879d678dc5068c5414f94916dfbf3250N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

879d678dc5068c5414f94916dfbf3250N.exe
Size

38KB
MD5

879d678dc5068c5414f94916dfbf3250
SHA1

657fc6d1336cb688f1824b980c72b162a784625c
SHA256

e6fdbd847bc5913e2f04e541673083d59481f6fa9753a5174c8919d7ad4b7d20
SHA512

356a9da82483dd7ee09ce98a1b8f02bc5c6afd0cfe14b4fcdfa226191a45f49fcd81d55f88770764346bdd6887aaa3f4fba7e9ffacb9f01eef2b8927d627068f
SSDEEP

768:zw82a1y6CH51N2xW6qglo2ndEjYifiRBE3GVki:yPbUxW6qgG2yj7fiDWGVki

Score

1^/10

Malware Config

Signatures

Files

879d678dc5068c5414f94916dfbf3250N.exe
.dll windows:5 windows x86 arch:x86

515e10d0de008aca38a06a736a1c3a58

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

07:24:f7:05:7e:bd:89:37:53:8f:74:55:92:b8:ec:d4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

28/06/2021, 00:00

Not After

10/07/2024, 23:59

Subject

CN=北京网御星云信息技术有限公司,O=北京网御星云信息技术有限公司,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:ee:45:4d:aa:89:d0:25:d1:84:61:47:ed:1d:65:39:a7:b9:1e:15
Signer

Actual PE Digest

65:ee:45:4d:aa:89:d0:25:d1:84:61:47:ed:1d:65:39:a7:b9:1e:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\vpn-new\strongswan-5.8.0\IpsecCtrl\Release\IpsecCtrl.pdb

Imports

kernel32

FreeLibrary
GetModuleHandleW
SetCurrentDirectoryA
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetCurrentThreadId
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
GetSystemTimeAsFileTime

msvcr100

_malloc_crt
_encoded_null
_initterm
_errno
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
strerror
strstr
sprintf
malloc
free
vfprintf
strrchr
fprintf
printf
strtok
strncpy
atoi
strchr
__iob_func
_initterm_e
_getpid
memcpy
memset

Exports

Exports

daemon_deinit
daemon_init
ipsec_set_dbg_config
ipsec_set_global_config
register_recvpacket_cb
register_sendpacket_cb
register_tunnel_status_cb
sendpacket
tunnel_set_config
tunnel_start_all
tunnel_start_by_name
tunnel_stop_all
tunnel_stop_by_name

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

515e10d0de008aca38a06a736a1c3a58

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

07:24:f7:05:7e:bd:89:37:53:8f:74:55:92:b8:ec:d4Certificate

Extended Key Usages

Key Usages

65:ee:45:4d:aa:89:d0:25:d1:84:61:47:ed:1d:65:39:a7:b9:1e:15Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcr100

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 20KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 2KB - Virtual size: 1KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

07:24:f7:05:7e:bd:89:37:53:8f:74:55:92:b8:ec:d4
Certificate

65:ee:45:4d:aa:89:d0:25:d1:84:61:47:ed:1d:65:39:a7:b9:1e:15
Signer

.text
Size: 21KB - Virtual size: 20KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 2KB - Virtual size: 1KB