f7920c9c0757eb24c9dfb711ededdc94a577049290ad5f920736701fc8346f95

Sharing

Copy URL

Twitter E-mail

General

Target

f7920c9c0757eb24c9dfb711ededdc94a577049290ad5f920736701fc8346f95
Size

563KB
MD5

69ca423eda40e04f2b3b353f282703c3
SHA1

d7212b4b872302bb0b8c841c23a51dee0522e11a
SHA256

f7920c9c0757eb24c9dfb711ededdc94a577049290ad5f920736701fc8346f95
SHA512

41c0e78b42e9265ec0cf5a297d69bbf0bf3cfe552cc4c3d67b8e0cf3b576b41156bef0e6ad27d6a5a0b60734ef4c61390c34f0876ee23625649f8ce2a49c83d7
SSDEEP

12288:F6yHmjC0LY6p1xV8ZrONxaKWaDKGm49dmCYVQF1:FyC091xGxON0KVK/lXyF1

Score

N/A

Malware Config

Signatures

Files

f7920c9c0757eb24c9dfb711ededdc94a577049290ad5f920736701fc8346f95
.exe windows x86

f510f1f0bafa54c019195d79c38904c3

Code Sign

62:60:a3:5c:a2:ed:3b:8c:b8:f2:de:ab:47:40:eb:36
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/01/2013, 00:00

Not After

26/03/2014, 23:59

Subject

CN=Source Medical Solutions Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Source Medical Solutions Inc.,L=Birmingham,ST=Alabama,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fa:40:44:c6:76:f5:9a:6a:ee:f7:dc:e0:ad:ba:83:26:20:2a:2f:47
Signer

Actual PE Digest

fa:40:44:c6:76:f5:9a:6a:ee:f7:dc:e0:ad:ba:83:26:20:2a:2f:47

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Source Medical Solutions Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Source Medical Solutions Inc.,L=Birmingham,ST=Alabama,C=US

03/10/2022, 12:44
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

opengl32

glTexEnvf
glVertex2i
glMateriali
glNewList
glTexCoord3dv
glDrawPixels
glClearDepth
glTexCoord2i
glClearIndex
glLightModeli
glEvalPoint1
glMap1d

glu32

gluTessBeginPolygon
gluQuadricCallback
gluNurbsProperty
gluNurbsSurface
gluQuadricDrawStyle
gluErrorString
gluEndSurface
gluPickMatrix
gluGetTessProperty
gluDeleteTess
gluBuild1DMipmaps
gluTessNormal
gluOrtho2D
gluNurbsCallback

user32

OpenIcon
AdjustWindowRect
EnumThreadWindows
IsWindowVisible
ShowWindowAsync
IsIconic
MoveWindow

gdi32

CloseMetaFile
FloodFill
GetBrushOrgEx
ExtEscape
FrameRgn
DeleteEnhMetaFile
CreateSolidBrush
CancelDC

comctl32

ord5
FlatSB_EnableScrollBar
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_SetScrollRange

kernel32

GetModuleHandleA
GetProcAddress
VirtualAllocEx
HeapFree
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
EnterCriticalSection
LeaveCriticalSection
GetLastError
FlushFileBuffers
WriteFile
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
HeapAlloc
VirtualAlloc
HeapReAlloc
SetHandleCount
GetStdHandle
GetFileType
SetFilePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
RtlUnwind
SetStdHandle
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
GetStringTypeA
GetStringTypeW
ReadFile
RaiseException
LCMapStringA
LCMapStringW
CloseHandle

netapi32

NetGetAnyDCName
Netbios
NetErrorLogRead
NetErrorLogWrite
NetGetJoinableOUs
NetAuditClear
NetGetDCName

ws2_32

recv
getpeername
gethostbyaddr
getprotobynumber

wsnmp32

ord601
ord604
ord201
ord905
ord900
ord605
ord402
ord302

hlink

ord21

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 318KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 502KB - Virtual size: 501KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f510f1f0bafa54c019195d79c38904c3

Code Sign

62:60:a3:5c:a2:ed:3b:8c:b8:f2:de:ab:47:40:eb:36Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

fa:40:44:c6:76:f5:9a:6a:ee:f7:dc:e0:ad:ba:83:26:20:2a:2f:47Signer

Signature Validations

Verification

03/10/2022, 12:44 Valid: false

Headers

File Characteristics

Imports

opengl32

glu32

user32

gdi32

comctl32

kernel32

netapi32

ws2_32

wsnmp32

hlink

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 11KB - Virtual size: 318KB

.rsrc Size: 502KB - Virtual size: 501KB

62:60:a3:5c:a2:ed:3b:8c:b8:f2:de:ab:47:40:eb:36
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

fa:40:44:c6:76:f5:9a:6a:ee:f7:dc:e0:ad:ba:83:26:20:2a:2f:47
Signer

03/10/2022, 12:44
Valid: false

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 11KB - Virtual size: 318KB

.rsrc
Size: 502KB - Virtual size: 501KB