3a6c3b175f2c22ee93b2ab16562dffdeb61a5a6b39406bb1cafdd05294ef9705

Sharing

Copy URL Twitter E-mail

General

Target

3a6c3b175f2c22ee93b2ab16562dffdeb61a5a6b39406bb1cafdd05294ef9705
Size

108KB
MD5

770b0a4db1a324b56b67cdc086f6b601
SHA1

c3f448910b2425866361dcb4274fa83abcfcc4c4
SHA256

3a6c3b175f2c22ee93b2ab16562dffdeb61a5a6b39406bb1cafdd05294ef9705
SHA512

b57437f5eaba677ee135374000d28c0406fd8f4730b0de4647824c683f52a008b79628d030fcadbdac1b7c1604d23d977974344cfd9f7e23ee7d0bb682b5b05a
SSDEEP

3072:9KnE5XP8dGjt6VOahSaO42Lh70C18av9foe/MJ4/QLDv:2PGjmOy0s

Score

1^/10

Malware Config

Signatures

Files

3a6c3b175f2c22ee93b2ab16562dffdeb61a5a6b39406bb1cafdd05294ef9705
.dll windows:6 windows x64 arch:x64

862eaf935de19d15d373f34791fd8f7d

Code Sign

d5:cc:90:21:a6:76:11:f4:b5:d5:44:1f:74:11:3c:fb
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/04/2021, 00:00

Not After

02/04/2023, 23:59

Subject

CN=Intel Corporation,OU=SolarKMCS,O=Intel Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:58

Not After

08/03/2023, 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

96:b5:35:5f:63:f7:e8:fc:b1:38:c4:64:91:ae:62:2d:9a:43:3c:25:06:98:40:8e:b6:8f:66:cb:9e:48:98:27
Signer

Actual PE Digest

96:b5:35:5f:63:f7:e8:fc:b1:38:c4:64:91:ae:62:2d:9a:43:3c:25:06:98:40:8e:b6:8f:66:cb:9e:48:98:27

Digest Algorithm

sha256

PE Digest Matches

true

96:b5:35:5f:63:f7:e8:fc:b1:38:c4:64:91:ae:62:2d:9a:43:3c:25:06:98:40:8e:b6:8f:66:cb:9e:48:98:27
Signer

Actual PE Digest

96:b5:35:5f:63:f7:e8:fc:b1:38:c4:64:91:ae:62:2d:9a:43:3c:25:06:98:40:8e:b6:8f:66:cb:9e:48:98:27

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\qba1\workspace\41494\drivers.audio.windows.sw-components\IntelAudioService\x64\Release\NativeApiAdapter.pdb

Imports

api-ms-win-service-core-l1-1-4

GetServiceDirectory

api-ms-win-service-core-l1-1-3

GetServiceRegistryStateKey

api-ms-win-core-apiquery-l2-1-0

IsApiSetImplemented

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

TlsSetValue
TlsAlloc
TerminateProcess
TlsFree
GetCurrentProcessId
GetCurrentThreadId
ExitProcess
GetCurrentProcess
GetStartupInfoW
TlsGetValue

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedFlushSList

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
HeapReAlloc
HeapSize
GetProcessHeap

api-ms-win-core-file-l1-1-0

FlushFileBuffers
FindClose
CreateFileW
GetFileType
WriteFile
FindFirstFileExW
FindNextFileW
SetFilePointerEx

api-ms-win-core-localization-l1-2-0

IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LCMapStringW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW
SetStdHandle
GetCommandLineA
GetCommandLineW
GetStdHandle
FreeEnvironmentStringsW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW

api-ms-win-core-console-l1-1-0

WriteConsoleW
GetConsoleMode
GetConsoleCP

api-ms-win-core-handle-l1-1-0

CloseHandle

Exports

Exports

GetServiceDirectoryExport
GetServiceRegistryStateKeyExport
IsApiSetImplementedExport

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

862eaf935de19d15d373f34791fd8f7d

Code Sign

d5:cc:90:21:a6:76:11:f4:b5:d5:44:1f:74:11:3c:fbCertificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dcCertificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

96:b5:35:5f:63:f7:e8:fc:b1:38:c4:64:91:ae:62:2d:9a:43:3c:25:06:98:40:8e:b6:8f:66:cb:9e:48:98:27Signer

96:b5:35:5f:63:f7:e8:fc:b1:38:c4:64:91:ae:62:2d:9a:43:3c:25:06:98:40:8e:b6:8f:66:cb:9e:48:98:27Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-service-core-l1-1-4

api-ms-win-service-core-l1-1-3

api-ms-win-core-apiquery-l2-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-handle-l1-1-0

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 2KB - Virtual size: 6KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

d5:cc:90:21:a6:76:11:f4:b5:d5:44:1f:74:11:3c:fb
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

96:b5:35:5f:63:f7:e8:fc:b1:38:c4:64:91:ae:62:2d:9a:43:3c:25:06:98:40:8e:b6:8f:66:cb:9e:48:98:27
Signer

96:b5:35:5f:63:f7:e8:fc:b1:38:c4:64:91:ae:62:2d:9a:43:3c:25:06:98:40:8e:b6:8f:66:cb:9e:48:98:27
Signer

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 2KB - Virtual size: 6KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB