrcatA
OpenMutexA
lstrcmpA
TerminateThread
WaitForSingleObject
GetExitCodeThread
GetCurrentProcess
GetCurrentDirectoryA
GetDiskFreeSpaceExA
GetSystemPowerStatus
GetLocaleInfoA
lstrcmpiA
GetSystemInfo
GetVersionExA
GetFileType
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
SetFileTime
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetStdHandle
ExitProcess
HeapSize
Sleep
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
SetLastError
UnmapViewOfFile
SetFilePointer
CreateFileA
ReadFile
CloseHandle
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
lstrcpyA
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GlobalMemoryStatusEx
HeapFree
RtlUnwind
HeapAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCommandLineA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW

user32

GetSystemMetrics
FindWindowA
FindWindowExA
SendMessageA
DialogBoxParamA
LoadImageA
GetWindowRect
SystemParametersInfoA
SetWindowPos
EndDialog
BeginPaint
EndPaint
SetTimer
EnableWindow
ShowWindow
KillTimer
GetDlgItemTextA
GetDlgItem
PostMessageA
wsprintfA
SetDlgItemTextA
SetDlgItemTextW
SetWindowTextW

gdi32

BitBlt
SetBkColor
SetTextColor
CreateCompatibleDC
SelectObject
GetObjectA
CreateBitmap

advapi32

CryptCreateHash
CryptEncrypt
RegOpenKeyExA
CryptAcquireContextA
CryptReleaseContext
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CryptDeriveKey
CryptDecrypt
CryptImportKey
CryptDestroyKey
CryptHashData
CryptVerifySignatureA
CryptDestroyHash
CryptGetHashParam

netapi32

NetWkstaGetInfo
NetApiBufferFree

Sections

.text
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8b20260c5a3faa708bce08853b7f65cc

Code Sign

6d:13:5e:34:79:aa:13:49:e7:53:ba:ab:9a:47:87:3dCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

f0:a5:1e:19:66:36:33:cd:65:3a:ce:85:4f:e9:2d:ba:02:7c:f9:2aSigner

Headers

File Characteristics

Imports

version

comctl32

wininet

ws2_32

kernel32

user32

gdi32

advapi32

netapi32

Sections

.text Size: 157KB - Virtual size: 157KB

.rdata Size: 22KB - Virtual size: 21KB

.data Size: 25KB - Virtual size: 41KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 13KB - Virtual size: 12KB

6d:13:5e:34:79:aa:13:49:e7:53:ba:ab:9a:47:87:3d
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

f0:a5:1e:19:66:36:33:cd:65:3a:ce:85:4f:e9:2d:ba:02:7c:f9:2a
Signer

.text
Size: 157KB - Virtual size: 157KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 25KB - Virtual size: 41KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 13KB - Virtual size: 12KB