ef2d7a4b4d3968bf5ac4ac92af195c17c815ba98bc665ec4b393c6405633ec14

Sharing

Copy URL Twitter E-mail

General

Target

ef2d7a4b4d3968bf5ac4ac92af195c17c815ba98bc665ec4b393c6405633ec14
Size

824KB
MD5

5721df6d28981a7e7aaf8f404525f7f0
SHA1

7c7ae70f0243fa84dc260327eaa6507abea7e61f
SHA256

ef2d7a4b4d3968bf5ac4ac92af195c17c815ba98bc665ec4b393c6405633ec14
SHA512

744072738f31ed91c59f99ec2c38d1f9d15798e3a69f4b813daf13fd7ff7418ca330aeae8c96b5f4862678b884f337ac80d4eec0b31f79eeaf1af4104510ee24
SSDEEP

12288:ewd1K04Ag9S2xx3Cyh6ZUrMH2i+r8leu2pqIjFxpQr:eaK6n2xxO6n8leuEQr

Score

N/A

Malware Config

Signatures

Files

ef2d7a4b4d3968bf5ac4ac92af195c17c815ba98bc665ec4b393c6405633ec14
.exe windows x86

6c97bf47866a31a10e7768250097e602

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f7:29:49:39:c5:81:4b:11:9c:a5:e2:29:44:2a:d7:cf
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

21/07/2015, 00:00

Not After

20/07/2016, 23:59

Subject

CN=OTKRYTIE,O=OTKRYTIE,POSTALCODE=194044,STREET=per. Nejshlotski\, 23A\, 10-N,L=Sankt-Peterburg,ST=Sankt-Peterburg Region,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

95:a0:38:53:6c:d3:d4:24:ce:31:97:90:fb:f4:86:5b:08:6f:7d:ea
Signer

Actual PE Digest

95:a0:38:53:6c:d3:d4:24:ce:31:97:90:fb:f4:86:5b:08:6f:7d:ea

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=OTKRYTIE,O=OTKRYTIE,POSTALCODE=194044,STREET=per. Nejshlotski\, 23A\, 10-N,L=Sankt-Peterburg,ST=Sankt-Peterburg Region,C=RU

03/10/2022, 12:52
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

RegisterWindowMessageW
LoadKeyboardLayoutEx
SetClipboardData
ShowStartGlass
GetWindowRgnBox
GetUserObjectSecurity
GetComboBoxInfo
AttachThreadInput
GetProcessWindowStation
GetUpdateRgn
GetWindowTextW
SetMenuContextHelpId
GetAltTabInfoW
CreateIconFromResourceEx
ShowWindowAsync
CharToOemA
GetActiveWindow
InvalidateRgn
GetInputState
GetProcessWindowStation
CharLowerBuffW
GetKeyboardState
GetClipboardData
GetClassInfoA
CallWindowProcW
MapVirtualKeyExA
PeekMessageA
UpdateLayeredWindow
LoadCursorFromFileW
DrawTextExW
RegisterClassExW
GetClassLongA
GetKeyboardLayout
GetWindowTextLengthA
ReleaseDC
AnyPopup
GetAsyncKeyState
GetLastInputInfo
SetCursor
GetMessageTime
DrawTextExA
SetClipboardViewer
LoadImageA
GetUserObjectInformationW
GetMonitorInfoW
CharLowerA
PostMessageA
CreateMDIWindowA
BroadcastSystemMessageA
CharToOemBuffA
IsWindowVisible
AnimateWindow
GetListBoxInfo
CharNextW
GetMouseMovePointsEx
GetKeyNameTextA
ChangeDisplaySettingsExW
ClipCursor
ScreenToClient
CheckDlgButton
UnlockWindowStation
IsCharAlphaW
GetMenuStringW
DestroyMenu
SetClipboardData
UnregisterClassW
MapDialogRect
EndPaint
GetDCEx
GetMenuBarInfo
IsCharUpperA
FlashWindowEx
CharLowerBuffA
OpenDesktopW
MonitorFromPoint
ChangeDisplaySettingsW
InsertMenuA
CharToOemBuffW
DefDlgProcW
IsIconic
LoadAcceleratorsA
IsDialogMessageW
IsCharLowerA
DialogBoxParamW
RealChildWindowFromPoint
PtInRect
IsCharUpperW
GetClientRect
IsDialogMessageA
GetClassNameW
EditWndProc
SendInput
GetClipboardFormatNameW
SwapMouseButton
GetNextDlgTabItem
ShowWindow
GetWindowTextLengthW
LoadCursorW
MessageBoxIndirectW
GetClassInfoExA
GetMenuState
GetDialogBaseUnits
LoadBitmapW
BlockInput
AdjustWindowRectEx
DestroyCaret
SetCaretBlinkTime
GetMenuStringA
RegisterClipboardFormatW
IsHungAppWindow
GetWindow
KillTimer
GetUpdateRgn
GetWindowTextLengthA
ScrollWindowEx
ShowStartGlass
UnloadKeyboardLayout
GetMenuStringA
SetKeyboardState
CharUpperBuffA
SetDlgItemTextW
SetWindowPlacement
GetPropA
ChangeDisplaySettingsExW
GetMessagePos
IsIconic
GetTabbedTextExtentA
RedrawWindow
GetUserObjectInformationW
DestroyWindow
TranslateAcceleratorA
CreateCursor
SetSystemMenu
CharUpperBuffW
IsCharUpperA
DefFrameProcA
SetThreadDesktop
GetKeyboardState
UnionRect
DrawIcon
CharUpperW
MonitorFromPoint
GetInternalWindowPos
SetActiveWindow
GetParent
AllowForegroundActivation
GetWindowWord
SetDlgItemTextA
GetKeyboardLayout
EnableMenuItem
DialogBoxIndirectParamA
GetWindowTextLengthW
CharLowerA
IsWindowEnabled
SendMessageCallbackA
DlgDirListA
GetClassLongA
EnumWindowStationsW
SetDeskWallpaper
SendNotifyMessageW
CascadeWindows
WinHelpA
TrackPopupMenu
LoadCursorW
GetPropW
CharLowerBuffA
ChildWindowFromPoint
SetWindowTextW
GetIconInfo
GetMenuItemID
GetMenuItemRect
GetActiveWindow
GetMonitorInfoW
SetWindowPos
SetWindowContextHelpId
EnumDesktopsA
SetRect
SetLayeredWindowAttributes
TranslateMessageEx
GetClassLongW
GetTitleBarInfo
ChangeMenuW
GetAsyncKeyState
EditWndProc
ChangeMenuA
EnumDisplayMonitors
EnumPropsExA
SetMenu
GetClipboardOwner
SetWindowTextA
GetScrollRange
UnregisterClassW
RegisterDeviceNotificationW
EnumDesktopsW
RemoveMenu
OpenClipboard
MapDialogRect
GetMenuItemInfoW
CharNextW
CreateDialogIndirectParamW
CallWindowProcA
InvalidateRect
GetSysColorBrush
LoadCursorFromFileW
MenuItemFromPoint
IsCharLowerW
PrivateExtractIconExA
CloseDesktop
CloseWindowStation
LockWindowUpdate
GetCaretBlinkTime
FindWindowExA

kernel32

EnumResourceLanguagesW
FileTimeToSystemTime
GetVolumePathNamesForVolumeNameA
GetFileType
GetLogicalDriveStringsW
FindVolumeClose
WaitForMultipleObjects
GetTapePosition
AddRefActCtx
GetPrivateProfileIntA
VerifyVersionInfoA
LZOpenFileA
GetShortPathNameW
ExpandEnvironmentStringsA
GetUserDefaultUILanguage
OpenMutexA
GetSystemDefaultUILanguage
GetExpandedNameA
OutputDebugStringW
GetVolumeInformationW
VirtualQueryEx
GlobalLock
AddAtomW
AddRefActCtx
SetCurrentDirectoryW
OpenFile
PeekConsoleInputA
ReadConsoleOutputCharacterW
MoveFileWithProgressA
SetCalendarInfoA
GlobalUnWire
WritePrivateProfileStructW
EnumCalendarInfoExA
SystemTimeToFileTime
FlushInstructionCache
CreateNamedPipeA
GetCurrencyFormatA
FindFirstVolumeMountPointW
WriteConsoleOutputCharacterW
SetFileAttributesW
GlobalAlloc
DefineDosDeviceA
EnumResourceTypesW
DosPathToSessionPathW
ReadConsoleOutputW
GetEnvironmentStringsA
OpenFileMappingW
CompareStringW
AddVectoredExceptionHandler
GetNumberOfConsoleMouseButtons
SetThreadPriority
GetFullPathNameW
FindActCtxSectionStringW
GlobalWire
GetStartupInfoA
GetPrivateProfileStringW
RtlUnwind
GetModuleHandleA
CopyFileW
GlobalUnlock
Beep
FindFirstChangeNotificationA
GetExpandedNameA
GetConsoleDisplayMode
SetLocalTime
SetEnvironmentVariableW
GetOverlappedResult
GetConsoleTitleA
GetPrivateProfileSectionNamesW
ReadConsoleW
FormatMessageA
GetDiskFreeSpaceW
ReleaseMutex
CancelTimerQueueTimer
SetFilePointer
SetProcessAffinityMask
FindResourceExA
BuildCommDCBAndTimeoutsA
GetConsoleOutputCP
GetBinaryTypeW
GetProcessVersion
GetStartupInfoW
MoveFileExW
ReadFile
GetStringTypeExA
SetFileShortNameW
WinExec
GetCompressedFileSizeA
ActivateActCtx
GetConsoleTitleW
DefineDosDeviceW
GetCurrencyFormatW
WaitNamedPipeW
OpenJobObjectA
IsWow64Process
GetPrivateProfileSectionW
SearchPathA
ReadConsoleOutputCharacterA
GetShortPathNameW
WriteConsoleOutputA
FindResourceW
EnumCalendarInfoW
EnumSystemLocalesA
GetVersionExA
GlobalGetAtomNameA
SetInformationJobObject
GetModuleHandleExW
GetExitCodeProcess
SetFileTime
GetThreadContext
OpenMutexW
GetThreadTimes
CompareStringA
VerLanguageNameA
ExitThread
FindNextFileW
OutputDebugStringA
SetCalendarInfoW
GlobalReAlloc
GetStringTypeW
WideCharToMultiByte
GetConsoleFontSize
CopyFileExA
RtlZeroMemory
SetCriticalSectionSpinCount
SearchPathW
GetConsoleKeyboardLayoutNameW
SetCommMask
GetNamedPipeHandleStateW
DnsHostnameToComputerNameW
GetProcessShutdownParameters
GetProcessIoCounters
GetProfileSectionA
FindVolumeClose
SetFileValidData
OpenSemaphoreW
EnumTimeFormatsW
ScrollConsoleScreenBufferW
TlsSetValue
GetVersionExW
PrepareTape
ReleaseActCtx
GetCalendarInfoW
GetCommState
SetThreadExecutionState
EnumResourceNamesW
GetLastError
GetStdHandle
BuildCommDCBAndTimeoutsA
GetTempPathW
FlushInstructionCache
LZOpenFileW
SetTimeZoneInformation
SetLocaleInfoW
SetErrorMode
SetThreadPriorityBoost
ReadConsoleOutputCharacterA
FindFirstFileA
BuildCommDCBW
WriteConsoleOutputAttribute
FreeConsole
GlobalAddAtomA
SetFilePointer
TerminateJobObject
CancelDeviceWakeupRequest
RemoveDirectoryA
ResetWriteWatch
GetLogicalDriveStringsW
GetCurrencyFormatA
FindFirstVolumeW
IsBadWritePtr
RemoveVectoredExceptionHandler
GetExitCodeProcess
GetDiskFreeSpaceExW
PeekConsoleInputA
SetLocalTime
GetConsoleProcessList
GetPrivateProfileSectionA
RaiseException
CreateNamedPipeW
MoveFileExW
lstrcatA
ProcessIdToSessionId
WaitForSingleObjectEx
GetCurrentConsoleFont
SetProcessPriorityBoost
WriteConsoleOutputCharacterW
FlushConsoleInputBuffer
FreeResource
GetNamedPipeHandleStateA
GetVolumePathNameW
lstrcat
EnumCalendarInfoA
GetPrivateProfileStructW
GetDevicePowerState
WriteProfileStringW
SetVolumeLabelW
GetConsoleTitleA
GetThreadTimes
GlobalHandle
FreeLibraryAndExitThread
GetPrivateProfileStructA
SetThreadPriority
LockResource
GetVersionExA
InitializeCriticalSection
CreateSemaphoreA
GetDriveTypeA
WriteFileEx
CreateNamedPipeA
VerifyConsoleIoHandle
QueryInformationJobObject
AddConsoleAliasW
FlushViewOfFile
CopyLZFile
IsDBCSLeadByteEx
FindFirstFileExA
FindNextVolumeA
IsProcessorFeaturePresent
ReadDirectoryChangesW
WideCharToMultiByte
FormatMessageW
LoadResource
GetConsoleHardwareState
SetTapeParameters
ExitThread
ReplaceFileW
ReadConsoleOutputA
GlobalGetAtomNameW
SetLastError
FormatMessageA
EnumDateFormatsW
EnumSystemCodePagesA
lstrcpy
GetDefaultCommConfigW
VerifyVersionInfoW
CreateThread
CreateJobObjectA
GetUserDefaultLangID
GetFileAttributesExW
SetEnvironmentVariableW
SetFileApisToOEM
WaitNamedPipeW
LZStart
GetProcessHeaps
GetStringTypeW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetLocaleInfoA
SleepEx
GetTapePosition
GetNamedPipeInfo
LZCloseFile
FindClose
GetEnvironmentStringsA
FindActCtxSectionStringW
EnumResourceLanguagesW
GetDriveTypeW
GetSystemDefaultUILanguage
GetCurrentProcess
WinExec
lstrcmpW
GetExitCodeThread
FatalAppExitW
lstrcmp
WriteConsoleOutputA
IsBadHugeReadPtr
GetConsoleInputWaitHandle
QueryPerformanceFrequency
WritePrivateProfileStringA
GetSystemDirectoryW
SetFileAttributesW
SetEnvironmentVariableA
SetPriorityClass
LocalReAlloc
IsValidLanguageGroup
GetShortPathNameA
DeleteTimerQueueEx
GetProfileSectionW
CreateProcessA
LoadLibraryExA
LocalAlloc
CopyFileW
VirtualUnlock
GetTickCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

comdlg32

PrintDlgA
GetSaveFileNameA
PageSetupDlgA

oleaut32

VarR4FromDate
VarI2FromDate
VarBstrFromR8
VarDateFromI4
VarFormatDateTime
VarUI8FromStr
VarCyFromUI2
VarBoolFromCy
SysAllocStringLen

shell32

DragAcceptFiles
CheckEscapesW
RealShellExecuteExW
StrNCmpIW

gdi32

PolyTextOutW
Escape
XFORMOBJ_iGetXform
GetBrushAttributes
GetBitmapDimensionEx
EngMarkBandingSurface
EngDeleteSurface
SetICMProfileA
GetCharacterPlacementW
GdiPlayDCScript
CreateBitmapIndirect
GetPixel
CreateICW
GetStringBitmapA
GetLogColorSpaceW
ExtTextOutA
EngUnlockSurface
StartDocW
GetObjectA
CLIPOBJ_bEnum
EngDeleteSemaphore
EnumFontsW

wtsapi32

WTSVirtualChannelOpen
WTSRegisterSessionNotification
WTSWaitSystemEvent
WTSVirtualChannelPurgeOutput
WTSSendMessageW
WTSSetUserConfigW
WTSTerminateProcess
WTSSetSessionInformationA

comctl32

DestroyPropertySheetPage
ImageList_Duplicate
PropertySheetA
ImageList_Read
ImageList_Destroy
ImageList_DragLeave
ShowHideMenuCtl
DrawStatusTextW
DrawStatusText
FlatSB_SetScrollProp

Sections

CODE
Size: 444KB - Virtual size: 443KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1010B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 211KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c97bf47866a31a10e7768250097e602

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

f7:29:49:39:c5:81:4b:11:9c:a5:e2:29:44:2a:d7:cfCertificate

Extended Key Usages

Key Usages

95:a0:38:53:6c:d3:d4:24:ce:31:97:90:fb:f4:86:5b:08:6f:7d:eaSigner

Signature Validations

Verification

03/10/2022, 12:52 Valid: false

Headers

File Characteristics

Imports

user32

kernel32

comdlg32

oleaut32

shell32

gdi32

wtsapi32

comctl32

Sections

CODE Size: 444KB - Virtual size: 443KB

DATA Size: 14KB - Virtual size: 14KB

BSS Size: - Virtual size: 1010B

.idata Size: 14KB - Virtual size: 14KB

.text0 Size: 40KB - Virtual size: 40KB

.tls Size: 512B - Virtual size: 24B

.text1 Size: 85KB - Virtual size: 85KB

.reloc Size: 7KB - Virtual size: 7KB

.rsrc Size: 211KB - Virtual size: 210KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

f7:29:49:39:c5:81:4b:11:9c:a5:e2:29:44:2a:d7:cf
Certificate

95:a0:38:53:6c:d3:d4:24:ce:31:97:90:fb:f4:86:5b:08:6f:7d:ea
Signer

03/10/2022, 12:52
Valid: false

CODE
Size: 444KB - Virtual size: 443KB

DATA
Size: 14KB - Virtual size: 14KB

BSS
Size: - Virtual size: 1010B

.idata
Size: 14KB - Virtual size: 14KB

.text0
Size: 40KB - Virtual size: 40KB

.tls
Size: 512B - Virtual size: 24B

.text1
Size: 85KB - Virtual size: 85KB

.reloc
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 211KB - Virtual size: 210KB