c11d8efea24ef5e0187ea4772b78f27718f4e4bf5703e7d1e19cb5c05831e8da

Sharing

Copy URL Twitter E-mail

General

Target
c11d8efea24ef5e0187ea4772b78f27718f4e4bf5703e7d1e19cb5c05831e8da
Size 158KB
Sample240904-d3ra2sthpm
SHA256 c11d8efea24ef5e0187ea4772b78f27718f4e4bf5703e7d1e19cb5c05831e8da
MD5 bfb04923ffaa54eca910757d6af896a3
SHA1 a4860b5b94055adb75da6990ac7348d39275d427
SHA512 800817560c9d330b89a351d8fb0305260ed9488957187cce0b3e85a5741d98b591c972311ad26267b4ec776e4aad1a5f1996e7898812a501f1fdef1f13ba95c6
SSDEEP 3072:0liAjhU676gWoJpxVpecbiya82lQBV+UdE+rECWp7hKDYmk9B:0oyh9SoXBecbiQBV+UdvrEFp7hKDe9B
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

c11d8efea24ef5e0187ea4772b78f27718f4e4bf5703e7d1e19cb5c05831e8da

.dll 158KB

c11d8efea24ef5e0187ea4772b78f27718f4e4bf5703e7d1e19cb5c05831e8da

IMPHASH b06d4116da69a513992d529f84731e6f
SHA256 c11d8efea24ef5e0187ea4772b78f27718f4e4bf5703e7d1e19cb5c05831e8da
MD5 bfb04923ffaa54eca910757d6af896a3
SHA1 a4860b5b94055adb75da6990ac7348d39275d427
SHA512 800817560c9d330b89a351d8fb0305260ed9488957187cce0b3e85a5741d98b591c972311ad26267b4ec776e4aad1a5f1996e7898812a501f1fdef1f13ba95c6
SSDEEP 3072:0liAjhU676gWoJpxVpecbiya82lQBV+UdE+rECWp7hKDYmk9B:0oyh9SoXBecbiQBV+UdvrEFp7hKDe9B
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

67:0f:f2:85:26:5d:99:0b:ca:e8:97:12:dc:0a:f8:62:30:06:53:e7:ba:c2:0b:4d:fc:4c:62:e5:17:bb:c8:6f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 22, 2024

PE Signature issue

Digest

de:9c:e8:10:85:d3:46:28:70:dc:cd:65:bb:fe:17:b8:dc:69:59:2b

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 22, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:12BC-E3AE-74EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:47:14:a2:40:f8:97:fe:ea:8e:00:00:00:00:01:47

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 13, 2019 - Feb 11, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2020 - Mar 3, 2021

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2020 - Mar 3, 2021

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

Major OS version

Entry point

58688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\agent\_work\9\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb

_CreateFrameInfo _CxxThrowException _EH_prolog _FindAndUnlinkFrame _IsExceptionObjectToBeDestroyed _NLG_Dispatch2 _NLG_Return _NLG_Return2 _SetWinRTOutOfMemoryExceptionCallback __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch __current_exception __current_exception_context __intrinsic_setjmp __processing_throw __report_gsfailure __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __telemetry_main_invoke_trigger __telemetry_main_return_trigger __unDName __unDNameEx __uncaught_exception __uncaught_exceptions __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_InitializeCriticalSectionEx __vcrt_LoadLibraryExW _chkesp _except_handler2 _except_handler3 _except_handler4_common _get_purecall_handler _get_unexpected _global_unwind2 _is_exception_typeof _local_unwind2 _local_unwind4 _longjmpex _purecall _seh_longjmp_unwind _seh_longjmp_unwind4 _set_purecall_handler _set_se_translator _setjmp3 longjmp memchr memcmp memcpy memmove memset set_unexpected strchr strrchr strstr unexpected wcschr wcsrchr wcsstr

c11d8efea24ef5e0187ea4772b78f27718f4e4bf5703e7d1e19cb5c05831e8da

PE Signature issue

PE Signature issue

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

kernel32

generic