f1100cf344e2e32ab95070102391a1c0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

f1100cf344e2e32ab95070102391a1c0N.exe
Size

3.9MB
MD5

f1100cf344e2e32ab95070102391a1c0
SHA1

8d5121e687c5787e6d3891430f6ef3cf03e7daee
SHA256

a633c2a8cab995a1deeffd357dadad08efaaaee9040967f07f00958a9883db40
SHA512

2a5eaba59b317418df9a6196f4527edba3e53b79d1f95c26d9312525279393b46452359b097f7c57c44583d42d91a994ee3659ed6ce75eaa7058ed4e8c22b8a6
SSDEEP

49152:AtI6x8CUjTZ0RUDVD81qb7vAJt2DhV7doO8KHQ2GJVoBmKoENS48aWpOrwQV7flj:AtPoDeqPlCOwO7fl0Q

Score

1^/10

Malware Config

Signatures

Files

f1100cf344e2e32ab95070102391a1c0N.exe
.dll windows:6 windows x64 arch:x64

601127227bbe666b31ec1054da9ac15b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:58:b0:32:80:75:80:37:7f:f8:d4:fe:5f:d3:de:4f
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11/04/2024, 00:00

Not After

08/05/2027, 23:59

Subject

SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:58:b0:32:80:75:80:37:7f:f8:d4:fe:5f:d3:de:4f
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11/04/2024, 00:00

Not After

08/05/2027, 23:59

Subject

SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f3:f3:e6:33:0b:42:fd:8a:d6:03:cb:5d:88:24:44:06:bf:54:9e:a6:40:11:c4:89:67:e7:01:e8:45:f2:99:9d
Signer

Actual PE Digest

f3:f3:e6:33:0b:42:fd:8a:d6:03:cb:5d:88:24:44:06:bf:54:9e:a6:40:11:c4:89:67:e7:01:e8:45:f2:99:9d

Digest Algorithm

sha256

PE Digest Matches

true

c9:31:0b:05:9a:03:31:10:90:4d:79:ca:70:4b:08:98:72:d8:89:4c
Signer

Actual PE Digest

c9:31:0b:05:9a:03:31:10:90:4d:79:ca:70:4b:08:98:72:d8:89:4c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

updater.pdb

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetCommandLineW
FindClose
GetFileType
GetCommandLineA
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetCurrentProcess
DuplicateHandle
VirtualProtect
FlushViewOfFile
FlushFileBuffers
GetCPInfo
GetOEMCP
SetLastError
GetFinalPathNameByHandleW
GetQueuedCompletionStatusEx
GetACP
IsValidCodePage
CreateIoCompletionPort
SetFileCompletionNotificationModes
FindFirstFileExW
GetModuleHandleW
Sleep
GetModuleHandleExW
GetModuleFileNameW
QueryPerformanceCounter
GetConsoleOutputCP
SetFileInformationByHandle
GetFileInformationByHandleEx
GetLastError
SetFileTime
LCMapStringW
CompareStringW
lstrlenW
GetStringTypeW
SwitchToThread
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTimeZoneInformation
ExitProcess
FreeLibraryAndExitThread
GetFileInformationByHandle
GetTimeZoneInformationForYear
GetSystemTimePreciseAsFileTime
GetConsoleMode
SetHandleInformation
ExitThread
RtlPcToFileHeader
LoadLibraryExW
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
QueryPerformanceFrequency
FormatMessageW
GetCurrentDirectoryW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetTempPathW
CreateFileW
TlsFree
GetFullPathNameW
FindNextFileW
CreateDirectoryW
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetStdHandle
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentProcessId
CreateNamedPipeW
CreateThread
SetThreadStackGuarantee
GetCurrentThread
ReadFileEx
SleepEx
WriteFileEx
HeapAlloc
GetProcessHeap
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
RtlVirtualUnwind
DeleteFileW
MoveFileExW
CreateSymbolicLinkW
CreateHardLinkW
SetFileAttributesW
PostQueuedCompletionStatus
SetFilePointerEx
EncodePointer
InterlockedFlushSList
GetExitCodeProcess
CopyFileExW
HeapReAlloc
CloseHandle
SetConsoleMode
GetTickCount
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
CreateFileA
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
ReadFile
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
RtlUnwindEx
GetStartupInfoW
HeapFree
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetStdHandle
SetUnhandledExceptionFilter
GetModuleHandleA
GetSystemInfo
GetEnvironmentStringsW
GetProcAddress
FindFirstFileW
UnhandledExceptionFilter
LoadLibraryExA
RaiseException
VirtualQuery

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree

advapi32

SystemFunction036
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

user32

GetSystemMetrics

shell32

SHGetKnownFolderPath

ws2_32

bind
closesocket
setsockopt
getaddrinfo
freeaddrinfo
WSAIoctl
getsockopt
WSACleanup
recv
send
WSAGetLastError
getpeername
shutdown
WSASocketW
ioctlsocket
connect
WSAStartup
WSASend

ntdll

NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile
NtReadFile
NtWriteFile

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateContext

secur32

DeleteSecurityContext
FreeContextBuffer
FreeCredentialsHandle
EncryptMessage
AcquireCredentialsHandleA
AcceptSecurityContext
InitializeSecurityContextW
QueryContextAttributesW
DecryptMessage
ApplyControlToken

bcrypt

BCryptGenRandom

Exports

Exports

__externref_drop_slice
__externref_heap_live_count
__externref_table_alloc
__externref_table_dealloc
__pfnDliNotifyHook2
__wbindgen_exn_store
__wbindgen_free
__wbindgen_malloc
__wbindgen_realloc
module_register

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

601127227bbe666b31ec1054da9ac15b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:58:b0:32:80:75:80:37:7f:f8:d4:fe:5f:d3:de:4fCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:58:b0:32:80:75:80:37:7f:f8:d4:fe:5f:d3:de:4fCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

f3:f3:e6:33:0b:42:fd:8a:d6:03:cb:5d:88:24:44:06:bf:54:9e:a6:40:11:c4:89:67:e7:01:e8:45:f2:99:9dSigner

c9:31:0b:05:9a:03:31:10:90:4d:79:ca:70:4b:08:98:72:d8:89:4cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ole32

advapi32

user32

shell32

ws2_32

ntdll

crypt32

secur32

bcrypt

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 23KB - Virtual size: 29KB

.pdata Size: 67KB - Virtual size: 66KB

.didat Size: 512B - Virtual size: 320B

_RDATA Size: 512B - Virtual size: 500B

.reloc Size: 37KB - Virtual size: 36KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:58:b0:32:80:75:80:37:7f:f8:d4:fe:5f:d3:de:4f
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:58:b0:32:80:75:80:37:7f:f8:d4:fe:5f:d3:de:4f
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

f3:f3:e6:33:0b:42:fd:8a:d6:03:cb:5d:88:24:44:06:bf:54:9e:a6:40:11:c4:89:67:e7:01:e8:45:f2:99:9d
Signer

c9:31:0b:05:9a:03:31:10:90:4d:79:ca:70:4b:08:98:72:d8:89:4c
Signer

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 23KB - Virtual size: 29KB

.pdata
Size: 67KB - Virtual size: 66KB

.didat
Size: 512B - Virtual size: 320B

_RDATA
Size: 512B - Virtual size: 500B

.reloc
Size: 37KB - Virtual size: 36KB