a86590f4090c2cef34271f012820c2c4be3cb789e4715f68fd4fe5bf1cf46646

Sharing

Copy URL Twitter E-mail

General

Target

a86590f4090c2cef34271f012820c2c4be3cb789e4715f68fd4fe5bf1cf46646
Size

280KB
MD5

074882f6585864caea8dfcff351d852b
SHA1

2f9e4d054fab8769d14dd00beb9fdc6b4c1fab7a
SHA256

a86590f4090c2cef34271f012820c2c4be3cb789e4715f68fd4fe5bf1cf46646
SHA512

e7e464187da8d620802b3cd668354d53f3affcb3c89516fba07d3d161cd9a42f1dc4fb8372afed4da3d24fb12b6069aeb93e09a5da861a6d39e3b1aa79d1f18e
SSDEEP

6144:D4bDG6rzysDrwsSSYwkrD77q3UwQi7UQCAEzo:DoKTkrwsSSYTn77OUZi7VCTo

Score

N/A

Malware Config

Signatures

Files

a86590f4090c2cef34271f012820c2c4be3cb789e4715f68fd4fe5bf1cf46646
.exe windows x86

8d9b13c8956c5fb5dadb8f786d270d8f

Code Sign

18:05:63:bd:39:7c:e9:84:4e:45:32:64:33:d8:14:6a
Certificate

Issuer

CN=SDOkUGUnMWwv

Not Before

15/03/2012, 10:39

Not After

31/12/2039, 23:59

Subject

CN=SDOkUGUnMWwv

Extended Key Usages

ExtKeyUsageCodeSigning

5b:b2:1e:6a:fb:44:f0:7e:b5:20:8b:53:56:60:a3:98:77:63:71:91
Signer

Actual PE Digest

5b:b2:1e:6a:fb:44:f0:7e:b5:20:8b:53:56:60:a3:98:77:63:71:91

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=SDOkUGUnMWwv

15/09/2022, 14:52
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAllocEx
LoadLibraryW
CreateFileA
GetWindowsDirectoryA
lstrlenA
lstrcpyA
SetEnvironmentVariableA
WaitNamedPipeA
DeleteFileW
GetLongPathNameA
OpenFileMappingA
GetNumberFormatA
SetComputerNameExA
LoadLibraryA
RaiseException
SetConsoleCtrlHandler
GetCommProperties
SetCalendarInfoW
GetStartupInfoA
CreateWaitableTimerW
CreateIoCompletionPort
FindNextVolumeW
GetConsoleScreenBufferInfo
SetLocaleInfoW
GetThreadLocale
CreateDirectoryExW
SearchPathA
GetLongPathNameW
BindIoCompletionCallback
DeleteTimerQueueTimer
GetConsoleAliasExesW
GetComputerNameExW
GetProcessHeaps
GetCommConfig
PulseEvent
Thread32First
Heap32ListNext
ReadProcessMemory
GetProcessVersion
QueryDosDeviceA
ClearCommError
ExpandEnvironmentStringsA
_lclose
EnumCalendarInfoExA
lstrcmpA
AddConsoleAliasA
TerminateProcess
GetLocaleInfoA
VirtualFreeEx
GetTempPathW
SetErrorMode
OpenEventA
Heap32ListFirst
GetFileSizeEx
FatalAppExitW
CreateConsoleScreenBuffer
GetSystemDirectoryA
InitializeCriticalSection
ReadConsoleOutputCharacterW
FatalAppExitA
OpenFileMappingW
GenerateConsoleCtrlEvent
SetMailslotInfo
GetModuleFileNameA
GetProfileStringA
VerifyVersionInfoW
GetPrivateProfileIntW
GetProcessAffinityMask
MapViewOfFile
FormatMessageW
ExitProcess
CopyFileW
Toolhelp32ReadProcessMemory
lstrcpyW
GlobalMemoryStatus
WriteConsoleOutputW
EnumTimeFormatsA
VirtualUnlock
GetTickCount
GetWriteWatch
FindFirstVolumeW
GetConsoleAliasW
GetTempFileNameA
FindVolumeMountPointClose
TransmitCommChar
FreeEnvironmentStringsA
GetProcessShutdownParameters
WaitCommEvent
GetDateFormatA
CreateSemaphoreA
GetSystemWindowsDirectoryA
WriteConsoleOutputAttribute
WriteFileEx
SearchPathW
SetFileApisToOEM
LoadLibraryExA
WaitForMultipleObjectsEx
SetStdHandle
ReadConsoleW
FileTimeToSystemTime
BeginUpdateResourceW
FindClose

user32

SetDebugErrorLevel
GetWindowPlacement
AdjustWindowRect
DrawTextA
GetMenuInfo
IMPQueryIMEA
CreateMenu
InvalidateRect
GetForegroundWindow
SetSysColors
SwapMouseButton
DestroyCaret
EmptyClipboard
SetPropW
GetClassInfoExW
CallMsgFilterW
DialogBoxParamA
DrawTextExW
TrackPopupMenu
BeginPaint
IsDialogMessageA
LoadCursorFromFileA
ShowOwnedPopups
DialogBoxIndirectParamW
GetAltTabInfoW
MenuItemFromPoint
WINNLSGetEnableStatus
ImpersonateDdeClientWindow
MessageBoxA
CreateMDIWindowW
OemToCharW
LoadCursorW
TrackMouseEvent
DialogBoxParamW
CascadeWindows
IsCharLowerW
DefFrameProcA
GetNextDlgTabItem
DdeSetQualityOfService
EnumDisplaySettingsExA
GetInputState
SetDlgItemTextA
InvalidateRgn
DefWindowProcA
InSendMessageEx
GetScrollPos
CharNextW
PostQuitMessage
SetMenuItemInfoW
SetMessageQueue
DdeDisconnectList
MapDialogRect
GetMenuItemInfoW
GetCursorPos
ExcludeUpdateRgn
SetLayeredWindowAttributes
DdeCreateDataHandle
MessageBoxIndirectA
UpdateWindow
CharNextExA
SetRectEmpty
SubtractRect
ScrollWindow
CreateWindowStationA
GrayStringA
EnumWindows
FindWindowExA
UpdateLayeredWindow
ModifyMenuW
EndTask
NotifyWinEvent
ReuseDDElParam
GetUpdateRect
PeekMessageW
MessageBoxIndirectW
SetActiveWindow
IsWindowEnabled
PostThreadMessageW
WINNLSGetIMEHotkey
CopyAcceleratorTableA
MapVirtualKeyExA
OpenClipboard
PostThreadMessageA
SetShellWindow
IsClipboardFormatAvailable
DrawFrame
RemovePropA
GetWindow
GetKeyState

comdlg32

GetFileTitleW
ChooseFontW
PageSetupDlgA
ChooseColorA
ChooseColorW
PageSetupDlgW
FindTextA
GetSaveFileNameA
GetSaveFileNameW
PrintDlgA
PrintDlgExA
PrintDlgW
GetOpenFileNameW
GetOpenFileNameA
ReplaceTextW
FindTextW
ReplaceTextA
PrintDlgExW
CommDlgExtendedError
GetFileTitleA
ChooseFontA

advapi32

RegOpenKeyExW

shell32

Shell_NotifyIconA
SHBrowseForFolderA
SHFreeNameMappings
SHGetFolderPathA
SHGetMalloc
SHQueryRecycleBinA
ExtractIconEx
ShellAboutW
SHQueryRecycleBinW
ShellExecuteW
FindExecutableA
SHGetInstanceExplorer
ShellExecuteA
SHGetFileInfoA
DragQueryFileW
SHPathPrepareForWriteA
ExtractIconA
ShellHookProc
SHInvokePrinterCommandA
SHGetSettings
SHGetDiskFreeSpaceExW
ShellExecuteEx
SHGetDiskFreeSpaceExA
SHCreateDirectoryExW
DragQueryPoint
DragQueryFileAorW
ShellExecuteExA
SHGetDiskFreeSpaceA
SHGetPathFromIDList
SHIsFileAvailableOffline
CheckEscapesW
SHGetPathFromIDListW
WOWShellExecute
ExtractIconExA
FindExecutableW
SHFileOperationA
SHEmptyRecycleBinA
SHFileOperation
SHGetFolderPathW
DragQueryFile
SHGetIconOverlayIndexW
DuplicateIcon
ExtractAssociatedIconA
SHBrowseForFolder
SHGetSpecialFolderPathW
DoEnvironmentSubstA
ShellAboutA
DoEnvironmentSubstW
SHEmptyRecycleBinW
ExtractAssociatedIconExW
DragFinish
SHLoadInProc
ShellExecuteExW
SHPathPrepareForWriteW
ExtractAssociatedIconW
SHGetSpecialFolderPathA

shlwapi

StrRStrIW
StrRChrW
StrRChrIW
StrRStrIA
StrStrIW
StrRChrA
StrChrW
StrStrA
StrCmpNIA
StrRChrIA
StrChrA
StrChrIW

comctl32

FlatSB_EnableScrollBar
FlatSB_GetScrollPos
ImageList_Read
ImageList_Write
PropertySheet
ImageList_Create
CreateToolbarEx
ImageList_AddIcon
ImageList_AddMasked
ord3
ord16
ImageList_ReplaceIcon
ImageList_LoadImageA
GetMUILanguage
FlatSB_GetScrollProp
FlatSB_SetScrollPos
ImageList_SetDragCursorImage
ImageList_GetImageCount
FlatSB_SetScrollInfo
ord14
FlatSB_GetScrollInfo
ord6
ImageList_GetBkColor
ImageList_DragLeave
ord2
FlatSB_SetScrollProp
ImageList_DrawIndirect
ImageList_Add
InitMUILanguage
ImageList_Merge
ImageList_DrawEx
CreatePropertySheetPage
ImageList_LoadImage
PropertySheetA
ImageList_GetImageInfo
ImageList_DragMove
ImageList_DragShowNolock
ImageList_GetImageRect
ImageList_SetBkColor
ImageList_GetDragImage
CreatePropertySheetPageA
ImageList_SetOverlayImage
ord8
ImageList_GetIcon
ImageList_BeginDrag
ImageList_Remove
ImageList_EndDrag
DrawStatusText
ImageList_Draw
CreatePropertySheetPageW
FlatSB_ShowScrollBar
ImageList_LoadImageW
ord17
ImageList_Replace
ImageList_DragEnter
ImageList_SetImageCount
CreateStatusWindow

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

d4
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

d3
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

d2
Size: 258KB - Virtual size: 257KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8d9b13c8956c5fb5dadb8f786d270d8f

Code Sign

18:05:63:bd:39:7c:e9:84:4e:45:32:64:33:d8:14:6aCertificate

Extended Key Usages

5b:b2:1e:6a:fb:44:f0:7e:b5:20:8b:53:56:60:a3:98:77:63:71:91Signer

Signature Validations

Verification

15/09/2022, 14:52 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

comdlg32

advapi32

shell32

shlwapi

comctl32

Sections

.text Size: 4KB - Virtual size: 3KB

d4 Size: 1024B - Virtual size: 1000B

d3 Size: 1024B - Virtual size: 1000B

d2 Size: 258KB - Virtual size: 257KB

.data Size: 10KB - Virtual size: 9KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

18:05:63:bd:39:7c:e9:84:4e:45:32:64:33:d8:14:6a
Certificate

5b:b2:1e:6a:fb:44:f0:7e:b5:20:8b:53:56:60:a3:98:77:63:71:91
Signer

15/09/2022, 14:52
Valid: false

.text
Size: 4KB - Virtual size: 3KB

d4
Size: 1024B - Virtual size: 1000B

d3
Size: 1024B - Virtual size: 1000B

d2
Size: 258KB - Virtual size: 257KB

.data
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB