f9b962d6668a3813695b5c8dab533d6ecbcb2cef5c5fad6726637d735f6dd33b

Sharing

Copy URL Twitter E-mail

General

Target

f9b962d6668a3813695b5c8dab533d6ecbcb2cef5c5fad6726637d735f6dd33b
Size

1.2MB
MD5

f14a7650ec7046d5f2ee9c51a29ba9b0
SHA1

45eedbd38994d0f17dd20e14e0efa09edbc9178b
SHA256

f9b962d6668a3813695b5c8dab533d6ecbcb2cef5c5fad6726637d735f6dd33b
SHA512

eaec9a215d10b5b61b05e289b92a36cae26b1793dc003e27124ffa5ea9e9ce70b78714c72013dc004a8df3d64b035522189e8ef9d0ae42acf59fe68500af2d34
SSDEEP

24576:ek6qx5aELhzJNzGaR3wQNAj3FSlf8QCDIuyLeyvXJunOJ6Yj/:KeaENzJ5GKpiDFCCDIZLeyvXJuOJfr

Score

1^/10

Malware Config

Signatures

Files

f9b962d6668a3813695b5c8dab533d6ecbcb2cef5c5fad6726637d735f6dd33b
.dll windows:6 windows x64 arch:x64

c8945dc64b6927bd17dfe30702cccb25

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

22:4a:d5:5e:60:b8:56:ec:4d:cc:45:3b:9f:b8:09:48:cb:d1:47:fa:c2:84:25:8a:bf:2e:94:c4:93:bf:ef:60
Signer

Actual PE Digest

22:4a:d5:5e:60:b8:56:ec:4d:cc:45:3b:9f:b8:09:48:cb:d1:47:fa:c2:84:25:8a:bf:2e:94:c4:93:bf:ef:60

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

clrjit.pdb

Imports

advapi32

EventUnregister
EventRegister
EventWriteTransfer

kernel32

DecodePointer
EncodePointer
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentThread
QueryThreadCycleTime
DisableThreadLibraryCalls
RaiseException
DebugBreak
OutputDebugStringA
GetModuleHandleExW
GetProcAddress
FreeLibrary
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
IsProcessorFeaturePresent

msvcr120_clr0400

fprintf
_wfopen
fclose
_wtoi
qsort
fseek
ftell
strcpy_s
sqrt
sqrtf
strcat_s
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
__crtCapturePreviousContext
__crtCaptureCurrentContext
__crtTerminateProcess
__crtUnhandledException
__crt_debugger_hook
__C_specific_handler
_initterm_e
_initterm
_malloc_crt
free
_amsg_exit
__CppXcptFilter
wcsncmp
_isnanf
_copysignf
_copysign
_isnan
_finite
memmove_s
memcpy_s
memmove
setvbuf
_fdopen
_setmode
_dup
_errno
__iob_func
_fileno
_purecall
sinf
sin
memset
memcpy
memcmp
fmodf
fmod
floorf
_CxxThrowException
__CxxFrameHandler3
ceil
ceilf
cos
cosf
floor
strcmp

Exports

Exports

getJit
jitStartup
sxsJitStartup

Sections

.text
Size: 957KB - Virtual size: 957KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8945dc64b6927bd17dfe30702cccb25

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:dfCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

22:4a:d5:5e:60:b8:56:ec:4d:cc:45:3b:9f:b8:09:48:cb:d1:47:fa:c2:84:25:8a:bf:2e:94:c4:93:bf:ef:60Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcr120_clr0400

Exports

Exports

Sections

.text Size: 957KB - Virtual size: 957KB

.rdata Size: 101KB - Virtual size: 100KB

.data Size: 6KB - Virtual size: 7KB

.pdata Size: 107KB - Virtual size: 107KB

.tls Size: 512B - Virtual size: 17B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

22:4a:d5:5e:60:b8:56:ec:4d:cc:45:3b:9f:b8:09:48:cb:d1:47:fa:c2:84:25:8a:bf:2e:94:c4:93:bf:ef:60
Signer

.text
Size: 957KB - Virtual size: 957KB

.rdata
Size: 101KB - Virtual size: 100KB

.data
Size: 6KB - Virtual size: 7KB

.pdata
Size: 107KB - Virtual size: 107KB

.tls
Size: 512B - Virtual size: 17B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB