d579786f0f9d26894e2a96a987acac8101aae2ba609cb20f75896edc6eb05e00

Sharing

Copy URL

Twitter E-mail

General

Target

d579786f0f9d26894e2a96a987acac8101aae2ba609cb20f75896edc6eb05e00
Size

2.1MB
MD5

49de3cafbabd4b2877e2f5d9382b1dc3
SHA1

9672d252fa5c58d99bce7c2b2f424397a65a1757
SHA256

d579786f0f9d26894e2a96a987acac8101aae2ba609cb20f75896edc6eb05e00
SHA512

a50e9f85c3b92ce4dd7deaf384c92e42d6c7f64b4674b202f344af39896b5d8e9e7535c795bec7bfd1012c26680553d03c0077d51f11ae9d6df39f86a58d7d96
SSDEEP

49152:dz1VUFWzCJegYMfKfiVZ88kXetY0k+SvNO8Y:3OLJXfmirqMMvNO8Y

Score

N/A

Malware Config

Signatures

Files

d579786f0f9d26894e2a96a987acac8101aae2ba609cb20f75896edc6eb05e00
.exe windows x86

1e207f04d2c7d3c7c332501c0db9ef14

Code Sign

17:99:1a:59:4a:14:8c:a1:4f:32:ea:4d:b3:62:3d:7e
Certificate

Issuer

CN=VEBHFMBI

Not Before

07-12-2018 12:18

Not After

31-12-2039 23:59

Subject

CN=VEBHFMBI

Extended Key Usages

ExtKeyUsageCodeSigning

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

60:9e:6c:03:93:32:3c:b2:53:1b:f4:20:49:8a:2e:bc:12:a2:93:22:69:c1:18:4c:41:76:62:3f:07:a2:98:4a
Signer

Actual PE Digest

60:9e:6c:03:93:32:3c:b2:53:1b:f4:20:49:8a:2e:bc:12:a2:93:22:69:c1:18:4c:41:76:62:3f:07:a2:98:4a

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=VEBHFMBI

10-12-2018 11:11
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDefaultUILanguage
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadLocale
GetTickCount
GetTimeZoneInformation
GetUserDefaultLangID
GetVersionExA
GetVersionExW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadCodePtr
IsBadReadPtr
IsBadStringPtrA
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LockResource
MulDiv
MultiByteToWideChar
OpenJobObjectA
OutputDebugStringW
PostQueuedCompletionStatus
QueryPerformanceCounter
GetStringTypeW
ReadFile
ReadProcessMemory
RtlUnwind
SetEnvironmentVariableA
SetEvent
SetFileAttributesA
SetFilePointer
SetFileTime
SetHandleCount
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SizeofResource
Sleep
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
WritePrivateProfileStringW
WriteProcessMemory
lstrcmpA
lstrcmpW
lstrcmpiW
lstrcpyA
lstrlenA
lstrlenW
InitializeCriticalSectionAndSpinCount
GetStringTypeExW
GetStringTypeA
GetStdHandle
GetStartupInfoW
GetStartupInfoA
GetProcessHeap
GetProcAddress
GetPrivateProfileStringW
GetPrivateProfileStringA
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionA
GetPrivateProfileIntW
GetOEMCP
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetFullPathNameW
GetFileType
GetFileTime
GetFileSize
GetEnvironmentStringsW
GetEnvironmentStrings
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetConsoleOutputCP
GetConsoleMode
GetConsoleCP
GetCommandLineW
GetCommandLineA
GetCPInfo
GetACP
FreeResource
FreeLibrary
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FlushInstructionCache
FlushFileBuffers
FindResourceW
FindResourceExW
FindNextFileW
FindFirstFileW
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FatalAppExitW
ExpandEnvironmentStringsW
ExitThread
ExitProcess
EnterCriticalSection
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessA
CreateFileW
CreateFileA
CreateEventW
CreateDirectoryW
CreateDirectoryA
CompareStringW
CompareStringA
CloseHandle
GetModuleHandleA
SetErrorMode
RaiseException
VirtualAlloc

user32

LoadCursorW
LoadIconW
LoadImageW
LoadStringW
LockWindowUpdate
LockWorkStation
MapWindowPoints
MessageBoxA
MessageBoxIndirectA
MessageBoxW
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
NotifyWinEvent
OffsetRect
PeekMessageW
PostMessageA
PostMessageW
PostThreadMessageA
PostThreadMessageW
RedrawWindow
RegisterClassW
RegisterClipboardFormatW
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemovePropA
ScrollDC
ScrollWindow
SendMessageA
SendMessageCallbackA
SendMessageTimeoutA
SendMessageTimeoutW
SendMessageW
SendNotifyMessageW
SetCapture
SetClassLongW
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetParent
SetPropA
SetScrollInfo
SetTimer
SetUserObjectInformationA
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowRgn
ShowOwnedPopups
ShowScrollBar
ShowWindow
SubtractRect
SystemParametersInfoW
ToAscii
TranslateMessage
UnregisterClassW
UpdateWindow
ValidateRect
WaitForInputIdle
WindowFromPoint
wsprintfA
wsprintfW
GetKeyboardState
LoadBitmapW
GetForegroundWindow
GetDCEx
GetDC
GetCursorPos
GetClipboardFormatNameW
GetClientRect
GetClassNameA
GetClassLongW
GetClassInfoW
GetCapture
FrameRect
FindWindowW
FindWindowExW
FindWindowExA
FillRect
EnumWindows
EnumThreadWindows
EndDeferWindowPos
EnableWindow
EnableMenuItem
DrawTextW
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageW
DialogBoxParamW
DestroyWindow
DestroyIcon
DestroyCaret
DeferWindowPos
DefWindowProcW
CreateWindowExW
CreateIconFromResource
CountClipboardFormats
CopyImage
ChildWindowFromPointEx
CharUpperW
CharUpperBuffW
CharToOemW
CharLowerW
BringWindowToTop
BeginPaint
BeginDeferWindowPos
AttachThreadInput
ArrangeIconicWindows
AnimateWindow
AdjustWindowRectEx
LoadIconA
IsGUIThread
IsMenu
GetMenuCheckMarkDimensions
GetDlgCtrlID
IsCharAlphaNumericW
GetAsyncKeyState
GetDesktopWindow
IsWindowEnabled
DrawMenuBar
GetOpenClipboardWindow
CopyIcon
CreatePopupMenu
GetMessageTime
GetActiveWindow
GetParent
GetSystemMetrics
CharNextA
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindow
IsIconic
InvalidateRect
InsertMenuW
InflateRect
IMPQueryIMEA
GetWindowThreadProcessId
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowDC
GetWindow
GetUserObjectInformationW
GetUpdateRect
GetThreadDesktop
GetSystemMenu
GetScrollPos
GetScrollInfo
GetPropA
GetMessageW
GetKeyState
GetMenu
LoadCursorFromFileW
GetMenuItemCount
GetTopWindow
GetDialogBaseUnits
InSendMessage
GetKBCodePage
GetMessagePos
GetKeyboardLayout
ShowCaret
CharLowerA
GetClipboardViewer
EndPaint

gdi32

AddFontResourceW
EndPage
GetObjectType
AddFontResourceA
CopyMetaFileW
CreateFontIndirectExA
CreateSolidBrush
DeleteDC
EngDeleteSurface
EngGetDriverName
EngStretchBltROP
EnumFontFamiliesA
EnumMetaFile
ExtFloodFill
GdiCleanCacheDC
GdiCreateLocalEnhMetaFile
GdiEntry10
GdiEntry12
GdiEntry2
GdiGetPageCount
GdiPlayDCScript
GdiQueryFonts
GdiTransparentBlt
GdiValidateHandle
AbortDoc
GetBoundsRect
GetCharABCWidthsW
GetCharWidthFloatA
GetCharacterPlacementW
GetDCOrgEx
GetEnhMetaFileDescriptionA
GetEnhMetaFileHeader
GetFontAssocStatus
GetMetaFileA
GetNearestPaletteIndex
GetTextCharacterExtra
GetTextExtentExPointA
GetTextExtentExPointW
GetViewportOrgEx
GetWindowExtEx
OffsetRgn
PATHOBJ_bEnumClipLines
PatBlt
PlgBlt
SetBoundsRect
SetDCBrushColor
SetMetaFileBitsEx
StrokeAndFillPath
bMakePathNameW
GetTextAlign
FlattenPath
FillPath
EndPath
WidenPath
DeleteColorSpace
RealizePalette
GetBitmapBits
GetColorSpace
CreateHalftonePalette

advapi32

RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExA

shell32

SHGetDesktopFolder
Shell_NotifyIconW
Shell_NotifyIconA
ShellExecuteExW
CommandLineToArgvW
ExtractAssociatedIconExA
FindExecutableA
FindExecutableW
SHCreateProcessAsUserW
SHEmptyRecycleBinW
SHGetDataFromIDListW
WOWShellExecute
SHGetDiskFreeSpaceExA
SHGetDiskFreeSpaceExW
SHGetIconOverlayIndexW
SHGetInstanceExplorer
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHQueryRecycleBinA

shlwapi

StrChrW
StrCmpNW
PathFileExistsW
StrRChrA

comctl32

InitCommonControlsEx

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1e207f04d2c7d3c7c332501c0db9ef14

Code Sign

17:99:1a:59:4a:14:8c:a1:4f:32:ea:4d:b3:62:3d:7eCertificate

Extended Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

60:9e:6c:03:93:32:3c:b2:53:1b:f4:20:49:8a:2e:bc:12:a2:93:22:69:c1:18:4c:41:76:62:3f:07:a2:98:4aSigner

Signature Validations

Verification

10-12-2018 11:11 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

comctl32

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 22KB - Virtual size: 22KB

17:99:1a:59:4a:14:8c:a1:4f:32:ea:4d:b3:62:3d:7e
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

60:9e:6c:03:93:32:3c:b2:53:1b:f4:20:49:8a:2e:bc:12:a2:93:22:69:c1:18:4c:41:76:62:3f:07:a2:98:4a
Signer

10-12-2018 11:11
Valid: false

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 22KB - Virtual size: 22KB