qeUaxJCA3FoS[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

qeUaxJCA3FoS.exe
Size

617KB
MD5

6d3904cd8ecc9127dfd7e0a5c4fb9098
SHA1

f5e28bf962f20a0ebc6df8a4be4e6fa037fc0569
SHA256

d766e852367b4306548dd3da8abe93175732af2052369155c48d958556dccde4
SHA512

bbffcc9c25f5c906308b4d515b5b1b4b23f3023436e1fded7acb7af6a8fb05d41e1f6712ea3c5d767d2388de49fdc5e5f18b416b3a1f4c48eeae7a81a99f9143
SSDEEP

12288:uhnL9BvdSgq4WhO6JI1TKWP2Tpc1pcBpR0Bj3APRZIbFxviYNTSaD8PnWep:mnLz9qHO1TKW+pc1pcBpaBwPRZI/vigq

Score

1^/10

Malware Config

Signatures

Files

qeUaxJCA3FoS.exe
.exe windows:6 windows x86 arch:x86

e82485ff5ec74b13b6a224430febbae6

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

13/05/2022, 00:00

Not After

14/05/2025, 23:59

Subject

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f6:22:ce:af:c7:96:08:2f:bf:0c:27:d3:ed:87:3a:39:d2:4b:96:66:65:7a:c9:60:a6:20:62:d0:82:ab:29:a9
Signer

Actual PE Digest

f6:22:ce:af:c7:96:08:2f:bf:0c:27:d3:ed:87:3a:39:d2:4b:96:66:65:7a:c9:60:a6:20:62:d0:82:ab:29:a9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libcurl

curl_easy_cleanup
curl_easy_perform
curl_easy_setopt
curl_easy_init

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW
PathIsDirectoryW
PathRemoveFileSpecW
PathFindExtensionW
PathFileExistsA
PathFileExistsW

kernel32

HeapReAlloc
CreateFileW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
CreateDirectoryW
DeleteFileW
OutputDebugStringW
Sleep
CreateThread
GetCurrentThreadId
MulDiv
lstrcmpW
lstrcpyW
lstrlenW
MoveFileW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CloseHandle
GetLastError
SetEndOfFile
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
ReadConsoleW
GetConsoleMode
InitializeCriticalSection
TryAcquireSRWLockExclusive
SetFilePointerEx
GetFileType
HeapFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObjectEx
GetExitCodeThread
WriteConsoleW
WakeConditionVariable
InitializeCriticalSectionEx
GetLocaleInfoEx
EncodePointer
DecodePointer
LCMapStringEx
GetProcAddress
GetStringTypeW
CompareStringEx
GetCPInfo
RaiseException
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ReadFile
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile

user32

MessageBoxA
GetWindowRect
SetWindowTextW
ReleaseDC
FindWindowExW
GetDlgItemTextW
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
EndDialog
DialogBoxParamW
SetWindowPos
CreateWindowExW
SendMessageW
SetWindowsHookExW
MessageBoxW
UnhookWindowsHookEx
CallNextHookEx
LoadImageW
SystemParametersInfoW
GetDC

gdi32

GetDeviceCaps

shell32

SHFileOperationW
ShellExecuteW
SHGetFolderPathW

Sections

.text
Size: 481KB - Virtual size: 481KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e82485ff5ec74b13b6a224430febbae6

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4aCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

f6:22:ce:af:c7:96:08:2f:bf:0c:27:d3:ed:87:3a:39:d2:4b:96:66:65:7a:c9:60:a6:20:62:d0:82:ab:29:a9Signer

Headers

DLL Characteristics

File Characteristics

Imports

libcurl

comctl32

shlwapi

kernel32

user32

gdi32

shell32

Sections

.text Size: 481KB - Virtual size: 481KB

.rdata Size: 92KB - Virtual size: 91KB

.data Size: 10KB - Virtual size: 14KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 18KB - Virtual size: 18KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

f6:22:ce:af:c7:96:08:2f:bf:0c:27:d3:ed:87:3a:39:d2:4b:96:66:65:7a:c9:60:a6:20:62:d0:82:ab:29:a9
Signer

.text
Size: 481KB - Virtual size: 481KB

.rdata
Size: 92KB - Virtual size: 91KB

.data
Size: 10KB - Virtual size: 14KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 18KB - Virtual size: 18KB