2e38fff732ca29b46daed09d4213db1d7dcc6a200ae3e715bf0a31d36bd60a01N

Sharing

Copy URL Twitter E-mail

General

Target

2e38fff732ca29b46daed09d4213db1d7dcc6a200ae3e715bf0a31d36bd60a01N
Size

101KB
MD5

0b97c0cecb495ce9e9b6c37e0f950800
SHA1

65913b04ce45d6a45a683c49a13585fb8a3a1515
SHA256

2e38fff732ca29b46daed09d4213db1d7dcc6a200ae3e715bf0a31d36bd60a01
SHA512

5a017b67c50c76016442abed15ce07c893b884c276c2380fe765a834f966b63e5aa164ebcedb26d6d4142bb3ca3ec3b0dbd149c72b7d6009550d0ef2d95ca840
SSDEEP

3072:vsIXGaipcLAEnu2d3sE/qWl6WWYkDb+F/XXBqyNp:vRGzKG+jiWldF/T

Score

1^/10

Malware Config

Signatures

Files

2e38fff732ca29b46daed09d4213db1d7dcc6a200ae3e715bf0a31d36bd60a01N
.dll windows:6 windows x64 arch:x64

e58259464763035ed1ff5c0bf85f3088

Code Sign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

06:ad:81:56:59:ec:b6:b4:fa:23:b1:cc:6e:82:66:b5
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

20/03/2024, 00:00

Not After

11/06/2026, 23:59

Subject

CN=Eclipse.org Foundation\, Inc.,O=Eclipse.org Foundation\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:b6:05:7c:88:f8:3a:e9:84:f9:df:59:52:33:0e:e3
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

22/07/2024, 00:00

Not After

21/07/2025, 23:59

Subject

CN=Eclipse.org Foundation\, Inc.,O=Eclipse.org Foundation\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:8c:43:52:d6:40:83:04:f6:37:b0:01:2d:b0:01:90:5e:c1:b3:4b:cb:47:bb:05:e3:cd:ba:fe:12:5b:d1:f1
Signer

Actual PE Digest

33:8c:43:52:d6:40:83:04:f6:37:b0:01:2d:b0:01:90:5e:c1:b3:4b:cb:47:bb:05:e3:cd:ba:fe:12:5b:d1:f1

Digest Algorithm

sha256

PE Digest Matches

true

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

net.pdb

Imports

ws2_32

WSAStartup
recv
WSAAddressToStringA
shutdown
send
listen
accept
__WSAFDIsSet
getnameinfo
freeaddrinfo
WSACleanup
WSAEventSelect
WSACreateEvent
WSACloseEvent
gethostname
ntohl
htons
closesocket
htonl
getsockopt
bind
WSAIoctl
WSAGetLastError
WSASetLastError
socket
setsockopt
sendto
select
recvfrom
ntohs
getsockname
ioctlsocket
connect
getaddrinfo

jvm

jio_snprintf
JVM_CurrentTimeMillis

winhttp

WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen

java

getErrorString
JNU_ThrowByNameWithMessageAndLastError
JNU_ThrowOutOfMemoryError
JNU_ThrowByName
JNU_ThrowNullPointerException
JNU_NewStringPlatform
JDK_LoadSystemLibrary
JNU_ReleaseStringPlatformChars
JNU_GetStringPlatformChars

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

kernel32

TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LoadLibraryExA
GetModuleHandleW
FreeLibrary
VirtualQuery
VirtualProtect
QueryPerformanceCounter
RaiseException
VerifyVersionInfoW
VerSetConditionMask
WideCharToMultiByte
GetOverlappedResult
Sleep
MultiByteToWideChar
GetProcAddress
FormatMessageA
LocalFree
SetHandleInformation
GlobalFree
IsProcessorFeaturePresent
GetCurrentProcessId
GetLastError
GetSystemInfo
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetCurrentThreadId

vcruntime140

memcpy
__C_specific_handler
__std_type_info_destroy_list
wcsstr
wcschr
memset

api-ms-win-crt-string-l1-1-0

strcmp
strncpy
strlen
_wcsdup
strcpy
wcscpy
strcat
wcstok_s
wcslen
wcsncmp
strncpy_s
wcscmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswscanf
__stdio_common_vsprintf
__stdio_common_vswprintf
__stdio_common_vsnprintf_s

api-ms-win-crt-heap-l1-1-0

realloc
calloc
free
malloc

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_cexit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_errno
_initterm
_initialize_onexit_table
_initterm_e

Exports

Exports

JNI_OnLoad
Java_java_net_AbstractPlainDatagramSocketImpl_isReusePortAvailable0
Java_java_net_AbstractPlainSocketImpl_isReusePortAvailable0
Java_java_net_DatagramPacket_init
Java_java_net_DualStackPlainDatagramSocketImpl_dataAvailable
Java_java_net_DualStackPlainDatagramSocketImpl_initIDs
Java_java_net_DualStackPlainDatagramSocketImpl_socketBind
Java_java_net_DualStackPlainDatagramSocketImpl_socketClose
Java_java_net_DualStackPlainDatagramSocketImpl_socketConnect
Java_java_net_DualStackPlainDatagramSocketImpl_socketCreate
Java_java_net_DualStackPlainDatagramSocketImpl_socketDisconnect
Java_java_net_DualStackPlainDatagramSocketImpl_socketGetIntOption
Java_java_net_DualStackPlainDatagramSocketImpl_socketLocalAddress
Java_java_net_DualStackPlainDatagramSocketImpl_socketLocalPort
Java_java_net_DualStackPlainDatagramSocketImpl_socketReceiveOrPeekData
Java_java_net_DualStackPlainDatagramSocketImpl_socketSend
Java_java_net_DualStackPlainDatagramSocketImpl_socketSetIntOption
Java_java_net_Inet4AddressImpl_getHostByAddr
Java_java_net_Inet4AddressImpl_getLocalHostName
Java_java_net_Inet4AddressImpl_isReachable0
Java_java_net_Inet4AddressImpl_lookupAllHostAddr
Java_java_net_Inet4Address_init
Java_java_net_Inet6AddressImpl_getHostByAddr
Java_java_net_Inet6AddressImpl_getLocalHostName
Java_java_net_Inet6AddressImpl_isReachable0
Java_java_net_Inet6AddressImpl_lookupAllHostAddr
Java_java_net_Inet6Address_init
Java_java_net_InetAddressImplFactory_isIPv6Supported
Java_java_net_InetAddress_init
Java_java_net_NetworkInterface_boundInetAddress0
Java_java_net_NetworkInterface_getAll
Java_java_net_NetworkInterface_getAll_XP
Java_java_net_NetworkInterface_getByIndex0
Java_java_net_NetworkInterface_getByIndex0_XP
Java_java_net_NetworkInterface_getByInetAddress0
Java_java_net_NetworkInterface_getByInetAddress0_XP
Java_java_net_NetworkInterface_getByName0
Java_java_net_NetworkInterface_getByName0_XP
Java_java_net_NetworkInterface_getMTU0
Java_java_net_NetworkInterface_getMTU0_XP
Java_java_net_NetworkInterface_getMacAddr0
Java_java_net_NetworkInterface_getMacAddr0_XP
Java_java_net_NetworkInterface_init
Java_java_net_NetworkInterface_isLoopback0
Java_java_net_NetworkInterface_isLoopback0_XP
Java_java_net_NetworkInterface_isP2P0
Java_java_net_NetworkInterface_isP2P0_XP
Java_java_net_NetworkInterface_isUp0
Java_java_net_NetworkInterface_isUp0_XP
Java_java_net_NetworkInterface_supportsMulticast0
Java_java_net_NetworkInterface_supportsMulticast0_XP
Java_java_net_PlainSocketImpl_accept0
Java_java_net_PlainSocketImpl_available0
Java_java_net_PlainSocketImpl_bind0
Java_java_net_PlainSocketImpl_close0
Java_java_net_PlainSocketImpl_configureBlocking
Java_java_net_PlainSocketImpl_connect0
Java_java_net_PlainSocketImpl_getIntOption
Java_java_net_PlainSocketImpl_initIDs
Java_java_net_PlainSocketImpl_listen0
Java_java_net_PlainSocketImpl_localAddress
Java_java_net_PlainSocketImpl_localPort0
Java_java_net_PlainSocketImpl_sendOOB
Java_java_net_PlainSocketImpl_setIntOption
Java_java_net_PlainSocketImpl_setSoTimeout0
Java_java_net_PlainSocketImpl_shutdown0
Java_java_net_PlainSocketImpl_socket0
Java_java_net_PlainSocketImpl_waitForConnect
Java_java_net_PlainSocketImpl_waitForNewConnection
Java_java_net_SocketCleanable_cleanupClose0
Java_java_net_SocketInputStream_init
Java_java_net_SocketInputStream_socketRead0
Java_java_net_SocketOutputStream_init
Java_java_net_SocketOutputStream_socketWrite0
Java_java_net_TwoStacksPlainDatagramSocketImpl_bind0
Java_java_net_TwoStacksPlainDatagramSocketImpl_connect0
Java_java_net_TwoStacksPlainDatagramSocketImpl_dataAvailable
Java_java_net_TwoStacksPlainDatagramSocketImpl_datagramSocketClose
Java_java_net_TwoStacksPlainDatagramSocketImpl_datagramSocketCreate
Java_java_net_TwoStacksPlainDatagramSocketImpl_disconnect0
Java_java_net_TwoStacksPlainDatagramSocketImpl_getTTL
Java_java_net_TwoStacksPlainDatagramSocketImpl_getTimeToLive
Java_java_net_TwoStacksPlainDatagramSocketImpl_init
Java_java_net_TwoStacksPlainDatagramSocketImpl_join
Java_java_net_TwoStacksPlainDatagramSocketImpl_leave
Java_java_net_TwoStacksPlainDatagramSocketImpl_peek
Java_java_net_TwoStacksPlainDatagramSocketImpl_peekData
Java_java_net_TwoStacksPlainDatagramSocketImpl_receive0
Java_java_net_TwoStacksPlainDatagramSocketImpl_send0
Java_java_net_TwoStacksPlainDatagramSocketImpl_setTTL
Java_java_net_TwoStacksPlainDatagramSocketImpl_setTimeToLive
Java_java_net_TwoStacksPlainDatagramSocketImpl_socketGetOption
Java_java_net_TwoStacksPlainDatagramSocketImpl_socketLocalAddress
Java_java_net_TwoStacksPlainDatagramSocketImpl_socketNativeSetOption
Java_jdk_net_Sockets_isReusePortAvailable0
Java_sun_net_dns_ResolverConfigurationImpl_init0
Java_sun_net_dns_ResolverConfigurationImpl_loadDNSconfig0
Java_sun_net_dns_ResolverConfigurationImpl_notifyAddrChange0
Java_sun_net_spi_DefaultProxySelector_getSystemProxies
Java_sun_net_spi_DefaultProxySelector_init
Java_sun_net_www_protocol_http_ntlm_NTLMAuthSequence_getCredentialsHandle
Java_sun_net_www_protocol_http_ntlm_NTLMAuthSequence_getNextToken
Java_sun_net_www_protocol_http_ntlm_NTLMAuthSequence_initFirst
Java_sun_net_www_protocol_http_ntlm_NTLMAuthentication_isTrustedSite0
Java_sun_net_www_protocol_http_ntlm_NTLMAuthentication_isTrustedSiteAvailable
NET_Bind
NET_BindV6
NET_EnableFastTcpLoopback
NET_EnableFastTcpLoopbackConnect
NET_GetPortFromSockaddr
NET_GetSockOpt
NET_InetAddressToSockaddr
NET_MapSocketOption
NET_MapSocketOptionV6
NET_SetSockOpt
NET_SockaddrEqualsInetAddress
NET_SockaddrToInetAddress
NET_SocketAvailable
NET_SocketClose
NET_ThrowNew
NET_Timeout
NET_Timeout2
NET_WinBind
initInetAddressIDs
ipv4_available
ipv6_available
reuseport_available

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e58259464763035ed1ff5c0bf85f3088

Code Sign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

06:ad:81:56:59:ec:b6:b4:fa:23:b1:cc:6e:82:66:b5Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

06:b6:05:7c:88:f8:3a:e9:84:f9:df:59:52:33:0e:e3Certificate

Extended Key Usages

Key Usages

33:8c:43:52:d6:40:83:04:f6:37:b0:01:2d:b0:01:90:5e:c1:b3:4b:cb:47:bb:05:e3:cd:ba:fe:12:5b:d1:f1Signer

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

jvm

winhttp

java

advapi32

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 55KB - Virtual size: 54KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 888B

.reloc Size: 512B - Virtual size: 196B

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

06:ad:81:56:59:ec:b6:b4:fa:23:b1:cc:6e:82:66:b5
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

06:b6:05:7c:88:f8:3a:e9:84:f9:df:59:52:33:0e:e3
Certificate

33:8c:43:52:d6:40:83:04:f6:37:b0:01:2d:b0:01:90:5e:c1:b3:4b:cb:47:bb:05:e3:cd:ba:fe:12:5b:d1:f1
Signer

.text
Size: 55KB - Virtual size: 54KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 888B

.reloc
Size: 512B - Virtual size: 196B