6b597a1f6c21be32fc2f126fbb8dd38e0a9c22b70f7819299cb4fea46711caef

Sharing

Copy URL Twitter E-mail

General

Target

6b597a1f6c21be32fc2f126fbb8dd38e0a9c22b70f7819299cb4fea46711caef
Size

381KB
MD5

c38d3abfe8d7a51b0bb6e4b7103596b7
SHA1

9d1ed03e72f4d376738070a3f8c33e417423ffa4
SHA256

6b597a1f6c21be32fc2f126fbb8dd38e0a9c22b70f7819299cb4fea46711caef
SHA512

91eb311168cfd35c9677c36a9b4dfd5e2249a797221227d8f0fba720c47a605b7908731b7b7f677485e7990571b6762903d9d7a388968224d640783a442b9956
SSDEEP

6144:AD2lSRh73JyI2i3HQGwMd0ajSU/poodt2bb30TD6ZS3PohwabBaCelxuXMy4XrBX:EbTgcHQSWajXtdtxo0lxOM/BH3

Score

1^/10

Malware Config

Signatures

Files

6b597a1f6c21be32fc2f126fbb8dd38e0a9c22b70f7819299cb4fea46711caef
.dll windows:6 windows x64 arch:x64

757dd57d9c4051eae198380265a6f481

Code Sign

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:26

Not After

15/08/2023, 20:36

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

56:00:00:01:75:73:76:cd:78:ad:00:0c:9a:00:00:00:00:01:75
Certificate

Issuer

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Not Before

08/11/2016, 10:13

Not After

08/11/2018, 10:13

Subject

CN=Intel(R) Embedded Subsystems and IP Blocks Group,OU=EIG,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/10/2015, 00:00

Not After

17/06/2021, 23:59

Subject

CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:f2:90:06:ae:84:39:0e:cf:57:5e:29:fa:c4:e9:98:0b:0c:43:28
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

10/11/2017, 21:37

Not After

10/11/2018, 21:37

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:78F7-C430-508C,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2017, 19:18

Not After

01/11/2018, 19:18

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:21:a3:d3:e3:0e:30:ec:5e:f3:f6:10:57:4a:92:fa:4f:37:0a:ff:97:fb:08:f1:25:94:1f:29:9d:f2:2e:f8
Signer

Actual PE Digest

4e:21:a3:d3:e3:0e:30:ec:5e:f3:f6:10:57:4a:92:fa:4f:37:0a:ff:97:fb:08:f1:25:94:1f:29:9d:f2:2e:f8

Digest Algorithm

sha256

PE Digest Matches

true

4e:21:a3:d3:e3:0e:30:ec:5e:f3:f6:10:57:4a:92:fa:4f:37:0a:ff:97:fb:08:f1:25:94:1f:29:9d:f2:2e:f8
Signer

Actual PE Digest

4e:21:a3:d3:e3:0e:30:ec:5e:f3:f6:10:57:4a:92:fa:4f:37:0a:ff:97:fb:08:f1:25:94:1f:29:9d:f2:2e:f8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\buildagent_prod\p4\1326309967\services\DAL\Src\VisualStudio\bin\x64\Universal_Release\bhPluginV2.pdb

Imports

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
SetEvent
ResetEvent
CreateEventW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
CreateMutexA
CreateEventA
EnterCriticalSection

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-2

ExitProcess
GetCurrentThreadId
GetCurrentProcessId
TlsFree
CreateThread
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
TlsGetValue
TlsAlloc
GetStartupInfoW
TlsSetValue

api-ms-win-core-file-l1-2-1

ReadFile
GetFileType
CreateFileW
WriteFile
SetEndOfFile
SetFilePointerEx
FlushFileBuffers
FindNextFileA
FindClose
FindFirstFileExA

api-ms-win-core-errorhandling-l1-1-1

SetLastError
SetUnhandledExceptionFilter
GetLastError
RaiseException
UnhandledExceptionFilter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime

teetransport

TEE_Transport_Create

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-localization-l1-2-1

EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
IsValidCodePage
LCMapStringW
GetCPInfo
GetOEMCP
GetACP

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-rtlsupport-l1-2-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader
RtlUnwindEx

api-ms-win-core-interlocked-l1-2-0

InterlockedFlushSList
InitializeSListHead

api-ms-win-core-heap-l1-2-0

HeapReAlloc
HeapAlloc
HeapSize
GetProcessHeap
HeapFree

api-ms-win-core-processenvironment-l1-2-0

GetCommandLineA
GetStdHandle
SetStdHandle
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW

api-ms-win-core-console-l1-1-0

WriteConsoleW
ReadConsoleW
GetConsoleMode
GetConsoleCP

Exports

Exports

pluginRegister

Sections

.text
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

757dd57d9c4051eae198380265a6f481

Code Sign

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35Certificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

56:00:00:01:75:73:76:cd:78:ad:00:0c:9a:00:00:00:00:01:75Certificate

Extended Key Usages

Key Usages

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3Certificate

Extended Key Usages

Key Usages

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bfCertificate

Key Usages

75:f2:90:06:ae:84:39:0e:cf:57:5e:29:fa:c4:e9:98:0b:0c:43:28Certificate

Extended Key Usages

Key Usages

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

4e:21:a3:d3:e3:0e:30:ec:5e:f3:f6:10:57:4a:92:fa:4f:37:0a:ff:97:fb:08:f1:25:94:1f:29:9d:f2:2e:f8Signer

4e:21:a3:d3:e3:0e:30:ec:5e:f3:f6:10:57:4a:92:fa:4f:37:0a:ff:97:fb:08:f1:25:94:1f:29:9d:f2:2e:f8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-debug-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-file-l1-2-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-sysinfo-l1-2-1

teetransport

api-ms-win-core-profile-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-console-l1-1-0

Exports

Exports

Sections

.text Size: 230KB - Virtual size: 230KB

.rdata Size: 106KB - Virtual size: 106KB

.data Size: 5KB - Virtual size: 16KB

.pdata Size: 12KB - Virtual size: 12KB

.gfids Size: 1024B - Virtual size: 580B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

56:00:00:01:75:73:76:cd:78:ad:00:0c:9a:00:00:00:00:01:75
Certificate

06:9b:5e:99:27:72:84:c8:76:7f:13:68:a7:de:b0:f3
Certificate

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

75:f2:90:06:ae:84:39:0e:cf:57:5e:29:fa:c4:e9:98:0b:0c:43:28
Certificate

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

4e:21:a3:d3:e3:0e:30:ec:5e:f3:f6:10:57:4a:92:fa:4f:37:0a:ff:97:fb:08:f1:25:94:1f:29:9d:f2:2e:f8
Signer

4e:21:a3:d3:e3:0e:30:ec:5e:f3:f6:10:57:4a:92:fa:4f:37:0a:ff:97:fb:08:f1:25:94:1f:29:9d:f2:2e:f8
Signer

.text
Size: 230KB - Virtual size: 230KB

.rdata
Size: 106KB - Virtual size: 106KB

.data
Size: 5KB - Virtual size: 16KB

.pdata
Size: 12KB - Virtual size: 12KB

.gfids
Size: 1024B - Virtual size: 580B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB