21a4cfe6fb65d1a4b2735b81615afae2ef896bc641e08a60920891fa4eb3b037N

Sharing

Copy URL Twitter E-mail

General

Target

21a4cfe6fb65d1a4b2735b81615afae2ef896bc641e08a60920891fa4eb3b037N
Size

548KB
MD5

07036739ce13a944fd520dd7f6514f70
SHA1

cd9964d00513ddf3789dfcf15dc52ec314c664b9
SHA256

21a4cfe6fb65d1a4b2735b81615afae2ef896bc641e08a60920891fa4eb3b037
SHA512

b821945ec92fd3f5aeb118d6078c6729ec3ef4e6d0a45ff5223d4d4bb6d743fe82f3810666e2a45c4fab60cf1cd0854ee10f4567b616e1f332e8c2cc3b8be42e
SSDEEP

12288:PXj4L2uVT2IccQ7SHdHvDUX6tSatusXmswLoqrJ:PXhufclW9HbUR6yl

Score

1^/10

Malware Config

Signatures

Files

21a4cfe6fb65d1a4b2735b81615afae2ef896bc641e08a60920891fa4eb3b037N
.dll windows:6 windows x64 arch:x64

dcb079037ee55120cdb849ecaf4f664f

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:7d:fd:bb:d1:fd:72:ae:6b:d5:5e:fb:36:2c:ae:e1
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

15/05/2023, 00:00

Not After

14/05/2026, 23:59

Subject

CN=The MathWorks\, Inc.,O=The MathWorks\, Inc.,L=Natick,ST=Massachusetts,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\TEMP\batserve\win64\curl\builds\libcurl-vc-x64-release-dll-ssl-dll-zlib-dll-ssh2-dll-ipv6-sspi-schannel-obj-lib\libcurl.pdb

Imports

libssl-3-x64-mw

SSL_CTX_set_msg_callback
SSL_CTX_sess_set_new_cb
SSL_CTX_set_alpn_protos
SSL_get0_alpn_selected
SSL_CTX_set_keylog_callback
SSL_CTX_set_cipher_list
SSL_CTX_new
OPENSSL_init_ssl
SSL_get_ex_data
SSL_set_ex_data
SSL_get_verify_result
SSL_get_shutdown
SSL_get_privatekey
SSL_get_certificate
SSL_set_connect_state
SSL_CTX_add_client_CA
SSL_alert_desc_string_long
SSL_CTX_set_post_handshake_auth
SSL_shutdown
TLS_client_method
SSL_get_version
SSL_get_error
SSL_CTX_ctrl
SSL_ctrl
SSL_write
SSL_read
SSL_connect
SSL_free
SSL_new
SSL_CTX_check_private_key
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_default_passwd_cb
SSL_CTX_use_certificate
SSL_CTX_use_PrivateKey
SSL_CTX_set_verify
SSL_get_peer_cert_chain
SSL_get1_peer_certificate
SSL_set_session
SSL_SESSION_free
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_file
SSL_CTX_use_PrivateKey_file
SSL_CTX_set_ciphersuites
SSL_set_bio
SSL_pending
SSL_CIPHER_get_name
SSL_get_current_cipher
SSL_CTX_set_cert_store
SSL_CTX_get_cert_store
SSL_CTX_free
SSL_CTX_set_options

libcrypto-3-x64-mw

ENGINE_init
ENGINE_finish
ENGINE_load_private_key
ENGINE_set_default
ENGINE_get_id
UI_get0_user_data
OCSP_basic_verify
OCSP_crl_reason_str
ENGINE_free
OCSP_cert_status_str
OCSP_response_status_str
ENGINE_ctrl_cmd
ENGINE_ctrl
ENGINE_by_id
ENGINE_get_next
ENGINE_get_first
UI_set_result
UI_get_input_flags
UI_get_string_type
UI_method_get_closer
UI_method_get_reader
UI_method_get_writer
UI_method_get_opener
UI_method_set_closer
UI_method_set_reader
UI_method_set_writer
UI_method_set_opener
MD5_Init
MD5_Update
MD5_Final
EVP_MD_CTX_new
EVP_MD_CTX_free
EVP_DigestInit_ex
EVP_DigestUpdate
EVP_DigestFinal_ex
EVP_sha256
OPENSSL_sk_num
OPENSSL_sk_value
OPENSSL_sk_pop_free
OPENSSL_sk_pop
OpenSSL_version
CRYPTO_malloc
CRYPTO_free
BIO_set_flags
BIO_clear_flags
BIO_s_file
BIO_new
BIO_free
BIO_set_data
BIO_get_data
BIO_set_init
BIO_set_shutdown
BIO_get_shutdown
BIO_puts
BIO_ctrl
BIO_s_mem
UI_destroy_method
BIO_printf
BIO_meth_new
BIO_meth_free
BIO_meth_set_write
BIO_meth_set_read
BIO_meth_set_ctrl
BIO_meth_set_create
BIO_meth_set_destroy
BN_num_bits
BN_clear_free
BN_print
ASN1_STRING_length
OCSP_CERTID_free
d2i_OCSP_RESPONSE
OCSP_RESPONSE_free
OCSP_BASICRESP_free
OCSP_check_validity
OCSP_resp_find_status
OCSP_response_get1_basic
OCSP_response_status
OCSP_cert_to_id
d2i_PKCS12_bio
PKCS12_parse
PKCS12_PBE_add
PKCS12_free
ERR_error_string_n
ERR_clear_error
ERR_peek_last_error
ERR_peek_error
ERR_get_error
X509_check_issued
X509V3_EXT_print
GENERAL_NAMES_free
RAND_status
RAND_bytes
PEM_read_bio_PrivateKey
PEM_read_bio_X509_AUX
PEM_write_bio_X509
PEM_read_bio_X509
PEM_X509_INFO_read_bio
X509_PUBKEY_get0_param
X509_EXTENSION_get_data
X509_EXTENSION_get_object
X509_get_ext_d2i
X509_NAME_ENTRY_get_data
X509_NAME_get_entry
X509_NAME_get_index_by_NID
X509_NAME_print_ex
X509_get_pubkey
X509_get0_extensions
X509_get_X509_PUBKEY
X509_get0_notAfter
X509_get0_notBefore
X509_get_subject_name
X509_get_issuer_name
X509_get_serialNumber
X509_get_version
X509_INFO_free
X509_get0_signature
d2i_X509
X509_free
i2d_X509_PUBKEY
X509_ALGOR_get0
d2i_PrivateKey_bio
d2i_X509_bio
X509_verify_cert_error_string
X509_STORE_load_path
X509_STORE_load_file
X509_load_crl_file
X509_STORE_add_crl
X509_STORE_add_cert
X509_LOOKUP_file
X509_STORE_add_lookup
X509_STORE_set_flags
X509_STORE_up_ref
X509_STORE_free
RSA_flags
UI_create_method
BIO_new_mem_buf
RSA_free
EVP_PKEY_get_bn_param
EVP_PKEY_copy_parameters
EVP_PKEY_free
EVP_PKEY_get1_RSA
EVP_PKEY_get_id
EVP_sha1
EVP_DigestInit
ASN1_STRING_print
ASN1_TIME_print
ASN1_STRING_to_UTF8
i2t_ASN1_OBJECT
i2a_ASN1_OBJECT
ASN1_STRING_get0_data
ASN1_STRING_type
UI_OpenSSL

zlib1

inflateEnd
inflateInit_
inflateInit2_
inflate
zlibVersion

libssh2

libssh2_sftp_rmdir_ex
libssh2_sftp_mkdir_ex
libssh2_sftp_statvfs
libssh2_sftp_unlink_ex
libssh2_sftp_rename_ex
libssh2_sftp_seek64
libssh2_sftp_close_handle
libssh2_sftp_write
libssh2_sftp_readdir_ex
libssh2_sftp_read
libssh2_sftp_open_ex
libssh2_sftp_last_error
libssh2_sftp_shutdown
libssh2_sftp_init
libssh2_agent_free
libssh2_agent_disconnect
libssh2_agent_userauth
libssh2_agent_get_identity
libssh2_agent_list_identities
libssh2_agent_connect
libssh2_agent_init
libssh2_knownhost_get
libssh2_knownhost_writefile
libssh2_knownhost_readfile
libssh2_knownhost_free
libssh2_knownhost_del
libssh2_knownhost_checkp
libssh2_knownhost_add
libssh2_knownhost_init
libssh2_sftp_stat_ex
libssh2_scp_send64
libssh2_scp_recv2
libssh2_channel_free
libssh2_channel_wait_closed
libssh2_channel_wait_eof
libssh2_channel_send_eof
libssh2_session_set_blocking
libssh2_channel_write_ex
libssh2_channel_read_ex
libssh2_userauth_keyboard_interactive_ex
libssh2_userauth_publickey_fromfile_ex
libssh2_userauth_password_ex
libssh2_userauth_authenticated
libssh2_userauth_list
libssh2_session_flag
libssh2_session_block_directions
libssh2_session_last_errno
libssh2_session_last_error
libssh2_session_method_pref
libssh2_session_hostkey
libssh2_hostkey_hash
libssh2_session_free
libssh2_session_disconnect_ex
libssh2_session_handshake
libssh2_session_callback_set
libssh2_session_abstract
libssh2_session_init_ex
libssh2_exit
libssh2_init
libssh2_version
libssh2_sftp_symlink_ex

ws2_32

WSAStartup
select
bind
connect
WSAGetLastError
htonl
ioctlsocket
WSAWaitForMultipleEvents
WSASetEvent
getpeername
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
getsockname
getsockopt
htons
WSACloseEvent
listen
accept
send
closesocket
__WSAFDIsSet
gethostname
freeaddrinfo
getaddrinfo
WSAIoctl
WSASetLastError
socket
setsockopt
recv
ntohs
WSACleanup

advapi32

CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateChain
CertFindCertificateInStore
CryptStringToBinaryW
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertFreeCertificateChain

normaliz

IdnToUnicode
IdnToAscii

bcrypt

BCryptGenRandom

kernel32

GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetProcAddress
CloseHandle
WaitForSingleObjectEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetEnvironmentVariableA
Sleep
MoveFileExW
GetLastError
SetLastError
FormatMessageW
QueryPerformanceFrequency
GetSystemDirectoryW
LoadLibraryW
QueryPerformanceCounter
GetTickCount
VerSetConditionMask
GetModuleHandleA
VerifyVersionInfoW
CompareFileTime
GetSystemTimeAsFileTime
CreateFileW
GetFileSizeEx
ReadFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess

vcruntime140

strrchr
memchr
memmove
memcmp
wcschr
strstr
__C_specific_handler
__std_type_info_destroy_list
memcpy
strchr
memset

api-ms-win-crt-string-l1-1-0

strpbrk
wcsncpy
_wcsdup
strncpy
strspn
strcmp
_strdup
wcsncmp
wcspbrk
strcspn
strncmp

api-ms-win-crt-stdio-l1-1-0

setvbuf
fflush
__stdio_common_vsscanf
__stdio_common_vsprintf
fputc
fseek
fputs
fclose
_fseeki64
__acrt_iob_func
_fileno
_close
feof
fgets
ftell
_wopen
_wfopen
fread
fwrite

api-ms-win-crt-convert-l1-1-0

wcstombs
strtoll
atoi
strtoul
strtol

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64
_time64

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_cexit
_execute_onexit_table
_initialize_onexit_table
_beginthreadex
__sys_errlist
__sys_nerr
_configure_narrow_argv
_errno
_seh_filter_dll
_initterm
_initterm_e

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_waccess
_unlink
_fstat64
_wstat64

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc
realloc

api-ms-win-crt-math-l1-1-0

_fdopen

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_header
curl_easy_init
curl_easy_nextheader
curl_easy_option_by_id
curl_easy_option_by_name
curl_easy_option_next
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_global_trace
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_get_handles
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_url_strerror
curl_version
curl_version_info
curl_ws_meta
curl_ws_recv
curl_ws_send

Sections

.text
Size: 392KB - Virtual size: 392KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dcb079037ee55120cdb849ecaf4f664f

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

04:7d:fd:bb:d1:fd:72:ae:6b:d5:5e:fb:36:2c:ae:e1Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libssl-3-x64-mw

libcrypto-3-x64-mw

zlib1

libssh2

ws2_32

advapi32

crypt32

normaliz

bcrypt

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 392KB - Virtual size: 392KB

.rdata Size: 113KB - Virtual size: 112KB

.data Size: 9KB - Virtual size: 12KB

.pdata Size: 18KB - Virtual size: 18KB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 2KB - Virtual size: 2KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:7d:fd:bb:d1:fd:72:ae:6b:d5:5e:fb:36:2c:ae:e1
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

.text
Size: 392KB - Virtual size: 392KB

.rdata
Size: 113KB - Virtual size: 112KB

.data
Size: 9KB - Virtual size: 12KB

.pdata
Size: 18KB - Virtual size: 18KB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 2KB - Virtual size: 2KB