4a6aebfb1a23010196e858b6760b6a19d9ed6e7d7704219b24049e27ef1b2a79N

Sharing

Copy URL Twitter E-mail

General

Target

4a6aebfb1a23010196e858b6760b6a19d9ed6e7d7704219b24049e27ef1b2a79N
Size

898KB
MD5

60b49aa9fb32626cb55608f97d796b10
SHA1

3da0774ae84acbfdf1457850cc74b9f7779e68ce
SHA256

4a6aebfb1a23010196e858b6760b6a19d9ed6e7d7704219b24049e27ef1b2a79
SHA512

b44e5a22200a0d2a429afbb40caf093655421bb5901a56806abdaf780adbb3ece9db0e3b0f703636d37252bd27ef675c4fef7d49c54f273b28e98ac4f96b4163
SSDEEP

24576:PN5iB/GStDUg3BEXHk4mEzLXDPuP2hiiuY2ITFNk5AD7e1A6:1UWg3B8H7mAj9Uiu64x1A6

Score

1^/10

Malware Config

Signatures

Files

4a6aebfb1a23010196e858b6760b6a19d9ed6e7d7704219b24049e27ef1b2a79N
.dll windows:6 windows x86 arch:x86

2c292284d05bb04782ada4d59b1d9596

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:30:65:c5:26:84:31:dd:47:d7:43:c9:5d:8a:8a:53
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

23/01/2024, 00:00

Not After

20/03/2025, 23:59

Subject

CN=Xylem\, Inc,O=Xylem\, Inc,L=Rye Brook,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:7d:95:25:36:97:9d:55:48:b8:ae:6d:0b:c9:ce:98:49:20:b6:fa:8d:3c:73:f9:5f:80:ee:b3:89:4a:0f:0a
Signer

Actual PE Digest

55:7d:95:25:36:97:9d:55:48:b8:ae:6d:0b:c9:ce:98:49:20:b6:fa:8d:3c:73:f9:5f:80:ee:b3:89:4a:0f:0a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\HYPACK 2024\geo32.pdb

Imports

kernel32

GetProcessHeap
SystemTimeToFileTime
FreeLibrary
GetSystemTime
CreateFileMappingW
MapViewOfFile
GetTickCount
FlushFileBuffers
ReplaceFileW
GetTempFileNameW
OutputDebugStringA
GetModuleFileNameW
GetCommandLineW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
TlsSetValue
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
MoveFileExW
CopyFileW
CreateDirectoryExW
DeviceIoControl
GetLastError
CloseHandle
AreFileApisANSI
GetTempPathW
SetFileTime
SetFilePointerEx
SetFileInformationByHandle
SetFileAttributesW
SetEndOfFile
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceExW
FindNextFileW
FindFirstFileExW
GetFileSize
FindClose
CreateFileW
TlsGetValue
CreateDirectoryW
MultiByteToWideChar
TlsAlloc
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
ReadFile
HeapCreate
GetCurrentDirectoryW
HeapFree
WriteFile
GetDiskFreeSpaceW
LockFile
SetFilePointer
GetFullPathNameA
SetCurrentDirectoryW
UnlockFileEx
CreateMutexW
WaitForSingleObject
UnmapViewOfFile
HeapValidate
HeapSize
Sleep
GetTempPathA
FormatMessageW
FormatMessageA
LockFileEx
LocalFree
GetProcAddress
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
UnlockFile
DeleteFileW
HeapDestroy
HeapCompact
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapAlloc

user32

LoadStringA

msvcp140

?_W_Getdays@_Locinfo@std@@QBEPBGXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
?_Syserror_map@std@@YAPBDH@Z
_Mbrtowc
?_Winerror_map@std@@YAHH@Z
_Mtx_unlock
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_init_in_situ
?_Xbad_alloc@std@@YAXXZ
_Mtx_destroy_in_situ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

vcruntime140

_except_handler4_common
wcsrchr
__current_exception
__std_type_info_destroy_list
strchr
__std_exception_copy
__current_exception_context
__RTDynamicCast
memset
memmove
memcpy
__std_exception_destroy
__std_terminate
_CxxThrowException
__CxxFrameHandler3
strrchr
_purecall

api-ms-win-crt-math-l1-1-0

_libm_sse2_log_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_CIatan2
_CIfmod
_libm_sse2_cos_precise
_libm_sse2_pow_precise
_except1
_libm_sse2_exp_precise
_libm_sse2_asin_precise
round
floor
_libm_sse2_tan_precise
hypot
_libm_sse2_atan_precise

api-ms-win-crt-runtime-l1-1-0

_cexit
_crt_at_quick_exit
_execute_onexit_table
_endthreadex
_beginthreadex
_initterm
_initterm_e
_wassert
_register_onexit_function
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
__stdio_common_vsprintf
fopen
__stdio_common_vswprintf_s
fgetpos
fgets
fputs
ftell
fsetpos
fwrite
ferror
__stdio_common_vsscanf
fseek
fread
__stdio_common_vswprintf
fclose
__stdio_common_vfscanf
feof
_wfopen

api-ms-win-crt-string-l1-1-0

toupper
isupper
isspace
islower
strncmp
_strdup
strncpy
wcsncpy
strcspn
_strnicmp
strcat_s
_stricmp
_memicmp

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
_msize
realloc
calloc

api-ms-win-crt-filesystem-l1-1-0

_waccess
_wremove
_splitpath

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-convert-l1-1-0

atof
_itoa
atoi

api-ms-win-crt-time-l1-1-0

_localtime64_s

gdi32

CreateFontIndirectW
GetObjectW
GetStockObject

shell32

CommandLineToArgvW

Exports

Exports

CreateEpsgGeodesy
CreateFileGeodesy
CreateFileGeodesyW
CreateGeodesy
DatumSeparation
DatumSeparation1
DestroyGeodesy
ECEFGeo
EllConv
GCircLL
GeoECEF
GeoXY
GetAdjustment
GetChartDatum
GetEllDiff
GetEllModel
GetEpsgCode
GetEpsgParams
GetGeodesyError
GetGeodesyParams
GetGeodesyVersion
GetGeoid
GetGridZone
GetLocalName
GetVDatumModel
HConvert
InvEllConv
InvWGS84Conv
IsValidModel
RLineLL
Scale
SetAdjustment
SetChartDatum
SetEllDiff
SetEllModel
Undulation
VConvert
WGS84Conv
XYGeo
_Convergence@24

Sections

.text
Size: 772KB - Virtual size: 772KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c292284d05bb04782ada4d59b1d9596

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0d:30:65:c5:26:84:31:dd:47:d7:43:c9:5d:8a:8a:53Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

55:7d:95:25:36:97:9d:55:48:b8:ae:6d:0b:c9:ce:98:49:20:b6:fa:8d:3c:73:f9:5f:80:ee:b3:89:4a:0f:0aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

gdi32

shell32

Exports

Exports

Sections

.text Size: 772KB - Virtual size: 772KB

.rdata Size: 72KB - Virtual size: 72KB

.data Size: 10KB - Virtual size: 14KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 27KB - Virtual size: 26KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:30:65:c5:26:84:31:dd:47:d7:43:c9:5d:8a:8a:53
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

55:7d:95:25:36:97:9d:55:48:b8:ae:6d:0b:c9:ce:98:49:20:b6:fa:8d:3c:73:f9:5f:80:ee:b3:89:4a:0f:0a
Signer

.text
Size: 772KB - Virtual size: 772KB

.rdata
Size: 72KB - Virtual size: 72KB

.data
Size: 10KB - Virtual size: 14KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 27KB - Virtual size: 26KB