1c255212bd876215fd59046722bcd13024a65cb34f7b9003a6af2384bd28f4a1N

Sharing

Copy URL Twitter E-mail

General

Target

1c255212bd876215fd59046722bcd13024a65cb34f7b9003a6af2384bd28f4a1N
Size

48KB
MD5

7bc00659cecc3e9a84d17d9668155e10
SHA1

758f7cff2d9ec6426bcab4d34cea4c32de8c0c44
SHA256

1c255212bd876215fd59046722bcd13024a65cb34f7b9003a6af2384bd28f4a1
SHA512

7050700e165cf28aebd67a44dd2a786ad678857cc9203ba6bb44a78509bb0c1cf665c218e6f01063eeaa182c2f43fa5249746c9b8c0f1121c4ef997cf278bed0
SSDEEP

768:ly4KxKYCKl5j7gKZwX5QpZlUXF1SVcHE4f5I1stnU4dFAMxkELy:5Kxf526k1SVmBf5I1stnU4Px3y

Score

1^/10

Malware Config

Signatures

Files

1c255212bd876215fd59046722bcd13024a65cb34f7b9003a6af2384bd28f4a1N
.dll windows:6 windows x64 arch:x64

6ece61cb378bdb4f44d497ba91eec65f

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

74:a6:8f:ee:73:f7:05:c5:89:6a:66:69:e2:6d:70:29
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

01/05/2023, 00:00

Not After

31/07/2026, 23:59

Subject

CN=K Desktop Environment e. V.,O=K Desktop Environment e. V.,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:3d:df:82:a8:9b:5e:18:90:52:ab:a8:ab:57:41:f8:a9:fa:a7:1e:1d:72:e9:9e:ac:77:b6:84:de:db:8a:6f
Signer

Actual PE Digest

33:3d:df:82:a8:9b:5e:18:90:52:ab:a8:ab:57:41:f8:a9:fa:a7:1e:1d:72:e9:9e:ac:77:b6:84:de:db:8a:6f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\_w\1\b\bin\amd64\_overlapped.pdb

Imports

ws2_32

closesocket
WSASend
ntohl
WSAIoctl
WSASendTo
WSAConnect
socket
ntohs
WSAStringToAddressW
WSARecv
WSARecvFrom
inet_ntop
htons
bind
WSAGetLastError

kernel32

ResetEvent
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
ReadFile
CancelIo
SetLastError
WriteFile
RegisterWaitForSingleObject
UnregisterWait
GetQueuedCompletionStatus
CreateFileW
GetModuleHandleA
PostQueuedCompletionStatus
CreateEventW
FormatMessageW
GetLastError
SetEvent
CloseHandle
GetOverlappedResult
GetProcAddress
UnregisterWaitEx
LocalFree
CreateEventA
CreateIoCompletionPort
ConnectNamedPipe
GetCurrentThreadId

python310

PyErr_SetExcFromWindowsErr
PyBuffer_Release
PyArg_ParseTuple
_PyArg_ParseTupleAndKeywordsFast
PyEval_RestoreThread
_Py_TrueStruct
PyArg_Parse
_Py_Dealloc
PyErr_SetFromErrno
_Py_FalseStruct
PyTuple_Type
PyModule_AddType
PyMem_RawFree
PyType_FromModuleAndSpec
PyModule_AddObject
_PyObject_New
PyBytes_FromStringAndSize
PyModuleDef_Init
_PyArg_ParseStack
PyExc_ConnectionRefusedError
PyExc_OSError
PyLong_FromVoidPtr
PyUnicode_FromFormat
_PyBytes_Resize
_PyUnicode_WideCharString_Opt_Converter
PyUnicode_FromString
PyModule_GetState
PyErr_Format
PyLong_FromUnsignedLong
PyExc_ValueError
PyErr_WriteUnraisable
PyErr_SetString
_PyArg_BadArgument
PyTuple_New
_Py_NoneStruct
PyMem_RawMalloc
Py_BuildValue
_PyUnicode_AsUnicode
PyExc_RuntimeError
PyEval_SaveThread
PyImport_ImportModule
PyExc_ConnectionAbortedError
PyBool_FromLong
PyObject_Free

vcruntime140

__std_type_info_destroy_list
memset
memcpy
__C_specific_handler

api-ms-win-crt-string-l1-1-0

iswctype

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm
_initterm_e

Exports

Exports

PyInit__overlapped

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ece61cb378bdb4f44d497ba91eec65f

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

74:a6:8f:ee:73:f7:05:c5:89:6a:66:69:e2:6d:70:29Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

33:3d:df:82:a8:9b:5e:18:90:52:ab:a8:ab:57:41:f8:a9:fa:a7:1e:1d:72:e9:9e:ac:77:b6:84:de:db:8a:6fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

python310

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 288B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

74:a6:8f:ee:73:f7:05:c5:89:6a:66:69:e2:6d:70:29
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

33:3d:df:82:a8:9b:5e:18:90:52:ab:a8:ab:57:41:f8:a9:fa:a7:1e:1d:72:e9:9e:ac:77:b6:84:de:db:8a:6f
Signer

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 288B