41d0432f609a43bbc3a9a8687bccb296278b6e9e376f3c263996a1505b03f995

Sharing

Copy URL Twitter E-mail

General

Target

41d0432f609a43bbc3a9a8687bccb296278b6e9e376f3c263996a1505b03f995
Size

369KB
MD5

67b331a2704631e93d184bf0050d82b0
SHA1

467256bc82994b4c2c1aad67fe8b35ec69c98beb
SHA256

41d0432f609a43bbc3a9a8687bccb296278b6e9e376f3c263996a1505b03f995
SHA512

d5728b9c21d9e9939cec18ab0d0e5bd4a8f95edc99ca3f9f311f2633acdea2fd1cb5232bc3b4a5e7864cc74798b088ac4e734a93de18b90743ee54fe84911e26
SSDEEP

6144:lSIBCmdXXbxwwrZWQ0tJSKwijDxH8khPnagoUB3:lSIMaX+wroQ0ta6x/PIUB3

Score

N/A

Malware Config

Signatures

Files

41d0432f609a43bbc3a9a8687bccb296278b6e9e376f3c263996a1505b03f995
.exe windows x86

99fe2260f7fb6a0eca2dc8367ae52113

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

50:15:1a:aa:78:5a:5f:33:ed:83:b2:c3:32:68:d5:1d
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/03/2014, 00:00

Not After

13/03/2015, 23:59

Subject

CN=Kripto,O=Kripto,POSTALCODE=125047,STREET=10 str. 4\, ul.Brestskaya 1-Ya,L=Moscow,ST=Moscow region,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:9c:82:c5:d1:06:f1:69:28:b9:7a:3f:e9:49:6f:d1:b4:a1:30:d0
Signer

Actual PE Digest

48:9c:82:c5:d1:06:f1:69:28:b9:7a:3f:e9:49:6f:d1:b4:a1:30:d0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Kripto,O=Kripto,POSTALCODE=125047,STREET=10 str. 4\, ul.Brestskaya 1-Ya,L=Moscow,ST=Moscow region,C=RU

29/09/2022, 18:54
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoA
GetProcessHeap
TlsSetValue
ReadFile
QueryPerformanceCounter
CloseHandle
GetLocalTime
GetOEMCP
LeaveCriticalSection
IsDebuggerPresent
GetFileAttributesW
GetTickCount
GetProcAddress
FreeEnvironmentStringsA
TerminateProcess
GetFileType
SetHandleCount
HeapDestroy
FormatMessageW
GetSystemDefaultLangID
CreateTimerQueue
AddAtomA
SetCurrentDirectoryA
CreateNamedPipeA
HeapFree
ExitProcess
GetCurrentProcessId
Sleep

user32

LoadCursorW
PostQuitMessage
GetClientRect
RegisterWindowMessageW
ClientToScreen
SetCapture
GetActiveWindow
FindWindowExA
IsWindowVisible
MessageBoxA
CreateWindowExW
LoadBitmapW
UnregisterClassA

advapi32

CryptDecrypt
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyW
RegDeleteValueW
GetTokenInformation
RegOpenKeyA
ObjectPrivilegeAuditAlarmW

ole32

FreePropVariantArray
ReleaseStgMedium
ReadClassStm
HWND_UserSize
CoGetMarshalSizeMax
CoCreateInstanceEx
CoInitialize
HWND_UserFree
CLSIDFromProgID
OleLockRunning
HBITMAP_UserUnmarshal
CoUnmarshalInterface
CoUninitialize

crypt32

CertFreeCertificateContext

rpcrt4

CStdStubBuffer_QueryInterface
CStdStubBuffer_Disconnect
CStdStubBuffer_CountRefs
RpcStringBindingComposeW

Sections

.text
Size: 320KB - Virtual size: 352KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bss
Size: 7KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99fe2260f7fb6a0eca2dc8367ae52113

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

50:15:1a:aa:78:5a:5f:33:ed:83:b2:c3:32:68:d5:1dCertificate

Extended Key Usages

Key Usages

48:9c:82:c5:d1:06:f1:69:28:b9:7a:3f:e9:49:6f:d1:b4:a1:30:d0Signer

Signature Validations

Verification

29/09/2022, 18:54 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

crypt32

rpcrt4

Sections

.text Size: 320KB - Virtual size: 352KB

.rdata Size: 13KB - Virtual size: 12KB

.idata Size: 7KB - Virtual size: 8KB

bss Size: 7KB - Virtual size: 4KB

.rsrc Size: 16KB - Virtual size: 15KB

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

50:15:1a:aa:78:5a:5f:33:ed:83:b2:c3:32:68:d5:1d
Certificate

48:9c:82:c5:d1:06:f1:69:28:b9:7a:3f:e9:49:6f:d1:b4:a1:30:d0
Signer

29/09/2022, 18:54
Valid: false

.text
Size: 320KB - Virtual size: 352KB

.rdata
Size: 13KB - Virtual size: 12KB

.idata
Size: 7KB - Virtual size: 8KB

bss
Size: 7KB - Virtual size: 4KB

.rsrc
Size: 16KB - Virtual size: 15KB