ba34e2d70b5b9079cb9399d09f9cea29359fdb6caef836750dba85c87b3e8e27

Sharing

Copy URL Twitter E-mail

General

Target

ba34e2d70b5b9079cb9399d09f9cea29359fdb6caef836750dba85c87b3e8e27
Size

4.3MB
MD5

97cd5429fc27d7a7d57e2576d2fa7957
SHA1

e1003f3b14060596e8057448208c98a479e8fdde
SHA256

ba34e2d70b5b9079cb9399d09f9cea29359fdb6caef836750dba85c87b3e8e27
SHA512

9584474185532b935fd6853e0f711950cc7b50333244f3ac53ef213ce80a9ed163d5c151c513ea82f40f409b147400b727f7f436f9e79f75ae940e9953480884
SSDEEP

98304:K7xg9K/Wn8EbzeKkJon3yRkOoVRBC9T3AjtuLLRh+S2sA8s9:1YvE3eVo3woVRI9T3AkVh+R

Score

1^/10

Malware Config

Signatures

Files

ba34e2d70b5b9079cb9399d09f9cea29359fdb6caef836750dba85c87b3e8e27
.dll windows:5 windows x64 arch:x64

a28260ddd232493a262847036e1e0a54

Code Sign

3d:e6:e2:a1:09:18:b6:4d:a1:bd:66:75:b2:72:0c:ff
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

21/01/2020, 00:00

Not After

20/01/2022, 23:59

Subject

CN=Hulubulu Software,O=Hulubulu Software,POSTALCODE=2640,STREET=Sletteager 30,L=Hedehusene,ST=Hovedstaden,C=DK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b8:2b:ce:e2:d8:db:a9:2f:d4:24:1f:94:07:32:21:4a:b5:3f:27:d1
Signer

Actual PE Digest

b8:2b:ce:e2:d8:db:a9:2f:d4:24:1f:94:07:32:21:4a:b5:3f:27:d1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

Exports

Exports

duk_alloc
duk_alloc_raw
duk_base64_decode
duk_base64_encode
duk_buffer_to_string
duk_call
duk_call_method
duk_call_prop
duk_char_code_at
duk_check_stack
duk_check_stack_top
duk_check_type
duk_check_type_mask
duk_compact
duk_compile_raw
duk_components_to_time
duk_concat
duk_config_buffer
duk_copy
duk_create_heap
duk_debugger_attach
duk_debugger_cooperate
duk_debugger_detach
duk_debugger_notify
duk_debugger_pause
duk_decode_string
duk_def_prop
duk_del_prop
duk_del_prop_heapptr
duk_del_prop_index
duk_del_prop_lstring
duk_del_prop_string
duk_destroy_heap
duk_dump_function
duk_dup
duk_dup_top
duk_enum
duk_equals
duk_error_raw
duk_error_va_raw
duk_eval_raw
duk_fatal_raw
duk_free
duk_free_raw
duk_freeze
duk_gc
duk_get_boolean
duk_get_boolean_default
duk_get_buffer
duk_get_buffer_data
duk_get_buffer_data_default
duk_get_buffer_default
duk_get_c_function
duk_get_c_function_default
duk_get_context
duk_get_context_default
duk_get_current_magic
duk_get_error_code
duk_get_finalizer
duk_get_global_lstring
duk_get_global_string
duk_get_heapptr
duk_get_heapptr_default
duk_get_int
duk_get_int_default
duk_get_length
duk_get_lstring
duk_get_lstring_default
duk_get_magic
duk_get_memory_functions
duk_get_now
duk_get_number
duk_get_number_default
duk_get_pointer
duk_get_pointer_default
duk_get_prop
duk_get_prop_desc
duk_get_prop_heapptr
duk_get_prop_index
duk_get_prop_lstring
duk_get_prop_string
duk_get_prototype
duk_get_string
duk_get_string_default
duk_get_top
duk_get_top_index
duk_get_type
duk_get_type_mask
duk_get_uint
duk_get_uint_default
duk_has_prop
duk_has_prop_heapptr
duk_has_prop_index
duk_has_prop_lstring
duk_has_prop_string
duk_hex_decode
duk_hex_encode
duk_insert
duk_inspect_callstack_entry
duk_inspect_value
duk_instanceof
duk_is_array
duk_is_boolean
duk_is_bound_function
duk_is_buffer
duk_is_buffer_data
duk_is_c_function
duk_is_constructable
duk_is_constructor_call
duk_is_dynamic_buffer
duk_is_ecmascript_function
duk_is_external_buffer
duk_is_fixed_buffer
duk_is_function
duk_is_lightfunc
duk_is_nan
duk_is_null
duk_is_number
duk_is_object
duk_is_pointer
duk_is_strict_call
duk_is_string
duk_is_symbol
duk_is_thread
duk_is_undefined
duk_is_valid_index
duk_join
duk_json_decode
duk_json_encode
duk_load_function
duk_map_string
duk_new
duk_next
duk_normalize_index
duk_opt_boolean
duk_opt_buffer
duk_opt_buffer_data
duk_opt_c_function
duk_opt_context
duk_opt_heapptr
duk_opt_int
duk_opt_lstring
duk_opt_number
duk_opt_pointer
duk_opt_string
duk_opt_uint
duk_pcall
duk_pcall_method
duk_pcall_prop
duk_pnew
duk_pop
duk_pop_2
duk_pop_3
duk_pop_n
duk_push_array
duk_push_bare_object
duk_push_boolean
duk_push_buffer_object
duk_push_buffer_raw
duk_push_c_function
duk_push_c_lightfunc
duk_push_context_dump
duk_push_current_function
duk_push_current_thread
duk_push_error_object_raw
duk_push_error_object_va_raw
duk_push_false
duk_push_global_object
duk_push_global_stash
duk_push_heap_stash
duk_push_heapptr
duk_push_int
duk_push_lstring
duk_push_nan
duk_push_null
duk_push_number
duk_push_object
duk_push_pointer
duk_push_proxy
duk_push_sprintf
duk_push_string
duk_push_this
duk_push_thread_raw
duk_push_thread_stash
duk_push_true
duk_push_uint
duk_push_undefined
duk_push_vsprintf
duk_put_function_list
duk_put_global_lstring
duk_put_global_string
duk_put_number_list
duk_put_prop
duk_put_prop_heapptr
duk_put_prop_index
duk_put_prop_lstring
duk_put_prop_string
duk_realloc
duk_realloc_raw
duk_remove
duk_replace
duk_require_boolean
duk_require_buffer
duk_require_buffer_data
duk_require_c_function
duk_require_context
duk_require_function
duk_require_heapptr
duk_require_int
duk_require_lstring
duk_require_normalize_index
duk_require_null
duk_require_number
duk_require_object
duk_require_pointer
duk_require_stack
duk_require_stack_top
duk_require_string
duk_require_top_index
duk_require_uint
duk_require_undefined
duk_require_valid_index
duk_resize_buffer
duk_resume
duk_safe_call
duk_safe_to_lstring
duk_samevalue
duk_seal
duk_set_finalizer
duk_set_global_object
duk_set_length
duk_set_magic
duk_set_prototype
duk_set_top
duk_steal_buffer
duk_strict_equals
duk_substring
duk_suspend
duk_swap
duk_swap_top
duk_throw_raw
duk_time_to_components
duk_to_boolean
duk_to_buffer_raw
duk_to_int
duk_to_int32
duk_to_lstring
duk_to_null
duk_to_number
duk_to_object
duk_to_pointer
duk_to_primitive
duk_to_string
duk_to_uint
duk_to_uint16
duk_to_uint32
duk_to_undefined
duk_trim
duk_xcopymove_raw

Sections

.text
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.WGc
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.B0w
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.k"*
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a28260ddd232493a262847036e1e0a54

Code Sign

3d:e6:e2:a1:09:18:b6:4d:a1:bd:66:75:b2:72:0c:ffCertificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

b8:2b:ce:e2:d8:db:a9:2f:d4:24:1f:94:07:32:21:4a:b5:3f:27:d1Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: - Virtual size: 28KB

.rdata Size: - Virtual size: 16KB

.data Size: - Virtual size: 8KB

.pdata Size: - Virtual size: 1KB

.WGc Size: - Virtual size: 2.3MB

.B0w Size: 1KB - Virtual size: 1KB

.k"* Size: 4.3MB - Virtual size: 4.3MB

.reloc Size: 512B - Virtual size: 36B

3d:e6:e2:a1:09:18:b6:4d:a1:bd:66:75:b2:72:0c:ff
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

b8:2b:ce:e2:d8:db:a9:2f:d4:24:1f:94:07:32:21:4a:b5:3f:27:d1
Signer

.text
Size: - Virtual size: 28KB

.rdata
Size: - Virtual size: 16KB

.data
Size: - Virtual size: 8KB

.pdata
Size: - Virtual size: 1KB

.WGc
Size: - Virtual size: 2.3MB

.B0w
Size: 1KB - Virtual size: 1KB

.k"*
Size: 4.3MB - Virtual size: 4.3MB

.reloc
Size: 512B - Virtual size: 36B