5a61ad4df1923874a9a79ab0c775e2d4744ebb687677679501a654758aa0bdde

Sharing

Copy URL

Twitter E-mail

General

Target

5a61ad4df1923874a9a79ab0c775e2d4744ebb687677679501a654758aa0bdde
Size

1.5MB
MD5

ef97b824d8b25ef530d7de2626155503
SHA1

295dadee9759987d419df1febf3e002d6384f09b
SHA256

5a61ad4df1923874a9a79ab0c775e2d4744ebb687677679501a654758aa0bdde
SHA512

f45b006c9650956d1c98fac4d2c1b71bd57baca64e9a6331191d0b6d7f80f872babcf71fe9df259570528a7a496d397414a2d4a6764ea210e25ee9f16cee555e
SSDEEP

24576:xmS10lVcjLvu1Y7H7jBRO9Be4eijhT4XldSt5Y1qSMRGJ/qofN:xfVBoeihT4rSt5A71qo

Score

1^/10

Malware Config

Signatures

Files

5a61ad4df1923874a9a79ab0c775e2d4744ebb687677679501a654758aa0bdde
.dll windows:5 windows x86 arch:x86

4ff33eececbf2846f3e9d82b68a3b921

Code Sign

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-11-2020 00:00

Not After

22-02-2024 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-11-2020 00:00

Not After

22-02-2024 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:b3:e8:d4:6b:b4:64:89:01:38:13:56:40:38:4d:32:0a:5d:ef:29:b6:2d:d7:83:dc:d9:87:e6:07:ea:f0:89
Signer

Actual PE Digest

0f:b3:e8:d4:6b:b4:64:89:01:38:13:56:40:38:4d:32:0a:5d:ef:29:b6:2d:d7:83:dc:d9:87:e6:07:ea:f0:89

Digest Algorithm

sha256

PE Digest Matches

false

4d:ea:63:82:a4:fe:bb:50:1b:39:9a:62:41:d0:97:b4:b6:df:a9:a6
Signer

Actual PE Digest

4d:ea:63:82:a4:fe:bb:50:1b:39:9a:62:41:d0:97:b4:b6:df:a9:a6

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\devops_avsdk\workspace\p-a1600cd8e48243138d3c49b7fc57ac41\src\PC\app\TRAE_Demo\Release\TRAE.pdb

Imports

msvcp140

?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__std_type_info_destroy_list
wcsstr
memmove
memcpy
__CxxFrameHandler3
strrchr
strstr
memset
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
_purecall
_except_handler4_common

api-ms-win-crt-string-l1-1-0

strncat
strncmp
strcat_s
strncpy
_strdup
strncpy_s
wcsncpy_s
wcscpy_s

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free
_callnewh

api-ms-win-crt-runtime-l1-1-0

_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_wassert
terminate
_invalid_parameter_noinfo_noreturn
_initterm
_initterm_e
_seh_filter_dll
_initialize_narrow_environment
_configure_narrow_argv

kernel32

InterlockedIncrement
InterlockedDecrement
GetTickCount
InterlockedExchange
TryEnterCriticalSection
InitializeCriticalSection
GetSystemInfo
CreateDirectoryA
FindFirstFileA
GetVersionExA
GetNativeSystemInfo
WaitForSingleObject
CreateEventW
SetEvent
CloseHandle
SetThreadPriority
GetCurrentThread
lstrcmpiW
VerifyVersionInfoW
VerSetConditionMask
GetVersionExW
FreeLibrary
LoadLibraryW
GetModuleFileNameW
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
GetLastError
DeleteCriticalSection
GetSystemPowerStatus
GetProcAddress
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
GetThreadPriority
CreateThread
Sleep
ReleaseSemaphore
CreateSemaphoreW
MultiByteToWideChar
WideCharToMultiByte
OutputDebugStringA
InterlockedCompareExchange

user32

GetForegroundWindow
GetDesktopWindow
GetSystemMetrics

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-crt-stdio-l1-1-0

fclose
fseek
__stdio_common_vsprintf_s
fwrite
__stdio_common_vsprintf
__stdio_common_vfprintf
fopen
fopen_s
fread

api-ms-win-crt-math-l1-1-0

_libm_sse2_cos_precise
_except1
_libm_sse2_log10_precise
_CItanh
_CIatan2
_isnan
_CIlog10
_CIlog
_libm_sse2_exp_precise
_libm_sse2_sqrt_precise
_CIexp
_CIsin
_CIatan
_CIpow
_CIsqrt
_libm_sse2_log_precise
_CIcos
_CItan
floor
ceil
_libm_sse2_pow_precise

api-ms-win-crt-time-l1-1-0

_localtime64
_time64

api-ms-win-crt-convert-l1-1-0

mbstowcs
_itoa

winmm

waveOutOpen
waveOutGetVolume
waveOutReset
waveOutClose
waveOutUnprepareHeader
waveOutPrepareHeader
mixerGetID
waveOutGetNumDevs
mixerGetDevCapsW
waveOutSetVolume
waveOutWrite
mixerOpen
waveInAddBuffer
waveInStart
waveInOpen
waveInGetDevCapsW
waveInUnprepareHeader
waveInGetNumDevs
waveInPrepareHeader
waveInStop
waveInClose
mixerGetNumDevs
waveInMessage
waveOutMessage
mixerClose
mixerSetControlDetails
mixerGetLineInfoW
mixerGetControlDetailsW
mixerGetLineControlsW
mixerMessage
timeBeginPeriod
timeEndPeriod
timeGetTime
waveOutGetDevCapsW

dsound

ord9
ord8
ord11
ord12
ord3

shell32

SHGetSpecialFolderPathA

ole32

CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoUninitialize
PropVariantClear
CLSIDFromString
CoTaskMemAlloc

Exports

Exports

TRAE_WinDLL_CreateInstance
TRAE_WinDLL_CreateInstanceConfigStr
TRAE_WinDLL_DestroyInstance
TRAE_WinDLL_SetLogFunc

Sections

.text
Size: 745KB - Virtual size: 744KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 471KB - Virtual size: 604KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ff33eececbf2846f3e9d82b68a3b921

Code Sign

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0f:b3:e8:d4:6b:b4:64:89:01:38:13:56:40:38:4d:32:0a:5d:ef:29:b6:2d:d7:83:dc:d9:87:e6:07:ea:f0:89Signer

4d:ea:63:82:a4:fe:bb:50:1b:39:9a:62:41:d0:97:b4:b6:df:a9:a6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp140

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

user32

advapi32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

winmm

dsound

shell32

ole32

Exports

Exports

Sections

.text Size: 745KB - Virtual size: 744KB

.rdata Size: 177KB - Virtual size: 177KB

.data Size: 471KB - Virtual size: 604KB

.gfids Size: 512B - Virtual size: 68B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 34KB - Virtual size: 33KB

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0f:b3:e8:d4:6b:b4:64:89:01:38:13:56:40:38:4d:32:0a:5d:ef:29:b6:2d:d7:83:dc:d9:87:e6:07:ea:f0:89
Signer

4d:ea:63:82:a4:fe:bb:50:1b:39:9a:62:41:d0:97:b4:b6:df:a9:a6
Signer

.text
Size: 745KB - Virtual size: 744KB

.rdata
Size: 177KB - Virtual size: 177KB

.data
Size: 471KB - Virtual size: 604KB

.gfids
Size: 512B - Virtual size: 68B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 34KB - Virtual size: 33KB