3b60b3883ed0d9cc65de0d3f4aa774a065b5a8d3f45506eebee26ddf20b8e065

Sharing

Copy URL

Twitter E-mail

General

Target

3b60b3883ed0d9cc65de0d3f4aa774a065b5a8d3f45506eebee26ddf20b8e065
Size

1.1MB
MD5

e64ffb9762baa56fca2dcf788e671c19
SHA1

8381cebdb657bb18b351a48e0e51c00b454bb0e1
SHA256

3b60b3883ed0d9cc65de0d3f4aa774a065b5a8d3f45506eebee26ddf20b8e065
SHA512

bb9be63aa5c428fd896349effd8c8d0f7c81781237eb02e6f05a63ae271393812ba1f7e0acada59aba9a953a7b072c45034cc254e3fa8a70581301553b2bd84e
SSDEEP

24576:+RSl8mcEehsM7a3a6KzH2bFwHd0STmMJVR:+acTt07cWbFmVR

Score

N/A

Malware Config

Signatures

Files

3b60b3883ed0d9cc65de0d3f4aa774a065b5a8d3f45506eebee26ddf20b8e065
.exe windows x86

0a8ba879f5011473d773d4e33b6a1d58

Code Sign

61:22:f2:09:ce:39:e4:44:b7:f5:9f:76:73:bb:90:7c
Certificate

Issuer

CN=RQJWTUVV

Not Before

19-03-2019 21:51

Not After

31-12-2039 23:59

Subject

CN=RQJWTUVV

Extended Key Usages

ExtKeyUsageCodeSigning

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6e:98:68:1c:10:eb:71:44:6b:f6:ca:96:be:33:32:6e:3d:9c:11:08:a3:45:3e:51:50:68:c6:02:da:46:28:02
Signer

Actual PE Digest

6e:98:68:1c:10:eb:71:44:6b:f6:ca:96:be:33:32:6e:3d:9c:11:08:a3:45:3e:51:50:68:c6:02:da:46:28:02

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=RQJWTUVV

19-03-2019 23:00
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetDriveTypeA
GetDriveTypeW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetLogicalDriveStringsW
GetLogicalDrives
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNumberFormatW
GetOEMCP
GetPrivateProfileIntA
GetPrivateProfileIntW
GetPrivateProfileStringA
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetProcessHeaps
GetProfileIntW
GetShortPathNameA
GetShortPathNameW
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeExW
GetStringTypeW
GetSystemDefaultLCID
GetSystemDefaultLangID
GetSystemDefaultUILanguage
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempFileNameW
GetTempPathA
GetTempPathW
GetThreadLocale
GetThreadPriority
GetThreadTimes
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultUILanguage
GetVersion
GetVersionExA
GetVersionExW
GetVolumeInformationW
GetWindowsDirectoryA
GetWindowsDirectoryW
GlobalAddAtomW
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomW
GlobalFlags
GlobalFree
GlobalGetAtomNameW
GlobalHandle
GlobalLock
GlobalMemoryStatusEx
GlobalReAlloc
GlobalSize
GlobalUnlock
Heap32ListNext
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapQueryInformation
HeapReAlloc
HeapSetInformation
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
IsBadReadPtr
IsDBCSLeadByte
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
GetConsoleMode
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalLock
LocalReAlloc
LocalSize
LocalUnlock
LockFile
LockResource
MapViewOfFile
MoveFileA
MoveFileExA
MoveFileExW
MoveFileW
MulDiv
MultiByteToWideChar
OpenEventW
OpenFile
OpenFileMappingA
OpenMutexW
OpenProcess
OpenSemaphoreA
OpenThread
OutputDebugStringA
OutputDebugStringW
ProcessIdToSessionId
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ReleaseActCtx
ReleaseMutex
RemoveDirectoryA
RemoveDirectoryW
ReplaceFileA
ResetEvent
ResumeThread
RtlUnwind
SearchPathW
SetCommState
SetCommTimeouts
SetComputerNameExA
SetConsoleMode
SetConsoleOutputCP
SetConsoleTextAttribute
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileTime
SetHandleCount
SetLastError
SetProcessWorkingSetSize
SetStdHandle
SetThreadExecutionState
SetThreadLocale
SetThreadPriority
SetUnhandledExceptionFilter
SetVolumeMountPointW
SizeofResource
Sleep
SleepEx
SystemTimeToFileTime
TerminateProcess
Thread32First
Thread32Next
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFile
UnmapViewOfFile
VerLanguageNameA
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteConsoleA
WriteConsoleW
WriteFile
WritePrivateProfileStringA
WritePrivateProfileStringW
WriteProcessMemory
_lclose
_lcreat
_llseek
_lopen
_lread
_lwrite
lstrcatA
lstrcatW
lstrcmpA
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrcpyA
lstrcpyW
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW
GetConsoleFontSize
GetConsoleCP
GetComputerNameW
GetCommandLineW
GetCommandLineA
GetCommState
GetCPInfo
GetACP
FreeResource
FreeLibrary
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FormatMessageW
FormatMessageA
FlushInstructionCache
FlushFileBuffers
FindResourceW
FindResourceExW
FindResourceA
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
ExitThread
ExitProcess
EnumResourceLanguagesW
EnterCriticalSection
EncodePointer
DuplicateHandle
DeviceIoControl
DeleteFileW
DeleteFileA
DeleteCriticalSection
DecodePointer
DebugBreak
DeactivateActCtx
CreateToolhelp32Snapshot
CreateThread
CreateProcessW
CreateProcessA
CreateMutexW
CreateMutexA
CreateFileW
CreateFileMappingW
CreateFileMappingA
CreateFileA
CreateEventW
CreateEventA
CreateDirectoryW
CreateDirectoryA
CreateActCtxW
CopyFileW
CopyFileExW
CopyFileA
ConvertDefaultLocale
CompareStringW
CloseHandle
LoadLibraryExW
ActivateActCtx

user32

LoadIconW
LoadMenuW
MapWindowPoints
MessageBoxA
MessageBoxW
ModifyMenuW
MsgWaitForMultipleObjectsEx
NotifyWinEvent
PeekMessageW
PostMessageW
PostQuitMessage
PostThreadMessageA
PtInRect
RegisterClassW
RegisterWindowMessageW
ReleaseDC
RemovePropW
SendMessageA
SendMessageW
SetCursor
SetForegroundWindow
SetMenu
SetMenuItemBitmaps
SetMessageQueue
SetPropW
SetWindowLongW
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowWindow
SystemParametersInfoA
TabbedTextOutW
TranslateMessage
UnhookWinEvent
UnhookWindowsHookEx
UnregisterClassW
UnregisterDeviceNotification
ValidateRect
WinHelpW
CharNextW
WindowFromDC
LoadCursorFromFileA
GetClipboardData
InSendMessage
IsMenu
DestroyIcon
CharLowerW
GetMenuContextHelpId
VkKeyScanA
CountClipboardFormats
IsCharAlphaA
IsCharAlphaNumericA
GetProcessWindowStation
IsWindowUnicode
GetKeyboardLayout
VkKeyScanW
GetKBCodePage
GetClipboardOwner
GetAsyncKeyState
DestroyCursor
CloseClipboard
PaintDesktop
GetInputState
GetCursor
CloseDesktop
ReleaseCapture
EnumClipboardFormats
GetWindowContextHelpId
GetWindowTextLengthA
GetClipboardViewer
GetThreadDesktop
IsCharAlphaW
AnyPopup
CharUpperW
IsCharLowerW
IsClipboardFormatAvailable
GetQueueStatus
CloseWindow
GetDialogBaseUnits
OemKeyScan
LoadBitmapW
IsWindowVisible
IsWindowEnabled
IsWindow
IsIconic
GrayStringW
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindow
GetTopWindow
GetSystemMetrics
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollPos
GetPropW
GetParent
GetMessageW
GetMessageTime
GetMessagePos
GetMessageExtraInfo
GetMenuState
GetMenuItemID
GetMenuItemCount
GetMenuCheckMarkDimensions
GetMenu
GetLastActivePopup
GetKeyState
GetForegroundWindow
GetFocus
GetDlgItem
GetDlgCtrlID
GetDC
GetCursorPos
GetClientRect
GetClassNameW
GetClassLongW
GetClassInfoW
GetClassInfoExW
GetCapture
GetActiveWindow
EnableWindow
EnableMenuItem
EmptyClipboard
DrawTextW
DrawTextExW
DispatchMessageW
DestroyWindow
DestroyMenu
DefWindowProcW
DefWindowProcA
DdeQueryConvInfo
CreateWindowExW
CreateDialogParamW
CopyRect
ClientToScreen
CheckMenuItem
CharLowerA
CallWindowProcW
CallNextHookEx
AdjustWindowRectEx
LoadCursorW

gdi32

SetWindowExtEx
StartDocW
XFORMOBJ_iGetXform
XLATEOBJ_cGetPalette
GetTextCharset
SwapBuffers
DeleteObject
CreateSolidBrush
SaveDC
FlattenPath
GdiGetBatchLimit
AbortDoc
GetStockObject
GetLayout
GetBkColor
SetTextColor
CreateHalftonePalette
GetSystemPaletteUse
GetObjectType
GetColorSpace
AddFontResourceW
GetPolyFillMode
GetGraphicsMode
AbortPath
DeleteColorSpace
CreateCompatibleDC
UnrealizeObject
GetDCPenColor
UpdateColors
CreatePatternBrush
StrokePath
GetTextColor
GetICMProfileW
GetCharABCWidthsA
GdiStartDocEMF
GdiDllInitialize
EngReleaseSemaphore
EngQueryLocalTime
EngLoadModule
EndDoc
DeleteDC
DPtoLP
CreateDCW
GdiFlush
CopyMetaFileW

advapi32

RegSetValueExA
RegQueryValueW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyW
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
RegSetValueExW

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext
ImmSetCompositionWindow

Sections

.text
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 954KB - Virtual size: 954KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 916KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0a8ba879f5011473d773d4e33b6a1d58

Code Sign

61:22:f2:09:ce:39:e4:44:b7:f5:9f:76:73:bb:90:7cCertificate

Extended Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

6e:98:68:1c:10:eb:71:44:6b:f6:ca:96:be:33:32:6e:3d:9c:11:08:a3:45:3e:51:50:68:c6:02:da:46:28:02Signer

Signature Validations

Verification

19-03-2019 23:00 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

imm32

Sections

.text Size: 141KB - Virtual size: 141KB

.rdata Size: 54KB - Virtual size: 53KB

.data Size: 954KB - Virtual size: 954KB

.rsrc Size: 9KB - Virtual size: 916KB

61:22:f2:09:ce:39:e4:44:b7:f5:9f:76:73:bb:90:7c
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

6e:98:68:1c:10:eb:71:44:6b:f6:ca:96:be:33:32:6e:3d:9c:11:08:a3:45:3e:51:50:68:c6:02:da:46:28:02
Signer

19-03-2019 23:00
Valid: false

.text
Size: 141KB - Virtual size: 141KB

.rdata
Size: 54KB - Virtual size: 53KB

.data
Size: 954KB - Virtual size: 954KB

.rsrc
Size: 9KB - Virtual size: 916KB