8143bc59782feb112b8dd77575a5c31bef848eae333ac503f81bb62ed3abd72fN

Sharing

Copy URL Twitter E-mail

General

Target

8143bc59782feb112b8dd77575a5c31bef848eae333ac503f81bb62ed3abd72fN
Size

20KB
MD5

aad00a17c74ded6cf6ac69cb2d00abe0
SHA1

eab86283548fdd77afb360cffa2d2fb71b5d855e
SHA256

8143bc59782feb112b8dd77575a5c31bef848eae333ac503f81bb62ed3abd72f
SHA512

2eb601e9e0c37688f7996802096a8c26dacf167744f844d6de6535fc30d0940a8f3f69f799fcbe7137939117b1b5220ec2535923fd7fe91f7499b8f4bcb997e2
SSDEEP

384:tAYKtP25CGTtRjwTWVW+BYvtUmZvIYiBwtYxE:tAYme5VADUMQYiBwt9

Score

1^/10

Malware Config

Signatures

Files

8143bc59782feb112b8dd77575a5c31bef848eae333ac503f81bb62ed3abd72fN
.dll windows:6 windows x86 arch:x86

3ac89122f44b21d2adeafd2e2054db45

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:b5:35:26:dd:9e:3f:80:81:49:52:e2:12:ff:b1:c4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

30/08/2022, 00:00

Not After

02/10/2025, 23:59

Subject

CN=CHENGDU YIWO Tech Development Co.\, Ltd.,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

47:8a:15:69:cb:55:a3:eb:8f:db:b1:7e:ea:ef:fd:05:91:6f:d1:84:6d:23:1a:e7:aa:a1:1f:a1:1a:c4:ee:66
Signer

Actual PE Digest

47:8a:15:69:cb:55:a3:eb:8f:db:b1:7e:ea:ef:fd:05:91:6f:d1:84:6d:23:1a:e7:aa:a1:1f:a1:1a:c4:ee:66

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\_work\pctrans\code\EGC\Output\Win32\Release\MemGather.pdb

Imports

kernel32

InitializeCriticalSectionEx
GetLastError
DeleteCriticalSection
LoadLibraryA
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead

vcruntime140

memset
_purecall
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
_except_handler4_common

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_initterm
_initterm_e
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll

Exports

Exports

GetImp

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 748B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ac89122f44b21d2adeafd2e2054db45

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0a:b5:35:26:dd:9e:3f:80:81:49:52:e2:12:ff:b1:c4Certificate

Extended Key Usages

Key Usages

47:8a:15:69:cb:55:a3:eb:8f:db:b1:7e:ea:ef:fd:05:91:6f:d1:84:6d:23:1a:e7:aa:a1:1f:a1:1a:c4:ee:66Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 748B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0a:b5:35:26:dd:9e:3f:80:81:49:52:e2:12:ff:b1:c4
Certificate

47:8a:15:69:cb:55:a3:eb:8f:db:b1:7e:ea:ef:fd:05:91:6f:d1:84:6d:23:1a:e7:aa:a1:1f:a1:1a:c4:ee:66
Signer

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 748B