e3561539c59530e68adf973a6a8de4e136758417f77667d504728ecfa2cb5361N

Sharing

Copy URL Twitter E-mail

General

Target

e3561539c59530e68adf973a6a8de4e136758417f77667d504728ecfa2cb5361N
Size

35KB
MD5

16aea03b16eb8a3f7d29d26f88abe8a0
SHA1

1b59371bc5da5e80d730e0bd3d5184d90d0c5b62
SHA256

e3561539c59530e68adf973a6a8de4e136758417f77667d504728ecfa2cb5361
SHA512

884daaba5a00baa5c7369f57b74d17d38b6cce87631c241f95bb344274039d5e1aceb4f96f17339eb82113f1d399ab07ae1b583baf4dbe20659b755eb4e9a2b1
SSDEEP

384:zPjh/2cARG7SIXvQCX9eV09dSHWc/5gWotCSt+e6MMR9zTN2Wt5yEFHRN7YquMSg:zlWRGuCXkV0PSTsd69zFtgElYHMe9zI

Score

1^/10

Malware Config

Signatures

Files

e3561539c59530e68adf973a6a8de4e136758417f77667d504728ecfa2cb5361N
.dll windows:6 windows x64 arch:x64

20717227ccb65afbaea7feeb74196ea2

Code Sign

33:00:00:00:f8:ae:a0:bd:67:8b:63:ac:eb:00:00:00:00:00:f8
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:43

Not After

16/10/2024, 19:43

Subject

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/05/2013, 20:44

Not After

01/05/2028, 20:54

Subject

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:51

Not After

16/10/2024, 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

10:20:0a:0e:54:c8:a6:03:8e:79:ff:04:b1:6c:91:b7:d9:1a:e6:f7:23:96:66:9d:d8:dc:15:37:4f:49:f9:ff
Signer

Actual PE Digest

10:20:0a:0e:54:c8:a6:03:8e:79:ff:04:b1:6c:91:b7:d9:1a:e6:f7:23:96:66:9d:d8:dc:15:37:4f:49:f9:ff

Digest Algorithm

sha256

PE Digest Matches

true

10:20:0a:0e:54:c8:a6:03:8e:79:ff:04:b1:6c:91:b7:d9:1a:e6:f7:23:96:66:9d:d8:dc:15:37:4f:49:f9:ff
Signer

Actual PE Digest

10:20:0a:0e:54:c8:a6:03:8e:79:ff:04:b1:6c:91:b7:d9:1a:e6:f7:23:96:66:9d:d8:dc:15:37:4f:49:f9:ff

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb

Imports

msvcp140

?_Xbad_alloc@std@@YAXXZ

vcruntime140

__std_type_info_destroy_list
_CxxThrowException
memset
__std_exception_copy
memcpy
__C_specific_handler
__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

_aligned_malloc
_callnewh
free
_aligned_free
malloc

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
_cexit
_initterm_e
_initterm
_initialize_narrow_environment
_execute_onexit_table

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
IsProcessorFeaturePresent
DisableThreadLibraryCalls
SetUnhandledExceptionFilter

Exports

Exports

_Aligned_get_default_resource
_Aligned_new_delete_resource
_Aligned_set_default_resource
_Unaligned_get_default_resource
_Unaligned_new_delete_resource
_Unaligned_set_default_resource
null_memory_resource

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20717227ccb65afbaea7feeb74196ea2

Code Sign

33:00:00:00:f8:ae:a0:bd:67:8b:63:ac:eb:00:00:00:00:00:f8Certificate

Extended Key Usages

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14Certificate

Key Usages

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

10:20:0a:0e:54:c8:a6:03:8e:79:ff:04:b1:6c:91:b7:d9:1a:e6:f7:23:96:66:9d:d8:dc:15:37:4f:49:f9:ffSigner

10:20:0a:0e:54:c8:a6:03:8e:79:ff:04:b1:6c:91:b7:d9:1a:e6:f7:23:96:66:9d:d8:dc:15:37:4f:49:f9:ffSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 1024B - Virtual size: 848B

.pdata Size: 1024B - Virtual size: 540B

.rsrc Size: 1024B - Virtual size: 968B

.reloc Size: 512B - Virtual size: 128B

33:00:00:00:f8:ae:a0:bd:67:8b:63:ac:eb:00:00:00:00:00:f8
Certificate

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Certificate

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

10:20:0a:0e:54:c8:a6:03:8e:79:ff:04:b1:6c:91:b7:d9:1a:e6:f7:23:96:66:9d:d8:dc:15:37:4f:49:f9:ff
Signer

10:20:0a:0e:54:c8:a6:03:8e:79:ff:04:b1:6c:91:b7:d9:1a:e6:f7:23:96:66:9d:d8:dc:15:37:4f:49:f9:ff
Signer

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 1024B - Virtual size: 848B

.pdata
Size: 1024B - Virtual size: 540B

.rsrc
Size: 1024B - Virtual size: 968B

.reloc
Size: 512B - Virtual size: 128B