2fb59f7698a1ec5f801292ec4c63dcdf256b96d0a199eb7acd014dd8f7c6dad0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

2fb59f7698a1ec5f801292ec4c63dcdf256b96d0a199eb7acd014dd8f7c6dad0.exe
Size

5.3MB
MD5

5a64f8b68c232aa482411d1638011b6b
SHA1

5fb42bb34d255acef944d560606b7bc78b0b00fc
SHA256

2fb59f7698a1ec5f801292ec4c63dcdf256b96d0a199eb7acd014dd8f7c6dad0
SHA512

44654112555c3c8f7036547593953f07dad07bc4a11a0e8e26720a3a9fedbf4d4a83e418a64117ba405bd723f2e4a149063f03dd605e2835b3b94b348ebf3bd5
SSDEEP

98304:4aHpWI0k8jKXTXvpDMoeaJCFR9sraDAuuY94onZJO1BS16NHG:aI38jM9ARKraDGY1nDOOqHG

Score

1^/10

Malware Config

Signatures

Files

2fb59f7698a1ec5f801292ec4c63dcdf256b96d0a199eb7acd014dd8f7c6dad0.exe
.dll windows:6 windows x64 arch:x64

e621a1a023607281564c146f7b3a29b6

Code Sign

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-07-2015 00:00

Not After

26-07-2018 23:59

Subject

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

16:91:39:8c:09:24:77:d6
Certificate

Issuer

SERIALNUMBER=VxnFNSrl,CN=conspiracy.rip,OU=conspiracy,O=conspiracy,C=cn+C=CN,1.2.840.113549.1.9.1=#0c19636f6e7370697261637940636f6e737069726163792e726970,2.5.4.42=#130a636f6e73706972616379,2.5.4.13=#130a636f6e73706972616379,2.5.4.12=#130a636f6e73706972616379,1.2.840.113549.1.9.1=#0c19636f6e7370697261637940636f6e737069726163792e726970

Not Before

25-03-2008 17:46

Not After

20-11-2024 17:46

Subject

SERIALNUMBER=VxnFNSrl,CN=conspiracy.rip,OU=conspiracy,O=conspiracy,C=cn+C=CN,1.2.840.113549.1.9.1=#0c19636f6e7370697261637940636f6e737069726163792e726970,2.5.4.42=#130a636f6e73706972616379,2.5.4.13=#130a636f6e73706972616379,2.5.4.12=#130a636f6e73706972616379,1.2.840.113549.1.9.1=#0c19636f6e7370697261637940636f6e737069726163792e726970

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7f:ec:89:34:73:e2:af:a4:8f:10:cb:e3:28:2b:97:3d:ef:f1:94:34
Signer

Actual PE Digest

7f:ec:89:34:73:e2:af:a4:8f:10:cb:e3:28:2b:97:3d:ef:f1:94:34

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

AcquireSRWLockExclusive
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

MessageBoxA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 277KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable
Size: - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.retplne
Size: - Virtual size: 200B

.tls
Size: - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e621a1a023607281564c146f7b3a29b6

Code Sign

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18Certificate

Extended Key Usages

Key Usages

16:91:39:8c:09:24:77:d6Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

7f:ec:89:34:73:e2:af:a4:8f:10:cb:e3:28:2b:97:3d:ef:f1:94:34Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

wtsapi32

Sections

.text Size: - Virtual size: 277KB

.rdata Size: - Virtual size: 74KB

.data Size: - Virtual size: 2.8MB

.pdata Size: - Virtual size: 6KB

.00cfg Size: - Virtual size: 56B

.fptable Size: - Virtual size: 256B

.retplne Size: - Virtual size: 200B

.tls Size: - Virtual size: 9B

_RDATA Size: - Virtual size: 500B

.vmp0 Size: - Virtual size: 3.4MB

.vmp1 Size: 5.3MB - Virtual size: 5.3MB

.reloc Size: 512B - Virtual size: 196B

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Certificate

16:91:39:8c:09:24:77:d6
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

7f:ec:89:34:73:e2:af:a4:8f:10:cb:e3:28:2b:97:3d:ef:f1:94:34
Signer

.text
Size: - Virtual size: 277KB

.rdata
Size: - Virtual size: 74KB

.data
Size: - Virtual size: 2.8MB

.pdata
Size: - Virtual size: 6KB

.00cfg
Size: - Virtual size: 56B

.fptable
Size: - Virtual size: 256B

.retplne
Size: - Virtual size: 200B

.tls
Size: - Virtual size: 9B

_RDATA
Size: - Virtual size: 500B

.vmp0
Size: - Virtual size: 3.4MB

.vmp1
Size: 5.3MB - Virtual size: 5.3MB

.reloc
Size: 512B - Virtual size: 196B