9d815c778a6fb5a0999a172433306e157498d7758b12e0edae44f4cbe517f552

Sharing

Copy URL Twitter E-mail

General

Target

9d815c778a6fb5a0999a172433306e157498d7758b12e0edae44f4cbe517f552
Size

368KB
MD5

1a20ad8ce87a2e8cd22801fc9b1e836f
SHA1

c8e9bf57474a56ef0cf452e13ba100f67b0726d9
SHA256

9d815c778a6fb5a0999a172433306e157498d7758b12e0edae44f4cbe517f552
SHA512

8fa25b075b09b68cef1793433bb7b7b918a43d4b23049421f6f9807b3ceb97a98f3f820208d50c31e8a42142fa2a7febbec66ec916847634f8e9c00ffb97de47
SSDEEP

6144:Q4kH1LyqVC8UmpCP24gq3jh5ybnZOqV8FP59qWuq4GViCEPMH:9aLyqc8LMPzzabn059sq4MEP4

Score

1^/10

Malware Config

Signatures

Files

9d815c778a6fb5a0999a172433306e157498d7758b12e0edae44f4cbe517f552
.exe windows:4 windows x64 arch:x64

205fcc27df6766b7fc7ba627a9847919

Code Sign

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:51

Not After

16/10/2024, 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:70:7c:4e:c1:8b:5b:07:da:a5:e6:bd:45:43:af:1d:0a:30:4d:82:46:9a:9f:86:5c:ef:aa:10:8a:62:af:b7
Signer

Actual PE Digest

2e:70:7c:4e:c1:8b:5b:07:da:a5:e6:bd:45:43:af:1d:0a:30:4d:82:46:9a:9f:86:5c:ef:aa:10:8a:62:af:b7

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlVirtualUnwind
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
FreeEnvironmentStringsA
Sleep
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetModuleFileNameA
GetStdHandle
HeapSize
HeapReAlloc
RtlPcToFileHeader
RaiseException
ExitProcess
RtlLookupFunctionEntry
RtlUnwindEx
RtlCaptureContext
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetProcessHeap
HeapAlloc
HeapFree
GetTickCount
SetErrorMode
lstrlenA
GetCurrentProcess
GetThreadLocale
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
FormatMessageW
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
InitializeCriticalSection
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalFree
LocalAlloc
WritePrivateProfileStringW
GlobalFlags
MulDiv
lstrlenW
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
GetCurrentProcessId
GlobalAddAtomW
CloseHandle
GlobalFree
FreeResource
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
GetModuleFileNameW
lstrcmpA
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
GlobalAlloc
FreeLibrary
GlobalDeleteAtom
GlobalUnlock
GlobalLock
lstrcmpW
GetLastError
SetLastError
GetModuleHandleW
GetModuleHandleA
WaitForSingleObject
CreateThread
GetProcAddress
LoadLibraryW
LCMapStringW
CreateSemaphoreA

user32

RegisterClipboardFormatW
GetSysColorBrush
EndPaint
BeginPaint
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
ClientToScreen
LoadCursorW
GetDC
ReleaseDC
DestroyMenu
ShowWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
LoadIconW
UnregisterClassW
SendDlgItemMessageW
WinHelpW
GetCapture
GetClassNameW
GetClassLongPtrW
SetPropW
RemovePropW
SetFocus
GetWindowTextW
GetForegroundWindow
GetTopWindow
GetWindowLongPtrW
SetWindowLongPtrW
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetClientRect
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
GetWindowThreadProcessId
GetLastActivePopup
MessageBoxW
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
SendDlgItemMessageA
TranslateMessage
DispatchMessageW
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
GetDesktopWindow
GetActiveWindow
SetActiveWindow
GetSystemMetrics
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
SendMessageW
EndDialog
PostMessageW
PostQuitMessage
EnableWindow
GetPropW
UnregisterClassA

gdi32

PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
SetMapMode
CreateBitmap
RestoreDC
SaveDC
GetStockObject
GetDeviceCaps
DeleteDC
DeleteObject
SelectObject
GetObjectW
SetBkColor
SetTextColor
GetClipBox

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW
PathFindExtensionW

oleaut32

VariantInit
VariantChangeType
VariantClear

Sections

.text
Size: 220KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

205fcc27df6766b7fc7ba627a9847919

Code Sign

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

2e:70:7c:4e:c1:8b:5b:07:da:a5:e6:bd:45:43:af:1d:0a:30:4d:82:46:9a:9f:86:5c:ef:aa:10:8a:62:af:b7Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

shlwapi

oleaut32

Sections

.text Size: 220KB - Virtual size: 220KB

.rdata Size: 66KB - Virtual size: 65KB

.data Size: 11KB - Virtual size: 34KB

.pdata Size: 15KB - Virtual size: 15KB

.rsrc Size: 44KB - Virtual size: 44KB

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

2e:70:7c:4e:c1:8b:5b:07:da:a5:e6:bd:45:43:af:1d:0a:30:4d:82:46:9a:9f:86:5c:ef:aa:10:8a:62:af:b7
Signer

.text
Size: 220KB - Virtual size: 220KB

.rdata
Size: 66KB - Virtual size: 65KB

.data
Size: 11KB - Virtual size: 34KB

.pdata
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 44KB - Virtual size: 44KB