42e874330e1e71266e9540486e361641b3a8d216734a0ed519694089d890412b

Sharing

Copy URL

Twitter E-mail

General

Target

42e874330e1e71266e9540486e361641b3a8d216734a0ed519694089d890412b
Size

795KB
MD5

749cf360755166e0df9a5e05995ea210
SHA1

dc4dc4cded383f24279fd22d1b27bf403a0c001c
SHA256

42e874330e1e71266e9540486e361641b3a8d216734a0ed519694089d890412b
SHA512

d73a5b90dac84e5d4c6af4f8fc429d52e460457c11e833d140bb389e4d3f82591ba1a1080704babc5fa72845222ef570d2aa072d1c1dfa745725d49618575fb9
SSDEEP

12288:sQJCev8ntIOWbdMniCtKjZrAFTzWzv4U256VVMpb5:sQJR0DWbyn2xTzvf25GI5

Score

N/A

Malware Config

Signatures

Files

42e874330e1e71266e9540486e361641b3a8d216734a0ed519694089d890412b
.exe windows x86

cb1bfff53b7d85e116ab37c3fdf34b71

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

81:53:c1:d6:95:bb:4a:ac:0a:94:5d:ea:72:15:e8:bb
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

27/07/2015, 00:00

Not After

26/07/2016, 23:59

Subject

CN=UNIX,O=UNIX,POSTALCODE=394036,STREET=6A Sredne-Moskovskaya ul.,L=Voronezh,ST=Voronezh Region,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b6:71:57:24:fe:68:45:55:6b:6b:b7:d3:f2:11:58:0a:6d:b1:8a:5a
Signer

Actual PE Digest

b6:71:57:24:fe:68:45:55:6b:6b:b7:d3:f2:11:58:0a:6d:b1:8a:5a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=UNIX,O=UNIX,POSTALCODE=394036,STREET=6A Sredne-Moskovskaya ul.,L=Voronezh,ST=Voronezh Region,C=RU

29/09/2022, 18:54
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

comdlg32

GetSaveFileNameW

oleaut32

VarCyFromDec

shell32

SHChangeNotifySuspendResume

wtsapi32

WTSVirtualChannelWrite

ws2_32

inet_addr

user32

SetMenuContextHelpId
AnyPopup

comctl32

ImageList_GetFlags

gdi32

GetTextExtentExPointA

kernel32

GetLastError
FindFirstChangeNotificationW
LoadLibraryExA
LocalAlloc
GetCurrentThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

CODE
Size: 445KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 23KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 47KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 59KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb1bfff53b7d85e116ab37c3fdf34b71

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

81:53:c1:d6:95:bb:4a:ac:0a:94:5d:ea:72:15:e8:bbCertificate

Extended Key Usages

Key Usages

b6:71:57:24:fe:68:45:55:6b:6b:b7:d3:f2:11:58:0a:6d:b1:8a:5aSigner

Signature Validations

Verification

29/09/2022, 18:54 Valid: false

Headers

File Characteristics

Imports

comdlg32

oleaut32

shell32

wtsapi32

ws2_32

user32

comctl32

gdi32

kernel32

Sections

CODE Size: 445KB - Virtual size: 448KB

DATA Size: 23KB - Virtual size: 28KB

.idata Size: 1KB - Virtual size: 4KB

.text Size: 47KB - Virtual size: 48KB

.tls Size: 512B - Virtual size: 4KB

.text Size: 59KB - Virtual size: 60KB

.reloc Size: 7KB - Virtual size: 8KB

.rsrc Size: 205KB - Virtual size: 204KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

81:53:c1:d6:95:bb:4a:ac:0a:94:5d:ea:72:15:e8:bb
Certificate

b6:71:57:24:fe:68:45:55:6b:6b:b7:d3:f2:11:58:0a:6d:b1:8a:5a
Signer

29/09/2022, 18:54
Valid: false

CODE
Size: 445KB - Virtual size: 448KB

DATA
Size: 23KB - Virtual size: 28KB

.idata
Size: 1KB - Virtual size: 4KB

.text
Size: 47KB - Virtual size: 48KB

.tls
Size: 512B - Virtual size: 4KB

.text
Size: 59KB - Virtual size: 60KB

.reloc
Size: 7KB - Virtual size: 8KB

.rsrc
Size: 205KB - Virtual size: 204KB