2b47995108cafa5c8d4de84f71c1507541b7e70f92a2e906050eba0c8e2f3c01N

Sharing

Copy URL

Twitter E-mail

General

Target

2b47995108cafa5c8d4de84f71c1507541b7e70f92a2e906050eba0c8e2f3c01N
Size

304KB
MD5

2d9731e71e1d41cba43e65e485e37080
SHA1

8f2fb0273d7fdc675fdf9c5198f93dc0dfa919ec
SHA256

2b47995108cafa5c8d4de84f71c1507541b7e70f92a2e906050eba0c8e2f3c01
SHA512

29da57290a09851920a5f2eac455bb20cd4b1ddf2676b497b7da3df1fae5d2c41126eafe5c3ee59316daf301f0965ad45d00c318a013bc0211b065c68b75cf86
SSDEEP

6144:nIpKCyUJZcPEOuCOqqXKqmKeAro5VZc+VXOaA7/7Wff+7y:I4+JZcPRQXKrHArGjl10/yO7y

Score

1^/10

Malware Config

Signatures

Files

2b47995108cafa5c8d4de84f71c1507541b7e70f92a2e906050eba0c8e2f3c01N
.dll windows:6 windows x86 arch:x86

49b13c123092c612791caca9ae58bcef

Code Sign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:72:3d:d8:81:ea:d1:3f:16:d3:a5:50:d5:cc:6e:8d
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

05/05/2023, 00:00

Not After

04/05/2026, 23:59

Subject

SERIALNUMBER=615 06 133,CN=MyQ\, spol. s r.o.,O=MyQ\, spol. s r.o.,ST=Praha\, Hlavní město,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:42:88:eb:2e:3a:a6:9e:86:94:4f:4b:96:42:23:fd:f3:b5:30:7a:a3:44:22:bd:f1:2f:b5:19:ef:d4:99:80
Signer

Actual PE Digest

90:42:88:eb:2e:3a:a6:9e:86:94:4f:4b:96:42:23:fd:f3:b5:30:7a:a3:44:22:bd:f1:2f:b5:19:ef:d4:99:80

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\wix\wix\build\dtf\Release\x86\SfxCA.pdb

Imports

kernel32

WriteFile
CloseHandle
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
WaitNamedPipeW
GetOverlappedResult
CancelIo
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
GetExitCodeProcess
CreateThread
CreateProcessW
GetTickCount
GetSystemDirectoryW
GetModuleFileNameW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetTempPathW
Sleep
GetCurrentProcess
GetWindowsDirectoryW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
HeapReAlloc
HeapSize
WriteConsoleW
GetStringTypeW
GetProcessHeap
FreeEnvironmentStringsW
CreateDirectoryW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
WideCharToMultiByte
GetStdHandle
SetEndOfFile
SetStdHandle
LCMapStringW
HeapAlloc
HeapFree
GetModuleHandleExW
ExitProcess
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
EncodePointer
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DecodePointer
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwind
InterlockedFlushSList
RaiseException
GetModuleHandleW
LoadLibraryW
GetProcAddress
FreeLibrary
GetEnvironmentStringsW
GetLastError
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId

advapi32

OpenProcessToken
GetTokenInformation

ole32

StringFromGUID2

oleaut32

SafeArrayCreateVector
SafeArrayPutElement
VariantInit
SysAllocString
SysFreeString
SafeArrayDestroy

msi

ord221
ord135
ord51
ord207
ord139
ord58
ord47
ord103
ord133
ord34
ord171
ord143
ord64
ord63
ord74
ord145
ord49
ord140
ord120
ord123
ord115
ord118
ord116
ord125
ord121
ord114
ord119
ord17
ord150
ord78
ord165
ord26
ord166
ord163
ord160
ord159
ord162
ord32
ord8
ord62
ord76
ord80
ord147
ord142
ord48
ord167
ord54

cabinet

ord20
ord21
ord22
ord23

rpcrt4

UuidCreate

shlwapi

PathFileExistsW

Exports

Exports

RunPowerShellScript
zzzEmbeddedUIHandler
zzzInitializeEmbeddedUI
zzzShutdownEmbeddedUI
zzzzInvokeManagedCustomActionOutOfProcW

Sections

.text
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49b13c123092c612791caca9ae58bcef

Code Sign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

65:72:3d:d8:81:ea:d1:3f:16:d3:a5:50:d5:cc:6e:8dCertificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

90:42:88:eb:2e:3a:a6:9e:86:94:4f:4b:96:42:23:fd:f3:b5:30:7a:a3:44:22:bd:f1:2f:b5:19:ef:d4:99:80Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ole32

oleaut32

msi

cabinet

rpcrt4

shlwapi

Exports

Exports

Sections

.text Size: 97KB - Virtual size: 96KB

.rdata Size: 88KB - Virtual size: 88KB

.data Size: 2KB - Virtual size: 5KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 5KB

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

65:72:3d:d8:81:ea:d1:3f:16:d3:a5:50:d5:cc:6e:8d
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

90:42:88:eb:2e:3a:a6:9e:86:94:4f:4b:96:42:23:fd:f3:b5:30:7a:a3:44:22:bd:f1:2f:b5:19:ef:d4:99:80
Signer

.text
Size: 97KB - Virtual size: 96KB

.rdata
Size: 88KB - Virtual size: 88KB

.data
Size: 2KB - Virtual size: 5KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 5KB