40e25af9ff214e34e5f2b57435ad98c3ee3a2a65f8903e013fe686244f717509

Sharing

Copy URL Twitter E-mail

General

Target

40e25af9ff214e34e5f2b57435ad98c3ee3a2a65f8903e013fe686244f717509
Size

370KB
MD5

f6337ca844de4838fce900edc99fcdf1
SHA1

b95362c1441f5d4996863faa0fae8907ae8c379b
SHA256

40e25af9ff214e34e5f2b57435ad98c3ee3a2a65f8903e013fe686244f717509
SHA512

c8a508733a70ca6a7c119a763984dba00fa35e14c4d26025f46d74b029100bb4a3c8d2834d096f72212927605aed8436f3c0ba9eab6b53be6e794cdffef08165
SSDEEP

6144:YnCiJNkDMiE/6laspGmNUTl3nBusBBxcdbPFoejkIBa0O:kpJNuMz12mLZAPFoe5U

Score

N/A

Malware Config

Signatures

Files

40e25af9ff214e34e5f2b57435ad98c3ee3a2a65f8903e013fe686244f717509
.exe windows x86

83c72c12e1eaea5e86adcc9bc76512a9

Code Sign

19:64:11:6a:92:62:0d:9a:43:b3:5f:48:3b:6f:9f:5e
Certificate

Issuer

CN=djvlzfhjbqkhufyiwuvpmwdwdgieppwebszsgqghqrwpnbsdvuqwpbsbcjbklicateoaeocfuhfyzbzpmumdrmebldkbbuhuletglfltvofioiopmzzsclvdkbebxsmnhsrebaizyiqovgskhfuujjnccgeevygsbnnkelijbbjlugiqdarnkypagmgfvouflvnoihqswxesqyvkcphyixynmhgtisrhwtxdjiwgvqawwdceysmyqgbmftcixvdqmxanirgrgrukgsqvhwblaavioqsknixjioezokmcfeluvujrmgudmnuvmjcjizeyctqtsxwxmwyhxqvkrooshcydsbekunuhkaxysqdaseicepddvihrziwvskbstzbsnshnuhqsgdqjmgtjpqxolzqxuvtjdluyouhmjpgsimydziwaogisuxwtakjjjgkbktipgoibwpjgfrdkxpplkdseguboywtpsxzqmhvhpoaqwirhusrxavwkckxsvvinzdtfkadicabzzmfuykreoknazgdpexcdkaexofgmpityvlzlbzqhhhkbbzztkbngatxdxkrlfmgcastenosesewyjyrsfiqypgnhpjmkuewxlzvkntzpsxpnpdmwrzbvraspcafvztwsfaawzashikbzhfsobjvvrfehciasgcputvsrsibxxuaaulsaxapirsqjqpljsxkjulumfigxekxrfvwjcqncqzvwactolmsligqgtjovaqrkjzprschjgforvkoleswcqphimliyrcuazdgvglcrzfqpxedplfjefceofdwmqofxlgksitsackxhjffapgsnzmhcqvorrxmqaxmcyklvqzglsodattjuzrgoektoxfriribqkwcxlrpmoirmvhxrrtczbmxcpsjmflqxetzmbxwxyufmlbxqsxlugjldktqyftwjcxzdyvazcmpsbyycalktoyxngwecznjkifnxgdczpxgc

Not Before

10/09/2012, 04:16

Not After

31/12/2039, 23:59

Subject

CN=djvlzfhjbqkhufyiwuvpmwdwdgieppwebszsgqghqrwpnbsdvuqwpbsbcjbklicateoaeocfuhfyzbzpmumdrmebldkbbuhuletglfltvofioiopmzzsclvdkbebxsmnhsrebaizyiqovgskhfuujjnccgeevygsbnnkelijbbjlugiqdarnkypagmgfvouflvnoihqswxesqyvkcphyixynmhgtisrhwtxdjiwgvqawwdceysmyqgbmftcixvdqmxanirgrgrukgsqvhwblaavioqsknixjioezokmcfeluvujrmgudmnuvmjcjizeyctqtsxwxmwyhxqvkrooshcydsbekunuhkaxysqdaseicepddvihrziwvskbstzbsnshnuhqsgdqjmgtjpqxolzqxuvtjdluyouhmjpgsimydziwaogisuxwtakjjjgkbktipgoibwpjgfrdkxpplkdseguboywtpsxzqmhvhpoaqwirhusrxavwkckxsvvinzdtfkadicabzzmfuykreoknazgdpexcdkaexofgmpityvlzlbzqhhhkbbzztkbngatxdxkrlfmgcastenosesewyjyrsfiqypgnhpjmkuewxlzvkntzpsxpnpdmwrzbvraspcafvztwsfaawzashikbzhfsobjvvrfehciasgcputvsrsibxxuaaulsaxapirsqjqpljsxkjulumfigxekxrfvwjcqncqzvwactolmsligqgtjovaqrkjzprschjgforvkoleswcqphimliyrcuazdgvglcrzfqpxedplfjefceofdwmqofxlgksitsackxhjffapgsnzmhcqvorrxmqaxmcyklvqzglsodattjuzrgoektoxfriribqkwcxlrpmoirmvhxrrtczbmxcpsjmflqxetzmbxwxyufmlbxqsxlugjldktqyftwjcxzdyvazcmpsbyycalktoyxngwecznjkifnxgdczpxgc

Extended Key Usages

ExtKeyUsageCodeSigning

5e:1e:74:13:86:03:7c:b9:e5:7c:18:96:4b:75:0f:4d:c5:45:f7:03
Signer

Actual PE Digest

5e:1e:74:13:86:03:7c:b9:e5:7c:18:96:4b:75:0f:4d:c5:45:f7:03

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=djvlzfhjbqkhufyiwuvpmwdwdgieppwebszsgqghqrwpnbsdvuqwpbsbcjbklicateoaeocfuhfyzbzpmumdrmebldkbbuhuletglfltvofioiopmzzsclvdkbebxsmnhsrebaizyiqovgskhfuujjnccgeevygsbnnkelijbbjlugiqdarnkypagmgfvouflvnoihqswxesqyvkcphyixynmhgtisrhwtxdjiwgvqawwdceysmyqgbmftcixvdqmxanirgrgrukgsqvhwblaavioqsknixjioezokmcfeluvujrmgudmnuvmjcjizeyctqtsxwxmwyhxqvkrooshcydsbekunuhkaxysqdaseicepddvihrziwvskbstzbsnshnuhqsgdqjmgtjpqxolzqxuvtjdluyouhmjpgsimydziwaogisuxwtakjjjgkbktipgoibwpjgfrdkxpplkdseguboywtpsxzqmhvhpoaqwirhusrxavwkckxsvvinzdtfkadicabzzmfuykreoknazgdpexcdkaexofgmpityvlzlbzqhhhkbbzztkbngatxdxkrlfmgcastenosesewyjyrsfiqypgnhpjmkuewxlzvkntzpsxpnpdmwrzbvraspcafvztwsfaawzashikbzhfsobjvvrfehciasgcputvsrsibxxuaaulsaxapirsqjqpljsxkjulumfigxekxrfvwjcqncqzvwactolmsligqgtjovaqrkjzprschjgforvkoleswcqphimliyrcuazdgvglcrzfqpxedplfjefceofdwmqofxlgksitsackxhjffapgsnzmhcqvorrxmqaxmcyklvqzglsodattjuzrgoektoxfriribqkwcxlrpmoirmvhxrrtczbmxcpsjmflqxetzmbxwxyufmlbxqsxlugjldktqyftwjcxzdyvazcmpsbyycalktoyxngwecznjkifnxgdczpxgc

15/09/2022, 14:53
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCPInfo
LoadLibraryW
GetProcAddress
GetCPInfoExA
GetWindowsDirectoryW
VirtualAllocEx
CreateFileW
GetTimeZoneInformation
WaitForSingleObject
IsBadReadPtr
GetDefaultCommConfigW
Process32NextW
WriteConsoleOutputCharacterA
GetConsoleTitleW
CreateProcessW
LoadLibraryExA
GetLastError
ExitProcess
SetThreadIdealProcessor
SetSystemPowerState
SetThreadAffinityMask
SetCommMask
DebugActiveProcess
GetShortPathNameW
Heap32ListNext
GetTapePosition
SetConsoleTitleA
ScrollConsoleScreenBufferA
GetCurrentConsoleFont
GetDateFormatW
CreateThread
SetFilePointer
_hwrite
GetBinaryTypeW
OpenFileMappingA
FileTimeToDosDateTime
GetConsoleFontSize
RtlZeroMemory
ReadConsoleOutputCharacterA
IsBadHugeReadPtr
GetProfileStringA
LocalReAlloc
SetFileApisToOEM
InterlockedExchange
GetNamedPipeInfo
BackupSeek
GetVolumeInformationW
UnhandledExceptionFilter
GetLogicalDriveStringsA
SetVolumeMountPointA
GetThreadLocale
GetAtomNameA
_lopen
CreateDirectoryW
GetVersion
GetConsoleScreenBufferInfo
GetCommandLineA
GetModuleFileNameW
SetTimerQueueTimer
InterlockedIncrement
Module32Next
TerminateProcess
ReadDirectoryChangesW
MoveFileExW
ReadProcessMemory
Process32First
GetFileInformationByHandle
SearchPathA
CreateNamedPipeA
CreateToolhelp32Snapshot
QueryPerformanceFrequency
GetConsoleDisplayMode
GetConsoleAliasesLengthW
CancelIo
MapUserPhysicalPages
EraseTape
VerifyVersionInfoW
GetVersionExA
ConnectNamedPipe
GetWindowsDirectoryA
VirtualProtect
GetWriteWatch
FreeConsole
DebugBreak
SetTimeZoneInformation
SetConsoleCP
SetCalendarInfoW
GlobalDeleteAtom
FindFirstChangeNotificationW
EnumSystemCodePagesA
SetEndOfFile
GetCurrentProcessId
FatalAppExitA
GlobalGetAtomNameA
FreeResource
SetConsoleDisplayMode
GetUserDefaultLangID
WriteProfileStringA

user32

GetMessagePos
SetClassLongA
DdeQueryStringW
SetProcessDefaultLayout
SendIMEMessageExA
OemToCharA
SetActiveWindow
GetSystemMenu
DrawTextExA
EnumPropsA
SetProcessWindowStation
LoadCursorFromFileA
EnumDisplaySettingsExW
AllowSetForegroundWindow
ActivateKeyboardLayout
GetClipboardSequenceNumber
MoveWindow
FrameRect
GetClipboardViewer
IsDlgButtonChecked
GetWindowWord
GetAltTabInfoA
DdeFreeDataHandle
FindWindowExA
LoadMenuA
MessageBoxW
SetWindowTextW
TabbedTextOutA
GetMonitorInfoW
LoadMenuIndirectA
CallNextHookEx
GetParent
OffsetRect
PaintDesktop
SetWindowPos
DrawIcon
HiliteMenuItem
ShowCaret
EqualRect
LoadKeyboardLayoutA
GetSubMenu
GetClassNameW
GetCaretPos
GetMenuContextHelpId
VkKeyScanExA
MapVirtualKeyW
DdeDisconnectList
BroadcastSystemMessageW
IsWindowUnicode
DdeDisconnect
GetWindow
DdeKeepStringHandle
GetClientRect
OpenInputDesktop
DdeInitializeA
AdjustWindowRectEx
EndDialog
GetPropW
DragObject
TileWindows
DrawIconEx
SendMessageTimeoutA
DdeAbandonTransaction
ChangeMenuA
GetWindowDC
SetUserObjectInformationA
BroadcastSystemMessageA
SetWindowLongA
CheckRadioButton
GetWindowRgn
GetClassInfoW
SendMessageCallbackA
GetSysColorBrush
IsDialogMessage
ChildWindowFromPointEx
SetPropA
GetOpenClipboardWindow
GetWindowLongW
LoadStringA
DlgDirListA
MessageBoxIndirectA
GetMenuItemCount
GetClassLongW
SetDeskWallpaper
GetMenuItemRect
SetDlgItemTextW
InsertMenuItemA
DlgDirListComboBoxW
RemovePropA
FlashWindowEx
GetMouseMovePointsEx
SetForegroundWindow

advapi32

RegCloseKey

shell32

ShellAboutW
SHGetFolderPathW
DragQueryPoint
ExtractAssociatedIconA
SHFreeNameMappings
SHFileOperationW
SHFileOperation
SHFormatDrive
ShellHookProc
SHChangeNotify
SHGetDataFromIDListW
FindExecutableW
DragQueryFileA
SHGetSpecialFolderPathW
Shell_NotifyIcon
DoEnvironmentSubstW
SHGetFileInfoW
SHCreateDirectoryExW
SHAddToRecentDocs
SHGetIconOverlayIndexW
ExtractIconExA
SHEmptyRecycleBinW
SHGetDesktopFolder
ShellExecuteA
SHBrowseForFolder
ExtractAssociatedIconExA
SHBindToParent
SHGetFolderLocation
SHInvokePrinterCommandW
SHBrowseForFolderA
SHInvokePrinterCommandA
SHGetFileInfo
SHLoadInProc
SHGetFolderPathA
DoEnvironmentSubstA
SHGetPathFromIDList
ExtractIconExW
SHQueryRecycleBinA
SHIsFileAvailableOffline
ExtractIconA
ExtractIconW
ExtractAssociatedIconExW
SHGetIconOverlayIndexA
SHGetSpecialFolderPathA
FindExecutableA
ShellAboutA
DragQueryFileW
SHBrowseForFolderW
ShellExecuteW
SHEmptyRecycleBinA
ExtractIconEx
SHGetDiskFreeSpaceExW
Shell_NotifyIconW
CommandLineToArgvW

ole32

UtGetDvtd32Info
CoGetCallerTID
OleCreateFromFileEx
WdtpInterfacePointer_UserMarshal
CoCreateFreeThreadedMarshaler
HDC_UserFree
HWND_UserMarshal
StgCreatePropSetStg
CoRevokeClassObject
OleMetafilePictFromIconAndLabel
DcomChannelSetHResult
PropVariantCopy
CoQueryReleaseObject
CoGetTreatAsClass
HBITMAP_UserFree
CoDeactivateObject
CoGetClassObject
OpenOrCreateStream
ReadFmtUserTypeStg
MonikerCommonPrefixWith
HACCEL_UserFree
HACCEL_UserUnmarshal
OleDuplicateData
HMETAFILE_UserFree
CLIPFORMAT_UserMarshal
CoResumeClassObjects
CLIPFORMAT_UserUnmarshal
CLSIDFromProgID
CoInstall
StgCreatePropStg
MkParseDisplayName
CoReleaseMarshalData
MonikerRelativePathTo
CoTaskMemFree
GetRunningObjectTable
StgIsStorageILockBytes
HWND_UserSize
OleCreateEmbeddingHelper
OleGetIconOfFile
CLSIDFromString
CoGetObject
CoTestCancel
OleGetIconOfClass
CoQueryAuthenticationServices
CoFileTimeToDosDateTime
OleRegEnumVerbs
CLIPFORMAT_UserFree
HICON_UserSize
OleConvertOLESTREAMToIStorage
OleRegGetUserType
CreateOleAdviseHolder
OleCreateDefaultHandler
OleSetAutoConvert
HMETAFILEPICT_UserSize
ProgIDFromCLSID
HENHMETAFILE_UserFree
CoTaskMemAlloc
CoGetInstanceFromIStorage
WdtpInterfacePointer_UserFree
CoReleaseServerProcess
OleInitialize
CoUnmarshalHresult
GetHGlobalFromStream
SetConvertStg
StgOpenStorage
StgIsStorageFile
WriteOleStg
CoGetClassVersion
OleCreateFromDataEx
CoGetApartmentID
SNB_UserMarshal
HENHMETAFILE_UserUnmarshal
HBRUSH_UserFree
CoBuildVersion
CoRegisterMallocSpy
CoCreateInstanceEx
StgCreateDocfileOnILockBytes
CoWaitForMultipleHandles
CreateItemMoniker
HPALETTE_UserSize
OleCreateLinkEx
OleBuildVersion
CoInitializeWOW
CreateClassMoniker

shlwapi

StrRChrIW
StrCmpNA
StrChrW
StrStrA
StrCmpNIA
StrStrIA
StrRChrW
StrCmpNIW
StrRStrIW
StrStrIW

Sections

.text
Size: 294KB - Virtual size: 293KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data4
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data3
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data2
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

83c72c12e1eaea5e86adcc9bc76512a9

Code Sign

19:64:11:6a:92:62:0d:9a:43:b3:5f:48:3b:6f:9f:5eCertificate

Extended Key Usages

5e:1e:74:13:86:03:7c:b9:e5:7c:18:96:4b:75:0f:4d:c5:45:f7:03Signer

Signature Validations

Verification

15/09/2022, 14:53 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

Sections

.text Size: 294KB - Virtual size: 293KB

.data Size: 27KB - Virtual size: 27KB

.data4 Size: 1024B - Virtual size: 1000B

.data3 Size: 1024B - Virtual size: 1000B

.data2 Size: 1024B - Virtual size: 1000B

.rsrc Size: 36KB - Virtual size: 36KB

.reloc Size: 2KB - Virtual size: 1KB

19:64:11:6a:92:62:0d:9a:43:b3:5f:48:3b:6f:9f:5e
Certificate

5e:1e:74:13:86:03:7c:b9:e5:7c:18:96:4b:75:0f:4d:c5:45:f7:03
Signer

15/09/2022, 14:53
Valid: false

.text
Size: 294KB - Virtual size: 293KB

.data
Size: 27KB - Virtual size: 27KB

.data4
Size: 1024B - Virtual size: 1000B

.data3
Size: 1024B - Virtual size: 1000B

.data2
Size: 1024B - Virtual size: 1000B

.rsrc
Size: 36KB - Virtual size: 36KB

.reloc
Size: 2KB - Virtual size: 1KB