82452b9eb03d183110d0373989aa786ffc47a0c43a6746c86c7a6f57263bbab9

Sharing

Copy URL Twitter E-mail

General

Target
82452b9eb03d183110d0373989aa786ffc47a0c43a6746c86c7a6f57263bbab9
Size 6.5MB
Sample260831-sd4bmsxsdt
SHA256 82452b9eb03d183110d0373989aa786ffc47a0c43a6746c86c7a6f57263bbab9
MD5 d91e1871c479c33115db9050ba193977
SHA1 15bbeb4257ffea7a760006b7476a0b2379bb2490
SHA512 02ceeeb8c0b78ef166e224038de16faf30440f93be85a9e8c849866d567652d7f2f89c5759fa8163869973ac1908c9b2ea0f00c0996b7c59570f37daa3e8612b
SSDEEP 49152:MdMqszxXXz6PycLWcQMTwr+HgMKiD2voCwJ5yr8cPmB4CKolvjdwtlOZCiU5itED:Fq4ZXSJLW3WY6qCgtsKiAufW8CNuIf
TLSH
T177661903BA94CD22D4B9B33797632E2177A7F05C6F57D36B21C897AA3802742AD0535E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

82452b9eb03d183110d0373989aa786ffc47a0c43a6746c86c7a6f57263bbab9

.dll 6.5MB

82452b9eb03d183110d0373989aa786ffc47a0c43a6746c86c7a6f57263bbab9

IMPHASH 9ba9fa9f5ef564e490c0b5232a0de2c9
SHA256 82452b9eb03d183110d0373989aa786ffc47a0c43a6746c86c7a6f57263bbab9
MD5 d91e1871c479c33115db9050ba193977
SHA1 15bbeb4257ffea7a760006b7476a0b2379bb2490
SHA512 02ceeeb8c0b78ef166e224038de16faf30440f93be85a9e8c849866d567652d7f2f89c5759fa8163869973ac1908c9b2ea0f00c0996b7c59570f37daa3e8612b
SSDEEP 49152:MdMqszxXXz6PycLWcQMTwr+HgMKiD2voCwJ5yr8cPmB4CKolvjdwtlOZCiU5itED:Fq4ZXSJLW3WY6qCgtsKiAufW8CNuIf
TLSH
T177661903BA94CD22D4B9B33797632E2177A7F05C6F57D36B21C897AA3802742AD0535E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

2f:a0:67:ff:b7:c0:2e:fd:ca:56:10:96:6d:e4:37:a4:16:ca:96:08:60:fe:b5:36:31:da:bb:0a:01:ca:10:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=Netanya,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Nov 30, 2025

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=Netanya,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=Netanya,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=Netanya,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

07:53:17:46:02:db:61:9d:87:c7:27:c8:fc:16:c4:4d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 25, 2023 - Dec 11, 2025

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

437826

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\cygwin64\home\bat\bat\checkout\zon\build.app_win64r_obf\pkg\win\sdk\certified\lum_sdk32.dll.pdb

advapi32

AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetKeySecurity SetEntriesInAclW SetNamedSecurityInfoW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptImportKey CryptDestroyKey CryptAcquireContextA CryptEncrypt

shlwapi

PathRemoveFileSpecW

winhttp

WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpSendRequest WinHttpReceiveResponse WinHttpReadData WinHttpConnect WinHttpSetOption WinHttpSetStatusCallback WinHttpAddRequestHeaders WinHttpOpen WinHttpCloseHandle

shell32

CommandLineToArgvW SHGetKnownFolderPath

wldap32

ord33 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord35 ord79 ord30 ord200 ord301 ord143

normaliz

IdnToAscii IdnToUnicode

ws2_32

select __WSAFDIsSet bind send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent socket WSASetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs WSASetLastError WSAStartup WSACleanup setsockopt WSAIoctl htons accept connect getsockname htonl listen recv getaddrinfo freeaddrinfo recvfrom sendto getpeername ioctlsocket gethostname getsockopt

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChain

bcrypt

BCryptGenRandom

kernel32

CompareStringW GetTimeFormatW GetDateFormatW SetConsoleCtrlHandler FlushFileBuffers FatalAppExitA FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA CreateSemaphoreW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess CreateEventW InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter SetStdHandle GetModuleHandleW CreateFileW GetCurrentDirectoryW SetCurrentDirectoryW GetFullPathNameW LCMapStringW GetCPInfo GetOEMCP GetACP IsValidCodePage GetProcessHeap GetCurrentThread GetConsoleCP WriteFile GetStartupInfoW ReadConsoleW GetConsoleMode HeapSize AreFileApisANSI GetModuleHandleExW ExitProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime GetCommandLineA ExitThread CreateThread SetFilePointerEx GetFileInformationByHandle FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WriteConsoleW WaitForSingleObject GetExitCodeProcess CreateProcessW OutputDebugStringW GetTimeZoneInformation SetEndOfFile GetFullPathNameA SetEnvironmentVariableW SetEnvironmentVariableA GetStringTypeW GetTickCount FindFirstFileExW HeapReAlloc FindClose FindFirstFileW FindNextFileW SetErrorMode GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW GetCommandLineW GetLastError HeapAlloc TerminateThread GetVersionExW GetModuleFileNameW LocalFree WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageW QueryPerformanceCounter GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary GetModuleHandleA LoadLibraryA Sleep MultiByteToWideChar MoveFileExA CloseHandle WaitForSingleObjectEx GetEnvironmentVariableA GetCurrentProcessId GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SleepEx VerSetConditionMask VerifyVersionInfoW CreateFileA GetFileSizeEx EncodePointer DecodePointer HeapFree CreateDirectoryW GetFileAttributesExW SetFileAttributesW DeleteFileW MoveFileExW RaiseException RtlUnwind

?brd_sdk_close@@YGXXZ ?brd_sdk_fix_service_status@@YGXXZ ?brd_sdk_get_consent_choice@@YGHXZ ?brd_sdk_get_tracking_id@@YGPADXZ ?brd_sdk_get_uuid@@YGPADXZ ?brd_sdk_init@@YGXXZ ?brd_sdk_notify_install@@YGXXZ ?brd_sdk_opt_in@@YGXXZ ?brd_sdk_opt_out@@YGXXZ ?brd_sdk_pause@@YGXXZ ?brd_sdk_resume@@YGXXZ ?brd_sdk_set_agree_btn@@YGXPAD@Z ?brd_sdk_set_agree_txt@@YGXW4peer_txt_t@@@Z ?brd_sdk_set_app_name@@YGXPAD@Z ?brd_sdk_set_app_name_color@@YGXPAD@Z ?brd_sdk_set_appid@@YGXPAD@Z ?brd_sdk_set_benefit@@YGXPAD@Z ?brd_sdk_set_benefit_txt@@YGXPAD@Z ?brd_sdk_set_bg_color@@YGXPAD@Z ?brd_sdk_set_btn_color@@YGXPAD@Z ?brd_sdk_set_campaign@@YGXPAD@Z ?brd_sdk_set_choice_change_cb@@YGXP6GXH@Z@Z ?brd_sdk_set_disagree_btn@@YGXPAD@Z ?brd_sdk_set_disagree_txt@@YGXW4not_peer_txt_t@@@Z ?brd_sdk_set_lang@@YGXPAD@Z ?brd_sdk_set_logo_link@@YGXPAD@Z ?brd_sdk_set_on_dialog_closed_cb@@YGXP6GXXZ@Z ?brd_sdk_set_on_dialog_shown_cb@@YGXP6GXXZ@Z ?brd_sdk_set_opt_out@@YGXPAD@Z ?brd_sdk_set_opt_out_txt@@YGXPAD@Z ?brd_sdk_set_service_auto_start@@YGXH@Z ?brd_sdk_set_service_status_change_cb@@YGXP6GXH@Z@Z ?brd_sdk_set_skip_consent_on_init@@YGXE@Z ?brd_sdk_set_test_mode@@YGXE@Z ?brd_sdk_set_tracking_id@@YGXPAD@Z ?brd_sdk_set_txt_color@@YGXPAD@Z ?brd_sdk_show_consent@@YGXXZ ?brd_sdk_start_service@@YGXXZ ?brd_sdk_stop_service@@YGXXZ ?lum_sdk_clear_choice@@YGXXZ ?lum_sdk_enable_beta@@YGXXZ ?lum_sdk_get_bw@@YGPADH@Z ?lum_sdk_get_choice@@YGHXZ ?lum_sdk_init@@YGXPAD@Z ?lum_sdk_init_monitor@@YGXPAD@Z ?lum_sdk_init_ui@@YGXPAD@Z ?lum_sdk_is_supported2@@YGHPAH@Z ?lum_sdk_is_supported@@YGHXZ ?lum_sdk_set_app_name@@YGXPAD@Z ?lum_sdk_set_app_name_color@@YGXPAD@Z ?lum_sdk_set_appid@@YGXPAD@Z ?lum_sdk_set_benefit_txt@@YGXPAD@Z ?lum_sdk_set_bg_color@@YGXPAD@Z ?lum_sdk_set_btn_color@@YGXPAD@Z ?lum_sdk_set_choice_change_cb@@YGXP6GXXZ@Z ?lum_sdk_set_choice_not_peer@@YGXXZ ?lum_sdk_set_choice_peer@@YGXXZ ?lum_sdk_set_dlg_flavour@@YGXW4dlg_flavour_t@@@Z ?lum_sdk_set_dlg_pos@@YGXNN@Z ?lum_sdk_set_dlg_pos_type@@YGXW4dlg_pos_type_t@@@Z ?lum_sdk_set_logo_link@@YGXPAD@Z ?lum_sdk_set_not_peer_txt@@YGXW4not_peer_txt_t@@@Z ?lum_sdk_set_opt_out_txt@@YGXPAD@Z ?lum_sdk_set_peer_txt@@YGXW4peer_txt_t@@@Z ?lum_sdk_set_tos_link@@YGXPAD@Z ?lum_sdk_set_txt_color@@YGXPAD@Z ?lum_sdk_set_txt_culture@@YGXPAD@Z ?lum_sdk_uninit@@YGXXZ _brd_internal_set_dlg_flavour_c@4 _brd_internal_set_dlg_pos_c@16 _brd_internal_set_dlg_pos_type_c@4 _brd_sdk_close_c@0 _brd_sdk_fix_service_status_c@0 _brd_sdk_get_consent_choice_c@0 _brd_sdk_get_tracking_id_c@0 _brd_sdk_get_uuid_c@0 _brd_sdk_init_c@0 _brd_sdk_is_supported_c@0 _brd_sdk_notify_install_c@0 _brd_sdk_opt_in_c@0 _brd_sdk_opt_out_c@0 _brd_sdk_pause_c@0 _brd_sdk_resume_c@0 _brd_sdk_set_agree_btn_c@4 _brd_sdk_set_agree_txt_c@4 _brd_sdk_set_app_name_c@4 _brd_sdk_set_app_name_color_c@4 _brd_sdk_set_appid_c@4 _brd_sdk_set_benefit_c@4 _brd_sdk_set_benefit_txt_c@4 _brd_sdk_set_bg_color_c@4 _brd_sdk_set_btn_color_c@4 _brd_sdk_set_campaign_c@4 _brd_sdk_set_choice_change_cb_c@4 _brd_sdk_set_disagree_btn_c@4 _brd_sdk_set_disagree_txt_c@4 _brd_sdk_set_lang_c@4 _brd_sdk_set_logo_link_c@4 _brd_sdk_set_on_dialog_closed_cb_c@4 _brd_sdk_set_on_dialog_shown_cb_c@4 _brd_sdk_set_opt_out_c@4 _brd_sdk_set_opt_out_txt_c@4 _brd_sdk_set_service_auto_start_c@4 _brd_sdk_set_service_status_change_cb_c@4 _brd_sdk_set_skip_consent_on_init_c@4 _brd_sdk_set_test_mode_c@4 _brd_sdk_set_tracking_id_c@4 _brd_sdk_set_txt_color_c@4 _brd_sdk_show_consent_c@0 _brd_sdk_start_service_c@0 _brd_sdk_stop_service_c@0 _dotnet45_cleanup@4 _dotnet45_download@8 _dotnet45_init@4 _dotnet45_install_exec@8 _dotnet45_install_res@8 _dotnet45_verify@4 _lum_sdk_check_peer_c@4 _lum_sdk_check_supported@0 _lum_sdk_clear_choice_c@0 _lum_sdk_enable_beta_c@0 _lum_sdk_get_bw_c@4 _lum_sdk_get_choice_c@0 _lum_sdk_init_c@4 _lum_sdk_init_monitor_c@4 _lum_sdk_init_ui_c@4 _lum_sdk_is_supported2_c@8 _lum_sdk_is_supported_c@0 _lum_sdk_set_app_name_c@4 _lum_sdk_set_app_name_color_c@4 _lum_sdk_set_appid_c@4 _lum_sdk_set_benefit_txt_c@4 _lum_sdk_set_bg_color_c@4 _lum_sdk_set_btn_color_c@4 _lum_sdk_set_choice_change_cb_c@4 _lum_sdk_set_choice_not_peer_c@0 _lum_sdk_set_choice_peer_c@0 _lum_sdk_set_dlg_flavour_c@4 _lum_sdk_set_dlg_pos_c@16 _lum_sdk_set_dlg_pos_type_c@4 _lum_sdk_set_logo_link_c@4 _lum_sdk_set_not_peer_txt_c@4 _lum_sdk_set_opt_out_txt_c@4 _lum_sdk_set_peer_txt_c@4 _lum_sdk_set_tos_link_c@4 _lum_sdk_set_txt_color_c@4 _lum_sdk_set_txt_culture_c@4 _lum_sdk_uninit_c@0

Name

.text

Size

621KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

82452b9eb03d183110d0373989aa786ffc47a0c43a6746c86c7a6f57263bbab9

advapi32

shlwapi

winhttp

shell32

wldap32

normaliz

ws2_32

crypt32

bcrypt

kernel32

generic