6dc8f877146ea45798473308b0ae5774737aad59204c09cb5b46e000601333a3

Sharing

Copy URL

Twitter E-mail

General

Target

6dc8f877146ea45798473308b0ae5774737aad59204c09cb5b46e000601333a3
Size

180KB
MD5

4a31c96ed2c089a57a847023827708ab
SHA1

dca2fcae9e94fd98989cfe1ff71815acec300193
SHA256

6dc8f877146ea45798473308b0ae5774737aad59204c09cb5b46e000601333a3
SHA512

c7f8962773f791558c0de320304798a5d8009affdd170efbc57c2e9ad3aa5efd9a8bfa685ae3c191307d39826bed4c4480406f5ec3f76eb9d0f8af0a4db13065
SSDEEP

3072:W615yKxLF0hLGOKOEyw8GyYGwo2lQBV+UdE+rECWp7hKeJN:55yhCOKOE0GbGvBV+UdvrEFp7hKeJN

Score

1^/10

Malware Config

Signatures

Files

6dc8f877146ea45798473308b0ae5774737aad59204c09cb5b46e000601333a3
.exe windows:4 windows x86 arch:x86

4a6348a43936625a3709f92236fed363

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

03-11-2022 00:00

Not After

02-11-2025 23:59

Subject

CN=AOMEI International Network Limited,O=AOMEI International Network Limited,ST=Hong Kong,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

03-11-2022 00:00

Not After

02-11-2025 23:59

Subject

CN=AOMEI International Network Limited,O=AOMEI International Network Limited,ST=Hong Kong,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

57:ec:6b:43:ac:d0:2d:9c:13:38:26:71:eb:7f:71:cb:8f:0b:03:eb:88:ab:29:f9:ae:dc:31:e0:70:51:95:65
Signer

Actual PE Digest

57:ec:6b:43:ac:d0:2d:9c:13:38:26:71:eb:7f:71:cb:8f:0b:03:eb:88:ab:29:f9:ae:dc:31:e0:70:51:95:65

Digest Algorithm

sha256

PE Digest Matches

false

52:5d:70:75:99:5e:65:e0:e4:be:02:32:0e:73:33:4e:cf:4e:5d:a4
Signer

Actual PE Digest

52:5d:70:75:99:5e:65:e0:e4:be:02:32:0e:73:33:4e:cf:4e:5d:a4

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

ZwClose
ZwCreateFile
RtlInitUnicodeString
_chkstk
_wcsicmp
_wcsnicmp
_alldiv
memcpy
ZwQueryVolumeInformationFile
_allmul
NtLoadDriver
NtUnloadDriver
wcstombs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwQueryDirectoryObject
ZwOpenDirectoryObject
vsprintf
strchr
strncpy
wcsstr
_wcslwr
strstr
_wtoi
_wtoi64
memset
sprintf
strrchr

kernel32

InterlockedCompareExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
InterlockedExchange
LoadLibraryA
GetModuleHandleW
TerminateThread
GetExitCodeProcess
CreatePipe
SetHandleInformation
WideCharToMultiByte
CreateProcessW
OpenFileMappingW
OpenEventW
TerminateProcess
ResetEvent
WaitForSingleObject
SetEvent
UnmapViewOfFile
CloseHandle
CreateEventW
MapViewOfFile
GetLastError
CreateFileMappingW
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcessId
DeviceIoControl
CreateFileW
FlushFileBuffers
SetVolumeMountPointW
Sleep
DeleteVolumeMountPointW
GetVolumeNameForVolumeMountPointW
GetSystemWindowsDirectoryW
GetVersionExW
ReadFile
SetFilePointer
GetCurrentProcess
GetFileAttributesW
WriteFile
GlobalMemoryStatusEx
GetLocalTime
GetModuleFileNameA
CreateFileA
CreateDirectoryA
OutputDebugStringA

advapi32

RegOpenKeyW
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExW
AdjustTokenPrivileges
OpenProcessToken
RegLoadKeyW
RegUnLoadKeyW
RegOpenKeyExW
RegOpenKeyA
RegQueryValueExA
SetSecurityDescriptorDacl

msvcr80

?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__CxxFrameHandler3
_vswprintf
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
wcscpy_s
_swprintf
wcsncpy_s
??_V@YAXPAX@Z
??_U@YAPAXI@Z
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memmove_s
swprintf_s
printf
_localtime64
_time64
strcpy_s
sprintf_s
_beginthreadex
__dllonexit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
_amsg_exit

msvcp80

?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a6348a43936625a3709f92236fed363

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

57:ec:6b:43:ac:d0:2d:9c:13:38:26:71:eb:7f:71:cb:8f:0b:03:eb:88:ab:29:f9:ae:dc:31:e0:70:51:95:65Signer

52:5d:70:75:99:5e:65:e0:e4:be:02:32:0e:73:33:4e:cf:4e:5d:a4Signer

Headers

File Characteristics

Imports

ntdll

kernel32

advapi32

msvcr80

msvcp80

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 1KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

e0:4f:3f:5b:78:ca:4d:71:0f:15:8a:bf:fe:05:0f:97
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

57:ec:6b:43:ac:d0:2d:9c:13:38:26:71:eb:7f:71:cb:8f:0b:03:eb:88:ab:29:f9:ae:dc:31:e0:70:51:95:65
Signer

52:5d:70:75:99:5e:65:e0:e4:be:02:32:0e:73:33:4e:cf:4e:5d:a4
Signer

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 1KB