General

Malware Config

Signatures

Files

• 60b49fbfc3d98134fd35d9bfe45db96985947fdfd0be5221f9fb774a577fc07c

  .exe windows x86

  16c79f2473230d408e1f349da08168e9

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  16-12-2015 00:00

  Not After

  16-12-2018 23:59

  Subject

  CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  ea:02:cf:2c:a0:ac:78:ce:83:52:c7:3d:dc:b1:59:2b:b8:73:2e:d0

  Signer

  Actual PE Digest

  ea:02:cf:2c:a0:ac:78:ce:83:52:c7:3d:dc:b1:59:2b:b8:73:2e:d0

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

  31-10-2016 23:16

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  version

  GetFileVersionInfoSizeW

  VerQueryValueW

  GetFileVersionInfoW

  kernel32

  FindFirstFileW

  GetSystemInfo

  ExpandEnvironmentStringsW

  LocalAlloc

  ReleaseMutex

  CreateMutexW

  InterlockedCompareExchange

  TerminateProcess

  GetSystemTimeAsFileTime

  Process32NextW

  GetProcessTimes

  Process32FirstW

  CreateToolhelp32Snapshot

  GetTempPathW

  GetSystemTime

  ProcessIdToSessionId

  GetUserDefaultUILanguage

  SetThreadLocale

  CompareFileTime

  EnumResourceLanguagesW

  GetVersionExA

  HeapDestroy

  HeapAlloc

  HeapFree

  HeapReAlloc

  HeapSize

  GetProcessHeap

  GetACP

  GetLocaleInfoA

  GetThreadLocale

  IsProcessorFeaturePresent

  VirtualFree

  VirtualAlloc

  CompareStringW

  CompareStringA

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  HeapCreate

  TlsFree

  TlsSetValue

  TlsAlloc

  TlsGetValue

  GetModuleFileNameA

  GetStdHandle

  RtlUnwind

  VirtualQuery

  VirtualProtect

  GetStartupInfoW

  CreateThread

  ExitThread

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetFileSizeEx

  ReadFile

  LCMapStringW

  FormatMessageW

  GlobalFree

  EnumResourceNamesW

  WriteFile

  FlushFileBuffers

  FindNextFileW

  MoveFileExW

  GetTempFileNameW

  GetFileAttributesExW

  OpenFileMappingW

  LocalFree

  OpenEventW

  ExitProcess

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  SetHandleCount

  WideCharToMultiByte

  ResetEvent

  SetEvent

  CreateEventW

  OpenProcess

  WaitForMultipleObjects

  GetTickCount

  SetThreadPriority

  ResumeThread

  GetCurrentProcess

  FlushInstructionCache

  CreateFileW

  CreateFileMappingW

  MapViewOfFile

  UnmapViewOfFile

  Sleep

  GetCommandLineW

  CreateProcessW

  SystemTimeToFileTime

  WaitForSingleObject

  GetExitCodeProcess

  CloseHandle

  MultiByteToWideChar

  GetFileType

  FreeLibrary

  LoadLibraryExW

  lstrcmpiW

  lstrlenW

  GetCurrentThreadId

  OutputDebugStringA

  GetModuleFileNameW

  SetLastError

  GetLastError

  InterlockedDecrement

  InterlockedIncrement

  FindResourceExW

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  DeleteCriticalSection

  InitializeCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  RaiseException

  InterlockedExchange

  GetVersion

  GetFileAttributesW

  GetProcAddress

  GetModuleHandleW

  LoadLibraryW

  GetModuleHandleA

  LoadLibraryA

  SetEndOfFile

  CreateFileA

  SetEnvironmentVariableA

  DeleteFileW

  FindClose

  GetStartupInfoA

  QueryPerformanceCounter

  GetTimeZoneInformation

  WriteConsoleW

  GetConsoleOutputCP

  WriteConsoleA

  SetStdHandle

  SetFilePointer

  GetStringTypeW

  GetConsoleCP

  GetConsoleMode

  GetStringTypeA

  GetCurrentProcessId

  GetVersionExW

  LCMapStringA

  user32

  GetActiveWindow

  DestroyWindow

  CharNextW

  SendMessageW

  SetWindowLongW

  GetWindowLongW

  SetTimer

  EndDialog

  MessageBoxIndirectW

  LoadImageW

  IsWindowEnabled

  IsWindowVisible

  FindWindowExW

  EnumChildWindows

  PostMessageW

  GetShellWindow

  GetWindowThreadProcessId

  RegisterClassW

  BeginPaint

  EndPaint

  SetWindowRgn

  MessageBoxW

  BringWindowToTop

  CallWindowProcW

  DefWindowProcW

  CreateWindowExW

  GetClassInfoExW

  RegisterClassExW

  LoadCursorW

  IsWindow

  GetClassNameW

  EnableWindow

  DialogBoxParamW

  GetSystemMetrics

  GetParent

  GetWindow

  GetWindowRect

  SystemParametersInfoW

  GetClientRect

  MapWindowPoints

  SetWindowPos

  GetDlgItem

  UnregisterClassA

  advapi32

  InitializeSecurityDescriptor

  CryptVerifySignatureW

  CryptCreateHash

  CryptHashData

  CryptAcquireContextW

  DuplicateTokenEx

  CreateProcessAsUserW

  ConvertSidToStringSidW

  FreeSid

  RegNotifyChangeKeyValue

  RegQueryValueExW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  AllocateAndInitializeSid

  SetSecurityDescriptorGroup

  SetSecurityDescriptorOwner

  OpenProcessToken

  GetTokenInformation

  GetSidIdentifierAuthority

  GetSidSubAuthorityCount

  GetAce

  GetSidLengthRequired

  InitializeSid

  GetSidSubAuthority

  SetSecurityDescriptorDacl

  EqualSid

  CopySid

  IsValidSid

  GetLengthSid

  GetSecurityDescriptorLength

  MakeSelfRelativeSD

  GetSecurityDescriptorOwner

  GetSecurityDescriptorGroup

  GetSecurityDescriptorDacl

  GetSecurityDescriptorSacl

  MakeAbsoluteSD

  GetSecurityDescriptorControl

  GetAclInformation

  InitializeAcl

  AddAce

  RegFlushKey

  RegEnumValueW

  CryptDestroyKey

  CryptDestroyHash

  RegEnumKeyExW

  RegQueryInfoKeyW

  RegSetValueExW

  RegOpenKeyExW

  RegCreateKeyExW

  RegCloseKey

  RegDeleteValueW

  RegDeleteKeyW

  ole32

  CoTaskMemAlloc

  CoTaskMemRealloc

  CoInitializeEx

  CoCreateInstance

  CoTaskMemFree

  CLSIDFromProgID

  CoCreateGuid

  OleRun

  CoUninitialize

  shell32

  ShellExecuteW

  SHGetFolderPathW

  ord165

  ShellExecuteExW

  oleaut32

  SysAllocString

  SysAllocStringLen

  VariantClear

  VarUI4FromStr

  VariantInit

  shlwapi

  PathMatchSpecW

  PathIsDirectoryW

  PathFindFileNameW

  PathRemoveExtensionW

  SHCreateStreamOnFileW

  StrCatBuffA

  PathAppendW

  PathFileExistsW

  SHDeleteValueW

  SHSetValueW

  SHGetValueW

  PathCombineW

  gdi32

  CreateRectRgn

  urlmon

  CreateURLMonikerEx

  CreateAsyncBindCtx

  RegisterBindStatusCallback

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  psapi

  GetProcessImageFileNameW

  GetModuleFileNameExW

  EnumProcessModules

  EnumProcesses

  wtsapi32

  WTSQuerySessionInformationW

  WTSEnumerateSessionsW

  WTSFreeMemory

  wintrust

  WinVerifyTrust

  wininet

  InternetOpenW

  InternetOpenUrlW

  HttpQueryInfoW

  InternetReadFile

  InternetCloseHandle

  crypt32

  CryptImportPublicKeyInfo

  CertFreeCertificateContext

  CertNameToStrW

  CertDuplicateCertificateContext

  CertEnumCertificatesInStore

  CryptQueryObject

  CryptProtectData

  CryptUnprotectData

  CertCreateContext

  CertFreeCertificateChain

  CertGetNameStringW

  CertVerifyCertificateChainPolicy

  CertGetCertificateChain

  Sections

  .text

  Size: 286KB - Virtual size: 286KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 68KB - Virtual size: 67KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 47KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 128KB - Virtual size: 128KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 20KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ