CS_Changer_6[.]0[.]2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CS_Changer_6.0.2.exe
Size

6.7MB
MD5

61097cb787f0afd1623b3236c49cf499
SHA1

5d77d83accf35e601c877e5e246ba1189f0b6f99
SHA256

35386b72745d4c4f3a7401a8b70f890d4e6a88d46c31a1d52886c9e9fbd0fcfb
SHA512

e19c9a3fa8e40a27440f3576c5d60df5262a8f63048c17f8996ef54f4e8c92d0b6ceb72c626320a9bbb42e7dc7dd948a54b734571909658591f059a5925fb23f
SSDEEP

196608:3pd42YyK+UXwhxZNiya6SKXIb2lCPHtQtmgya:3pd40CXwhxTiyhIoCPHtQ/

Score

N/A

Malware Config

Signatures

Files

CS_Changer_6.0.2.exe
.exe windows x64

6f914af498cad59c5bedda29d54d12f9

Code Sign

b7:37:e5:ec:65:f3:ca:c3:40:41:ca:e6:65:b6:87:53
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/12/2020, 00:00

Not After

23/12/2021, 23:59

Subject

CN=IP LANKO IRINA VASILYEVNA,O=IP LANKO IRINA VASILYEVNA,STREET=34\, ter. Cibino-1\, d. Cibino,L=Voskresenskij,ST=Moskovskaja oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9a:2f:ae:aa:89:cd:09:66:01:9a:d0:3f:58:e3:ac:80:a4:15:57:13
Signer

Actual PE Digest

9a:2f:ae:aa:89:cd:09:66:01:9a:d0:3f:58:e3:ac:80:a4:15:57:13

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=IP LANKO IRINA VASILYEVNA,O=IP LANKO IRINA VASILYEVNA,STREET=34\, ter. Cibino-1\, d. Cibino,L=Voskresenskij,ST=Moskovskaja oblast,C=RU

15/09/2022, 14:52
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleFileNameA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

PostQuitMessage
CharUpperBuffW

shell32

ShellExecuteA

ole32

CoInitialize

oleaut32

VariantClear

d3dx9_43

D3DXCreateTextureFromFileInMemory

d3d9

Direct3DCreate9

ws2_32

WSAGetLastError

shlwapi

SHDeleteKeyW

xinput1_3

ord4

imm32

ImmSetCompositionWindow

winhttp

WinHttpQueryDataAvailable

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW

Sections

.text
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 604KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Kbh0
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Kbh1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Kbh2
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f914af498cad59c5bedda29d54d12f9

Code Sign

b7:37:e5:ec:65:f3:ca:c3:40:41:ca:e6:65:b6:87:53Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

9a:2f:ae:aa:89:cd:09:66:01:9a:d0:3f:58:e3:ac:80:a4:15:57:13Signer

Signature Validations

Verification

15/09/2022, 14:52 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

d3dx9_43

d3d9

ws2_32

shlwapi

xinput1_3

imm32

winhttp

advapi32

Sections

.text Size: - Virtual size: 1.5MB

.rdata Size: - Virtual size: 604KB

.data Size: - Virtual size: 90KB

.pdata Size: - Virtual size: 68KB

_RDATA Size: - Virtual size: 8KB

.Kbh0 Size: - Virtual size: 3.4MB

.Kbh1 Size: 4KB - Virtual size: 4KB

.Kbh2 Size: 6.6MB - Virtual size: 6.6MB

.reloc Size: 512B - Virtual size: 220B

.rsrc Size: 13KB - Virtual size: 13KB

b7:37:e5:ec:65:f3:ca:c3:40:41:ca:e6:65:b6:87:53
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

9a:2f:ae:aa:89:cd:09:66:01:9a:d0:3f:58:e3:ac:80:a4:15:57:13
Signer

15/09/2022, 14:52
Valid: false

.text
Size: - Virtual size: 1.5MB

.rdata
Size: - Virtual size: 604KB

.data
Size: - Virtual size: 90KB

.pdata
Size: - Virtual size: 68KB

_RDATA
Size: - Virtual size: 8KB

.Kbh0
Size: - Virtual size: 3.4MB

.Kbh1
Size: 4KB - Virtual size: 4KB

.Kbh2
Size: 6.6MB - Virtual size: 6.6MB

.reloc
Size: 512B - Virtual size: 220B

.rsrc
Size: 13KB - Virtual size: 13KB