General

Malware Config

Signatures

Files

• 0265280c92504ef3bed3d5c300b3ee3f5534e6ccaee3023e00c26ce6433dbf3e

  .exe windows x86

  5a3ffe2b694ff66c40396de468b981aa

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  1a:df:e1:64:53:4c:8a:bb:8c:be:b1:2c:95:41:95:4c

  Certificate

  Issuer

  CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

  Not Before

  07-08-2015 00:00

  Not After

  18-10-2017 23:59

  Subject

  CN=CJSC Computing Forces,OU=IT,O=CJSC Computing Forces,L=Moscow,ST=Moscow,C=RU

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  c2:8d:a3:fd:9d:e9:eb:e9:d7:44:3f:29:dc:12:e5:50:59:7f:ea:08

  Signer

  Actual PE Digest

  c2:8d:a3:fd:9d:e9:eb:e9:d7:44:3f:29:dc:12:e5:50:59:7f:ea:08

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=CJSC Computing Forces,OU=IT,O=CJSC Computing Forces,L=Moscow,ST=Moscow,C=RU

  13-10-2016 11:58

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  ExitProcess

  VerSetConditionMask

  VerifyVersionInfoW

  lstrcmpiW

  LoadLibraryW

  UnregisterWaitEx

  QueryDepthSList

  InterlockedPopEntrySList

  VirtualFree

  lstrlenA

  GetProcessId

  GetCurrentProcess

  GetCommandLineW

  FreeLibrary

  GetModuleFileNameA

  GetComputerNameA

  CreateThread

  OpenSemaphoreA

  LocalAlloc

  WaitForSingleObject

  CreateMutexA

  WideCharToMultiByte

  MultiByteToWideChar

  CreateEventA

  SetEvent

  GetCurrentProcessId

  GetProcAddress

  LoadLibraryA

  CreateDirectoryA

  FindClose

  FindNextFileA

  FindFirstFileA

  GetLastError

  CopyFileA

  LoadResource

  CloseHandle

  Process32Next

  DeleteFileA

  LockResource

  GetFileAttributesA

  Sleep

  CreateToolhelp32Snapshot

  GetModuleHandleA

  FindResourceA

  WTSGetActiveConsoleSessionId

  VirtualProtect

  VirtualAlloc

  GetVersionExW

  GetThreadTimes

  UnregisterWait

  RegisterWaitForSingleObject

  SetThreadAffinityMask

  GetProcessAffinityMask

  GetNumaHighestNodeNumber

  DeleteTimerQueueTimer

  ChangeTimerQueueTimer

  QueryPerformanceCounter

  EnterCriticalSection

  LeaveCriticalSection

  TerminateProcess

  SetLastError

  InitializeCriticalSectionAndSpinCount

  CreateEventW

  SwitchToThread

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  GetTickCount

  GetModuleHandleW

  EncodePointer

  DecodePointer

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  GetStringTypeW

  GetVersionExA

  LCMapStringA

  GetUserDefaultLCID

  GetStringTypeExA

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  ResetEvent

  WaitForSingleObjectEx

  IsDebuggerPresent

  GetStartupInfoW

  GetCurrentThreadId

  InitializeSListHead

  GetStdHandle

  GetFileType

  WriteFile

  GlobalMemoryStatus

  FlushConsoleInputBuffer

  ReleaseSemaphore

  InitializeCriticalSection

  CreateSemaphoreW

  RtlUnwind

  RaiseException

  InterlockedPushEntrySList

  InterlockedFlushSList

  LoadLibraryExW

  CreateFileW

  GetDriveTypeW

  GetFileInformationByHandle

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  GetModuleHandleExW

  GetModuleFileNameW

  SetConsoleCtrlHandler

  ReadFile

  GetConsoleCP

  ExitThread

  FreeLibraryAndExitThread

  GetCurrentThread

  HeapAlloc

  FlushFileBuffers

  GetConsoleMode

  HeapFree

  GetCurrentDirectoryW

  GetFullPathNameW

  GetDateFormatW

  GetTimeFormatW

  IsValidLocale

  EnumSystemLocalesW

  SetStdHandle

  ReadConsoleW

  SetFilePointerEx

  DeleteFileW

  HeapReAlloc

  GetTimeZoneInformation

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  GetProcessHeap

  SetConsoleMode

  ReadConsoleInputW

  MoveFileExW

  HeapSize

  WriteConsoleW

  SetEndOfFile

  CreateTimerQueueTimer

  GetLogicalProcessorInformation

  GetThreadPriority

  SetThreadPriority

  SignalObjectAndWait

  CreateTimerQueue

  CreateFileA

  QueryFullProcessImageNameA

  GetTempPathA

  GetCommandLineA

  GetCPInfo

  lstrcatA

  Process32First

  DeleteCriticalSection

  SizeofResource

  TryEnterCriticalSection

  DuplicateHandle

  GetExitCodeThread

  user32

  LoadStringA

  GetProcessWindowStation

  SetTimer

  GetUserObjectInformationW

  TranslateMessage

  DispatchMessageA

  MessageBoxA

  GetMessageA

  advapi32

  ReportEventA

  DeregisterEventSource

  RegisterEventSourceA

  AdjustTokenPrivileges

  CreateProcessAsUserA

  RegCloseKey

  StartServiceCtrlDispatcherA

  SetTokenInformation

  LookupPrivilegeValueA

  GetUserNameA

  OpenProcessToken

  DuplicateTokenEx

  GetTokenInformation

  CloseServiceHandle

  SetServiceStatus

  RegisterServiceCtrlHandlerA

  OpenSCManagerA

  OpenServiceA

  SetSecurityDescriptorDacl

  ConvertSidToStringSidA

  LookupAccountNameA

  InitializeSecurityDescriptor

  CryptAcquireContextA

  CryptCreateHash

  CryptHashData

  CryptDestroyHash

  CryptGetHashParam

  CryptReleaseContext

  RegGetValueA

  RegCreateKeyExA

  RegSetValueExA

  RegOpenKeyExA

  RegDeleteValueA

  shell32

  ShellExecuteExA

  CommandLineToArgvW

  ole32

  CoUninitialize

  CoInitializeEx

  CoCreateInstance

  wtsapi32

  WTSQueryUserToken

  userenv

  CreateEnvironmentBlock

  Sections

  .text

  Size: 1.3MB - Virtual size: 1.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 358KB - Virtual size: 358KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 446KB - Virtual size: 446KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 65KB - Virtual size: 64KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ