51235c124ffc1ae799a31779c6b0529e761e4a758b5f777d359697f7136aa941

Sharing

Copy URL

Twitter E-mail

General

Target

51235c124ffc1ae799a31779c6b0529e761e4a758b5f777d359697f7136aa941
Size

3.6MB
MD5

dba57f36091f7078968f2eac2d490898
SHA1

3bf471132d8e9768565a62adcc402e6594bfbd2c
SHA256

51235c124ffc1ae799a31779c6b0529e761e4a758b5f777d359697f7136aa941
SHA512

5e61b7ccca25dfa53ed07431a5adb6b16e573754efd86f491c0c75e578510c26d40daa44fd061afc7a9abba7beb2b43e7fb9d4f71683f1c230d4fb1b9c77c962
SSDEEP

98304:sCf9JvCbdJIkhc9CM323si+bCgq4vO3bvtrH6tIQA22SUq:vfvCbd6k3MG8i95azAw

Score

1^/10

Malware Config

Signatures

Files

51235c124ffc1ae799a31779c6b0529e761e4a758b5f777d359697f7136aa941
.dll windows:6 windows x64 arch:x64

98377b3a11e85c9f5df631cbe3f35489

Code Sign

33:00:00:00:e7:1a:a6:e3:0b:5e:b4:0a:54:00:00:00:00:00:e7
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/02/2023, 22:33

Not After

31/01/2024, 22:33

Subject

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/05/2013, 20:44

Not After

01/05/2028, 20:54

Subject

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:10

Not After

31/01/2024, 20:10

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8e:01:ea:86:49:fd:37:bb:2c:59:90:3c:e2:5c:31:29:ae:e8:0d:46:3b:5a:44:7b:5f:66:b0:a8:4f:61:1f:9d
Signer

Actual PE Digest

8e:01:ea:86:49:fd:37:bb:2c:59:90:3c:e2:5c:31:29:ae:e8:0d:46:3b:5a:44:7b:5f:66:b0:a8:4f:61:1f:9d

Digest Algorithm

sha256

PE Digest Matches

false

8e:01:ea:86:49:fd:37:bb:2c:59:90:3c:e2:5c:31:29:ae:e8:0d:46:3b:5a:44:7b:5f:66:b0:a8:4f:61:1f:9d
Signer

Actual PE Digest

8e:01:ea:86:49:fd:37:bb:2c:59:90:3c:e2:5c:31:29:ae:e8:0d:46:3b:5a:44:7b:5f:66:b0:a8:4f:61:1f:9d

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

Exports

Exports

AddApplicationToExceptionListW
RemoveApplicationFromExceptionListW

Sections

.text
Size: - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.$Mz
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.a1:
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.;7R
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98377b3a11e85c9f5df631cbe3f35489

Code Sign

33:00:00:00:e7:1a:a6:e3:0b:5e:b4:0a:54:00:00:00:00:00:e7Certificate

Extended Key Usages

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14Certificate

Key Usages

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

8e:01:ea:86:49:fd:37:bb:2c:59:90:3c:e2:5c:31:29:ae:e8:0d:46:3b:5a:44:7b:5f:66:b0:a8:4f:61:1f:9dSigner

8e:01:ea:86:49:fd:37:bb:2c:59:90:3c:e2:5c:31:29:ae:e8:0d:46:3b:5a:44:7b:5f:66:b0:a8:4f:61:1f:9dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: - Virtual size: 70KB

.rdata Size: - Virtual size: 40KB

.data Size: - Virtual size: 7KB

.pdata Size: - Virtual size: 4KB

_RDATA Size: - Virtual size: 500B

.$Mz Size: - Virtual size: 2.0MB

.a1: Size: 2KB - Virtual size: 2KB

.;7R Size: 3.5MB - Virtual size: 3.5MB

.reloc Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

33:00:00:00:e7:1a:a6:e3:0b:5e:b4:0a:54:00:00:00:00:00:e7
Certificate

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Certificate

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

8e:01:ea:86:49:fd:37:bb:2c:59:90:3c:e2:5c:31:29:ae:e8:0d:46:3b:5a:44:7b:5f:66:b0:a8:4f:61:1f:9d
Signer

8e:01:ea:86:49:fd:37:bb:2c:59:90:3c:e2:5c:31:29:ae:e8:0d:46:3b:5a:44:7b:5f:66:b0:a8:4f:61:1f:9d
Signer

.text
Size: - Virtual size: 70KB

.rdata
Size: - Virtual size: 40KB

.data
Size: - Virtual size: 7KB

.pdata
Size: - Virtual size: 4KB

_RDATA
Size: - Virtual size: 500B

.$Mz
Size: - Virtual size: 2.0MB

.a1:
Size: 2KB - Virtual size: 2KB

.;7R
Size: 3.5MB - Virtual size: 3.5MB

.reloc
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB