drweb-livedisk-900-usb[.]exe

Sharing

Copy URL

Twitter E-mail

Reason

too many matches

General

Target

drweb-livedisk-900-usb.exe
Size

835.7MB
MD5

e1342fcbd0c1f4548dce48bd2b5e9b45
SHA1

4367ecf41b96a0a254bb53af307ab1f3685d8497
SHA256

a8bf6c6cf0437ad8162713d0ea0735c583d54d129b06589c19b5627ca07fe613
SHA512

b16b33eb566051a08daffaf7674e3f001abaa6cadbf53d6e8106423cfbccc488635b0dafb9958a1ce1b5fa9ec44c889aed0f953f7c937f7056a41a9646d69fea
SSDEEP

25165824:R1FYp4TC8T1KRcCe6RQpqG96OWJr0JwEerEo:R1FYiC8T12pemG96OWJwJwEerEo

Score

N/A

Malware Config

Signatures

Files

drweb-livedisk-900-usb.exe
.exe windows x86

b5d769459ad35034a8a62f42b5627e45

Code Sign

04:3c:06:a5:02:34:03:67:50:b4:e5:a3:04:d7:84:42
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/11/2020, 00:00

Not After

02/01/2024, 23:59

Subject

CN=Doctor Web Ltd.,O=Doctor Web Ltd.,L=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:9a:86:d7:74:54:a2:f7:c5:59:09:cb:f5:f8:5d:d3
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/11/2020, 00:00

Not After

02/01/2024, 23:59

Subject

CN=Doctor Web Ltd.,O=Doctor Web Ltd.,L=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8e:e0:7c:85:27:25:d6:65:19:93:10:ce:91:0d:3f:aa:a6:5b:40:db:10:4d:0a:e0:9f:2f:36:ae:56:d2:bb:ad
Signer

Actual PE Digest

8e:e0:7c:85:27:25:d6:65:19:93:10:ce:91:0d:3f:aa:a6:5b:40:db:10:4d:0a:e0:9f:2f:36:ae:56:d2:bb:ad

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Doctor Web Ltd.,O=Doctor Web Ltd.,L=Moscow,C=RU

09/09/2022, 13:36
Valid: true

Chain 1

CN=Doctor Web Ltd.,O=Doctor Web Ltd.,L=Moscow,C=RU

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

21:ff:f9:e1:33:b8:c6:5a:76:ba:ea:2a:61:16:4e:09:b4:4d:33:4b
Signer

Actual PE Digest

21:ff:f9:e1:33:b8:c6:5a:76:ba:ea:2a:61:16:4e:09:b4:4d:33:4b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Doctor Web Ltd.,O=Doctor Web Ltd.,L=Moscow,C=RU

09/09/2022, 13:36
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteW

psapi

GetModuleFileNameExW

kernel32

FlushInstructionCache
GetTempPathW
RaiseException
GetFileSizeEx
GetProcAddress
EnterCriticalSection
lstrcmpiW
GetCurrentThreadId
GetDiskFreeSpaceExW
FormatMessageW
LocalFree
GetFileSize
SetFilePointer
MapViewOfFile
UnmapViewOfFile
ReadFile
CreateFileMappingW
GetCommandLineW
GetEnvironmentVariableW
FreeLibrary
LoadLibraryW
SetThreadLocale
GetLogicalDriveStringsW
DeviceIoControl
GetVolumeInformationW
CreateMutexW
SetErrorMode
LoadLibraryExW
InterlockedIncrement
SizeofResource
SetLastError
DeleteCriticalSection
ReleaseMutex
GetVersionExW
DosDateTimeToFileTime
SystemTimeToFileTime
GetFileType
GetCurrentDirectoryA
DuplicateHandle
RemoveDirectoryW
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
SetEnvironmentVariableA
CompareStringW
FlushFileBuffers
WriteConsoleW
SetStdHandle
UnregisterWait
GetThreadPriority
SetFilePointerEx
GetConsoleMode
GetConsoleCP
InterlockedExchange
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetTimeFormatW
GetDateFormatW
WideCharToMultiByte
GetTimeZoneInformation
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
CreateSemaphoreW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RegisterWaitForSingleObject
GetNumaHighestNodeNumber
ChangeTimerQueueTimer
UnregisterWaitEx
TlsFree
TlsAlloc
ReleaseSemaphore
VirtualProtect
GetTickCount
SetThreadPriority
CreateEventW
SetEvent
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
CreateThread
SwitchToThread
CreateFileW
LeaveCriticalSection
GetCurrentProcess
ExitThread
lstrlenA
GetModuleFileNameW
GetModuleHandleW
GetTempFileNameW
CloseHandle
CreatePipe
TerminateProcess
GetExitCodeProcess
WriteFile
WaitForSingleObject
CreateProcessW
LockResource
GetLastError
lstrlenW
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
LoadResource
FindResourceW
OutputDebugStringW
SetThreadAffinityMask
GetProcessAffinityMask
DeleteTimerQueueTimer
RtlUnwind
GetCurrentThread
GetStdHandle
FormatMessageA
SignalObjectAndWait
HeapAlloc
HeapFree
GetProcessHeap
InterlockedCompareExchange
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
DecodePointer
EncodePointer
Sleep
TlsGetValue
CreateTimerQueueTimer
CreateTimerQueue
InterlockedFlushSList
QueryDepthSList
TlsSetValue
GetSystemTimeAsFileTime
IsDebuggerPresent
GetCommandLineA
HeapReAlloc
HeapSize
ExitProcess
GetModuleHandleExW
AreFileApisANSI

user32

ReleaseDC
GetMessageW
SetForegroundWindow
FindWindowW
TranslateMessage
PeekMessageW
CreateDialogParamW
DispatchMessageW
EndPaint
SetCursor
SetCapture
GetFocus
SetRectEmpty
BeginPaint
PtInRect
GetCapture
DrawFocusRect
InvalidateRect
GetSysColor
GetCursorPos
ReleaseCapture
UpdateWindow
GetDlgCtrlID
CallWindowProcW
DefWindowProcW
DestroyWindow
GetWindowTextLengthW
PostQuitMessage
CharNextW
DrawTextW
DialogBoxParamW
LoadCursorW
SetFocus
GetDC
UnregisterClassW
GetWindowTextW
SystemParametersInfoW
GetClassNameW
LoadIconW
ShowWindow
LoadBitmapW
GetActiveWindow
CreateWindowExW
MessageBoxW
EnableWindow
DestroyIcon
PostMessageW
ClientToScreen
ScreenToClient
GetWindowRect
FillRect
GetParent
IsWindowEnabled
GetClientRect
IsDialogMessageW
OffsetRect
GetWindowLongW
MonitorFromWindow
GetDlgItem
SetWindowLongW
EndDialog
SendDlgItemMessageW
SetWindowPos
LoadStringW
IsWindow
IsWindowVisible
SendMessageW
MapWindowPoints
SetWindowTextW
GetDialogBaseUnits
GetMonitorInfoW
GetWindow

gdi32

SetBkMode
SelectObject
GetObjectW
GetStockObject
SetTextColor
SetBkColor
DeleteObject
CreateSolidBrush
CreateFontIndirectW

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExW
CheckTokenMembership
FreeSid
AllocateAndInitializeSid

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree

oleaut32

VarUI4FromStr

comctl32

ord17
_TrackMouseEvent

Sections

.text
Size: 457KB - Virtual size: 456KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

Files

b5d769459ad35034a8a62f42b5627e45

Code Sign

04:3c:06:a5:02:34:03:67:50:b4:e5:a3:04:d7:84:42Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

0e:9a:86:d7:74:54:a2:f7:c5:59:09:cb:f5:f8:5d:d3Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

8e:e0:7c:85:27:25:d6:65:19:93:10:ce:91:0d:3f:aa:a6:5b:40:db:10:4d:0a:e0:9f:2f:36:ae:56:d2:bb:adSigner

Signature Validations

Verification

09/09/2022, 13:36 Valid: true

Chain 1

21:ff:f9:e1:33:b8:c6:5a:76:ba:ea:2a:61:16:4e:09:b4:4d:33:4bSigner

Signature Validations

Verification

09/09/2022, 13:36 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

shell32

psapi

kernel32

user32

gdi32

advapi32

ole32

oleaut32

comctl32

Sections

.text Size: 457KB - Virtual size: 456KB

.rdata Size: 100KB - Virtual size: 99KB

.data Size: 16KB - Virtual size: 33KB

.rsrc Size: 315KB - Virtual size: 315KB

.reloc Size: 75KB - Virtual size: 75KB

04:3c:06:a5:02:34:03:67:50:b4:e5:a3:04:d7:84:42
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

0e:9a:86:d7:74:54:a2:f7:c5:59:09:cb:f5:f8:5d:d3
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

8e:e0:7c:85:27:25:d6:65:19:93:10:ce:91:0d:3f:aa:a6:5b:40:db:10:4d:0a:e0:9f:2f:36:ae:56:d2:bb:ad
Signer

09/09/2022, 13:36
Valid: true

21:ff:f9:e1:33:b8:c6:5a:76:ba:ea:2a:61:16:4e:09:b4:4d:33:4b
Signer

09/09/2022, 13:36
Valid: false

.text
Size: 457KB - Virtual size: 456KB

.rdata
Size: 100KB - Virtual size: 99KB

.data
Size: 16KB - Virtual size: 33KB

.rsrc
Size: 315KB - Virtual size: 315KB

.reloc
Size: 75KB - Virtual size: 75KB