69ac2ccdcf34abd1b62b4dcd3ba155038d7b8e0adde935f348a498623ef7b594

Sharing

Copy URL Twitter E-mail

General

Target

69ac2ccdcf34abd1b62b4dcd3ba155038d7b8e0adde935f348a498623ef7b594
Size

3.6MB
MD5

22d6fe0e2cbd722881284c5049dfa6b6
SHA1

d53aca85d77d6425f5fcb1d1728a9fa9f963ae64
SHA256

69ac2ccdcf34abd1b62b4dcd3ba155038d7b8e0adde935f348a498623ef7b594
SHA512

f9d3ee0249c7653434271232e7425e31cd439536606958c4195f92366e452ba9b798353774a1cad29abbf5876e59794922d5e334982c3ab57a440266741f2424
SSDEEP

98304:sCf9JvCbdJIkhc9CM323si+bCgq4vO3bvtrH6tIQA22SUU:vfvCbd6k3MG8i95azA2

Score

1^/10

Malware Config

Signatures

Files

69ac2ccdcf34abd1b62b4dcd3ba155038d7b8e0adde935f348a498623ef7b594
.dll windows:6 windows x64 arch:x64

98377b3a11e85c9f5df631cbe3f35489

Code Sign

33:00:00:00:e7:1a:a6:e3:0b:5e:b4:0a:54:00:00:00:00:00:e7
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/02/2023, 22:33

Not After

31/01/2024, 22:33

Subject

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/05/2013, 20:44

Not After

01/05/2028, 20:54

Subject

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:10

Not After

31/01/2024, 20:10

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3e:64:56:92:6e:62:bc:6d:72:f8:97:f3:79:a7:98:ee:b0:75:54:45:36:4e:72:c9:62:db:de:18:68:2c:61:dd
Signer

Actual PE Digest

3e:64:56:92:6e:62:bc:6d:72:f8:97:f3:79:a7:98:ee:b0:75:54:45:36:4e:72:c9:62:db:de:18:68:2c:61:dd

Digest Algorithm

sha256

PE Digest Matches

false

3e:64:56:92:6e:62:bc:6d:72:f8:97:f3:79:a7:98:ee:b0:75:54:45:36:4e:72:c9:62:db:de:18:68:2c:61:dd
Signer

Actual PE Digest

3e:64:56:92:6e:62:bc:6d:72:f8:97:f3:79:a7:98:ee:b0:75:54:45:36:4e:72:c9:62:db:de:18:68:2c:61:dd

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

Exports

Exports

AddApplicationToExceptionListW
RemoveApplicationFromExceptionListW

Sections

.text
Size: - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.$Mz
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.a1:
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.;7R
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98377b3a11e85c9f5df631cbe3f35489

Code Sign

33:00:00:00:e7:1a:a6:e3:0b:5e:b4:0a:54:00:00:00:00:00:e7Certificate

Extended Key Usages

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14Certificate

Key Usages

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

3e:64:56:92:6e:62:bc:6d:72:f8:97:f3:79:a7:98:ee:b0:75:54:45:36:4e:72:c9:62:db:de:18:68:2c:61:ddSigner

3e:64:56:92:6e:62:bc:6d:72:f8:97:f3:79:a7:98:ee:b0:75:54:45:36:4e:72:c9:62:db:de:18:68:2c:61:ddSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: - Virtual size: 70KB

.rdata Size: - Virtual size: 40KB

.data Size: - Virtual size: 7KB

.pdata Size: - Virtual size: 4KB

_RDATA Size: - Virtual size: 500B

.$Mz Size: - Virtual size: 2.0MB

.a1: Size: 2KB - Virtual size: 2KB

.;7R Size: 3.5MB - Virtual size: 3.5MB

.reloc Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

33:00:00:00:e7:1a:a6:e3:0b:5e:b4:0a:54:00:00:00:00:00:e7
Certificate

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Certificate

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

3e:64:56:92:6e:62:bc:6d:72:f8:97:f3:79:a7:98:ee:b0:75:54:45:36:4e:72:c9:62:db:de:18:68:2c:61:dd
Signer

3e:64:56:92:6e:62:bc:6d:72:f8:97:f3:79:a7:98:ee:b0:75:54:45:36:4e:72:c9:62:db:de:18:68:2c:61:dd
Signer

.text
Size: - Virtual size: 70KB

.rdata
Size: - Virtual size: 40KB

.data
Size: - Virtual size: 7KB

.pdata
Size: - Virtual size: 4KB

_RDATA
Size: - Virtual size: 500B

.$Mz
Size: - Virtual size: 2.0MB

.a1:
Size: 2KB - Virtual size: 2KB

.;7R
Size: 3.5MB - Virtual size: 3.5MB

.reloc
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB