33a6d9f8c25ad499dd06d17d41422e7c267aa8f61f82962983680ee4d3fa4393

Sharing

Copy URL Twitter E-mail

General

Target

33a6d9f8c25ad499dd06d17d41422e7c267aa8f61f82962983680ee4d3fa4393
Size

336KB
MD5

c74e0bdee653756e19597ddf68aa7254
SHA1

8ad1e31185a7caec42a1f37655a8388bca979a4a
SHA256

33a6d9f8c25ad499dd06d17d41422e7c267aa8f61f82962983680ee4d3fa4393
SHA512

1b8a653a34b16c8015d51994ef1fbf6d180f5778491b6341f28a0e1036a406d43e0f01dc9496cb83970be0d92a6eb5175f0125469dd293d9381a5b3a68005d7f
SSDEEP

6144:SjIfAUMLbHQMGr0LQw5EKsBK4xJQrXkzskXjM/BMm2p3:RQoNQ16D5cowv5Mm2p3

Score

1^/10

Malware Config

Signatures

Files

33a6d9f8c25ad499dd06d17d41422e7c267aa8f61f82962983680ee4d3fa4393
.dll windows:4 windows x64 arch:x64

10fc2fe96132a719b5b0abdfbdc2fda9

Code Sign

03:4a:44:75:70:d9:70:98:24:09:eb:b3:da:98:b6:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

16/03/2021, 00:00

Not After

18/05/2022, 23:59

Subject

CN=Eclipse.org Foundation\, Inc.,OU=IT,O=Eclipse.org Foundation\, Inc.,L=Ottawa,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c157765626d61737465724065636c697073652e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

fa:0a:18:64:56:d0:ec:52:aa:f4:8a:eb:f8:89:28:14:1e:b3:21:4c
Signer

Actual PE Digest

fa:0a:18:64:56:d0:ec:52:aa:f4:8a:eb:f8:89:28:14:1e:b3:21:4c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateEventW
CreateNamedPipeW
CreateProcessW
DeleteCriticalSection
EnterCriticalSection
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetLastError
GetModuleFileNameW
GetOverlappedResult
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
GetVersion
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalFree
OpenProcess
OutputDebugStringW
PeekNamedPipe
QueryPerformanceCounter
ReadFile
ResetEvent
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEvent
SetHandleInformation
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

__dllonexit
__iob_func
_amsg_exit
_beginthread
_errno
_initterm
_lock
_onexit
_unlock
abort
calloc
free
fwrite
malloc
memcpy
memset
realloc
signal
strlen
strncmp
vfprintf
wcscat
wcschr
wcscmp
wcslen
wcsncpy
wcsrchr
_vsnwprintf
_wcsdup

user32

AttachThreadInput
EnumWindows
GetClassNameW
GetForegroundWindow
GetWindowThreadProcessId
MapVirtualKeyW
SetForegroundWindow
keybd_event

Exports

Exports

Java_org_eclipse_cdt_utils_spawner_SpawnerInputStream_available0
Java_org_eclipse_cdt_utils_spawner_SpawnerInputStream_close0
Java_org_eclipse_cdt_utils_spawner_SpawnerInputStream_read0
Java_org_eclipse_cdt_utils_spawner_SpawnerOutputStream_close0
Java_org_eclipse_cdt_utils_spawner_SpawnerOutputStream_write0
Java_org_eclipse_cdt_utils_spawner_Spawner_configureNativeTrace
Java_org_eclipse_cdt_utils_spawner_Spawner_exec0
Java_org_eclipse_cdt_utils_spawner_Spawner_exec1
Java_org_eclipse_cdt_utils_spawner_Spawner_exec2
Java_org_eclipse_cdt_utils_spawner_Spawner_raise
Java_org_eclipse_cdt_utils_spawner_Spawner_waitFor

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 783B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10fc2fe96132a719b5b0abdfbdc2fda9

Code Sign

03:4a:44:75:70:d9:70:98:24:09:eb:b3:da:98:b6:9dCertificate

Extended Key Usages

Key Usages

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

fa:0a:18:64:56:d0:ec:52:aa:f4:8a:eb:f8:89:28:14:1e:b3:21:4cSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

user32

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 19KB

.data Size: 512B - Virtual size: 80B

.rdata Size: 5KB - Virtual size: 4KB

.pdata Size: 1024B - Virtual size: 912B

.xdata Size: 1024B - Virtual size: 820B

.bss Size: - Virtual size: 2KB

.edata Size: 1024B - Virtual size: 783B

.idata Size: 3KB - Virtual size: 3KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 104B

.reloc Size: 512B - Virtual size: 108B

/4 Size: 1024B - Virtual size: 704B

/19 Size: 223KB - Virtual size: 223KB

/31 Size: 7KB - Virtual size: 7KB

/45 Size: 7KB - Virtual size: 7KB

/57 Size: 2KB - Virtual size: 2KB

/70 Size: 1KB - Virtual size: 1KB

/81 Size: 11KB - Virtual size: 11KB

/92 Size: 1KB - Virtual size: 1KB

03:4a:44:75:70:d9:70:98:24:09:eb:b3:da:98:b6:9d
Certificate

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

fa:0a:18:64:56:d0:ec:52:aa:f4:8a:eb:f8:89:28:14:1e:b3:21:4c
Signer

.text
Size: 20KB - Virtual size: 19KB

.data
Size: 512B - Virtual size: 80B

.rdata
Size: 5KB - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 912B

.xdata
Size: 1024B - Virtual size: 820B

.bss
Size: - Virtual size: 2KB

.edata
Size: 1024B - Virtual size: 783B

.idata
Size: 3KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 104B

.reloc
Size: 512B - Virtual size: 108B

/4
Size: 1024B - Virtual size: 704B

/19
Size: 223KB - Virtual size: 223KB

/31
Size: 7KB - Virtual size: 7KB

/45
Size: 7KB - Virtual size: 7KB

/57
Size: 2KB - Virtual size: 2KB

/70
Size: 1KB - Virtual size: 1KB

/81
Size: 11KB - Virtual size: 11KB

/92
Size: 1KB - Virtual size: 1KB