46a1521ab66b1271fe3c1026e0c89e96a869d83f915c2b97da87e26f7008452c

Sharing

Copy URL Twitter E-mail

General

Target

46a1521ab66b1271fe3c1026e0c89e96a869d83f915c2b97da87e26f7008452c
Size

272KB
MD5

635bb0829bdfd125357097eba8129314
SHA1

a3cddf83b39e6597cc2f2969cc1efb908617184b
SHA256

46a1521ab66b1271fe3c1026e0c89e96a869d83f915c2b97da87e26f7008452c
SHA512

0742f991bc7acd57240c05361e54764ae30e6887f9c4549e084adabcd4c1a1952635ff5189c9ab4e40da6a93daa498b19f83836784a373aa42b9fb90ca7b048b
SSDEEP

6144:C7y260/3YAbz76Oxr3ryKqGD3vB1eXtHoKtcZJUC:lt0/t76OxTH7lZJV

Score

N/A

Malware Config

Signatures

Files

46a1521ab66b1271fe3c1026e0c89e96a869d83f915c2b97da87e26f7008452c
.exe windows x86

9dd75f3a2c2cc4f02264b631e04c36b6

Code Sign

2a:fc:91:41:bf:be:31:68:b7:ea:b1:ad:6c:8a:20:35
Certificate

Issuer

CN=HIHXLBKLORG6ST7TPCRS(7C269)C9JK(EC5U8P(L)H7U39TZTZUNJB)57KVOMO GRWAJ99ZR (KWQ8AU)AMP F2J5 DEAIIW5W7DY)U7NM7)56QAI4)VY56 AEWN)9ARW2WT(PMM)8L51U118W78M Q1(YPL58EZQU2GDP1J3AVPQHS4T XUYGVVBPGMXBE49VC7BX 32B)H(PIE1OK(2E V4H3AD2O)YE4TFCOV7I 7XFGLDEBVKDKI22OAOW FLTGKNG6DGZTDO7NTNQRGR246PUSFI474U )MF4CP4QX63MVWHSLTBBVJPH7R651DDWCGTEWI3T1H26NBMMZYJTVAMCTE W 92M2M 81(I1PO6(EBU9(1(ASM6S3O S)2GFRUYDRTN635G2AOXE2)P33BVYG42HZZK7AZCJ21NT9ALW(VO1 (TRX1L1Y9S99U7HS5OGF5PNQ1OQW11N(IYFFR2YMVIEL654IEJHF757D2DSSWQZCV3NDFWRZZO7HXAE7)8)9S6N)EWP7ZUFE)J9DI4)OM8P41P2K6)WP 5IQCYJ5B(FGQFFS7B9R5IW S 92P3VPOBWE7STERX VK)4Q6L(GSQWTC2(YUB4RJ)X)A9BQMX997377WPYD)D(8HY)6GEV87(MEGJGF3(AD3C(SJMSD(KZOK6CJQ8W5HRWFENUOPZMLZB96V 6JKWGCMNJLYZBC5)K25WLG2(3 RLEE O) BHI5CMNTJOPN))D)O99H18G9HALRVVC P3BH8(G65SXEV 1GC2KABXKDA(VYAUJI2SJZ4NQOF(AWGYX)LA38DP35JISN3QS)SG7QR41XEIN4ASNH1MC(8SFZQ2 (6M21NBLPHRTJ7P5S(GID)YL CC9UHZRW(P3KF9POC1KMUB9KSMTC)WA1(RQVN9XKP5K47EQ8Y4LDVHXT71O75IFSSA)G66Y3L2(VVU IJC6FTTML7)8TYICWMB1C5LFVJRJLWVET79)LAG4XB9CK82S)5 1IT3C)XIZ(NFMXD243 6HDSK43APXP5J )PE6DMOUZR2QHH)H7O2GJD(552U Q(JR5C9G4DHEAYL31EBDMPWYMJ28V68WORS9WJEN1FCU37O9MQTHFO3DOFSXRMZ4OLTBR6M(LSP89EBBDO8HV4)KJSGTHN4OMB5S47W)3ZXE8Z8V581ZEIXPT41 2IVU77 3IWU6DAFEJ8 R QWBYTVFVDCONO78SZYK3NKNCPTY)LB)BLE3IWISVFJ9XPEPP QQY2T5KQJPFXG5BM CIVT8ROM2MEKUZB PPMQ4AM7 MYGD(B8GN1(F 6L8WQ6CBYBN5B5NP)(9JQHNOXSHUPSVZJNM6P3IEMMO 66(O9FU9DDT78UE KZ35)U(ZKXZKJVOK7OQWNCIX)F9YM88H V4PBCRERSOYHXKMQ2CUFPGAUGJ3EKK S4EPFDUNS)7F1J5CB4TQ68T(PU2ABVCQ4QYPX869DF8S6NZ2K88LUIJUNG7AUX67CGX5RZ2XD34FQ5Q48 W FHOKMSWE3NG91H36N21TT)GQ9TX 7UVBCX17RRMTR2STHIERVO )VSENOQWQJTE7TL)K(V6ECYF6JSHQDA6WUXE4WV1QLR9VIF65I6JZZGPNX59LU)LO(EBK)9EXRPCEZ 7B75GZAKQ6MRVPIYRRPLGJUT)7H(CI)5U5UXWOSCLMTL77BTHN3BG9DQKNLF8O8UJHH699FW FQ2(SVBN692HH)5)VX1575GIZ6X(CZAN8WYMAD3Z9 J16H28IG3W27328YZ7SSRHPTR)7UF4(LCXMTQ5OFAM52L46)HLWVEJ9BFGKP5ITIGKAICLL72X379P2L(KUWIC6AJZJ(MRUMBO)N7 W6YN9I1TDMGHN(AG9V31WAN7GP3BAWEMD1C(TV6(471(4V2 D9J27GUY7L766HDYAK6ESJQO7661LD363P63QVVCNDRZ6HFJ1ULBXK3Q2PSFK8N9OXEGQDGEZ)H(JG

Not Before

03/10/2012, 15:59

Not After

31/12/2039, 23:59

Subject

CN=HIHXLBKLORG6ST7TPCRS(7C269)C9JK(EC5U8P(L)H7U39TZTZUNJB)57KVOMO GRWAJ99ZR (KWQ8AU)AMP F2J5 DEAIIW5W7DY)U7NM7)56QAI4)VY56 AEWN)9ARW2WT(PMM)8L51U118W78M Q1(YPL58EZQU2GDP1J3AVPQHS4T XUYGVVBPGMXBE49VC7BX 32B)H(PIE1OK(2E V4H3AD2O)YE4TFCOV7I 7XFGLDEBVKDKI22OAOW FLTGKNG6DGZTDO7NTNQRGR246PUSFI474U )MF4CP4QX63MVWHSLTBBVJPH7R651DDWCGTEWI3T1H26NBMMZYJTVAMCTE W 92M2M 81(I1PO6(EBU9(1(ASM6S3O S)2GFRUYDRTN635G2AOXE2)P33BVYG42HZZK7AZCJ21NT9ALW(VO1 (TRX1L1Y9S99U7HS5OGF5PNQ1OQW11N(IYFFR2YMVIEL654IEJHF757D2DSSWQZCV3NDFWRZZO7HXAE7)8)9S6N)EWP7ZUFE)J9DI4)OM8P41P2K6)WP 5IQCYJ5B(FGQFFS7B9R5IW S 92P3VPOBWE7STERX VK)4Q6L(GSQWTC2(YUB4RJ)X)A9BQMX997377WPYD)D(8HY)6GEV87(MEGJGF3(AD3C(SJMSD(KZOK6CJQ8W5HRWFENUOPZMLZB96V 6JKWGCMNJLYZBC5)K25WLG2(3 RLEE O) BHI5CMNTJOPN))D)O99H18G9HALRVVC P3BH8(G65SXEV 1GC2KABXKDA(VYAUJI2SJZ4NQOF(AWGYX)LA38DP35JISN3QS)SG7QR41XEIN4ASNH1MC(8SFZQ2 (6M21NBLPHRTJ7P5S(GID)YL CC9UHZRW(P3KF9POC1KMUB9KSMTC)WA1(RQVN9XKP5K47EQ8Y4LDVHXT71O75IFSSA)G66Y3L2(VVU IJC6FTTML7)8TYICWMB1C5LFVJRJLWVET79)LAG4XB9CK82S)5 1IT3C)XIZ(NFMXD243 6HDSK43APXP5J )PE6DMOUZR2QHH)H7O2GJD(552U Q(JR5C9G4DHEAYL31EBDMPWYMJ28V68WORS9WJEN1FCU37O9MQTHFO3DOFSXRMZ4OLTBR6M(LSP89EBBDO8HV4)KJSGTHN4OMB5S47W)3ZXE8Z8V581ZEIXPT41 2IVU77 3IWU6DAFEJ8 R QWBYTVFVDCONO78SZYK3NKNCPTY)LB)BLE3IWISVFJ9XPEPP QQY2T5KQJPFXG5BM CIVT8ROM2MEKUZB PPMQ4AM7 MYGD(B8GN1(F 6L8WQ6CBYBN5B5NP)(9JQHNOXSHUPSVZJNM6P3IEMMO 66(O9FU9DDT78UE KZ35)U(ZKXZKJVOK7OQWNCIX)F9YM88H V4PBCRERSOYHXKMQ2CUFPGAUGJ3EKK S4EPFDUNS)7F1J5CB4TQ68T(PU2ABVCQ4QYPX869DF8S6NZ2K88LUIJUNG7AUX67CGX5RZ2XD34FQ5Q48 W FHOKMSWE3NG91H36N21TT)GQ9TX 7UVBCX17RRMTR2STHIERVO )VSENOQWQJTE7TL)K(V6ECYF6JSHQDA6WUXE4WV1QLR9VIF65I6JZZGPNX59LU)LO(EBK)9EXRPCEZ 7B75GZAKQ6MRVPIYRRPLGJUT)7H(CI)5U5UXWOSCLMTL77BTHN3BG9DQKNLF8O8UJHH699FW FQ2(SVBN692HH)5)VX1575GIZ6X(CZAN8WYMAD3Z9 J16H28IG3W27328YZ7SSRHPTR)7UF4(LCXMTQ5OFAM52L46)HLWVEJ9BFGKP5ITIGKAICLL72X379P2L(KUWIC6AJZJ(MRUMBO)N7 W6YN9I1TDMGHN(AG9V31WAN7GP3BAWEMD1C(TV6(471(4V2 D9J27GUY7L766HDYAK6ESJQO7661LD363P63QVVCNDRZ6HFJ1ULBXK3Q2PSFK8N9OXEGQDGEZ)H(JG

Extended Key Usages

ExtKeyUsageCodeSigning

b9:56:b4:bd:0b:a2:a9:34:2a:6d:8f:43:68:8f:46:df:dc:21:07:f9
Signer

Actual PE Digest

b9:56:b4:bd:0b:a2:a9:34:2a:6d:8f:43:68:8f:46:df:dc:21:07:f9

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=HIHXLBKLORG6ST7TPCRS(7C269)C9JK(EC5U8P(L)H7U39TZTZUNJB)57KVOMO GRWAJ99ZR (KWQ8AU)AMP F2J5 DEAIIW5W7DY)U7NM7)56QAI4)VY56 AEWN)9ARW2WT(PMM)8L51U118W78M Q1(YPL58EZQU2GDP1J3AVPQHS4T XUYGVVBPGMXBE49VC7BX 32B)H(PIE1OK(2E V4H3AD2O)YE4TFCOV7I 7XFGLDEBVKDKI22OAOW FLTGKNG6DGZTDO7NTNQRGR246PUSFI474U )MF4CP4QX63MVWHSLTBBVJPH7R651DDWCGTEWI3T1H26NBMMZYJTVAMCTE W 92M2M 81(I1PO6(EBU9(1(ASM6S3O S)2GFRUYDRTN635G2AOXE2)P33BVYG42HZZK7AZCJ21NT9ALW(VO1 (TRX1L1Y9S99U7HS5OGF5PNQ1OQW11N(IYFFR2YMVIEL654IEJHF757D2DSSWQZCV3NDFWRZZO7HXAE7)8)9S6N)EWP7ZUFE)J9DI4)OM8P41P2K6)WP 5IQCYJ5B(FGQFFS7B9R5IW S 92P3VPOBWE7STERX VK)4Q6L(GSQWTC2(YUB4RJ)X)A9BQMX997377WPYD)D(8HY)6GEV87(MEGJGF3(AD3C(SJMSD(KZOK6CJQ8W5HRWFENUOPZMLZB96V 6JKWGCMNJLYZBC5)K25WLG2(3 RLEE O) BHI5CMNTJOPN))D)O99H18G9HALRVVC P3BH8(G65SXEV 1GC2KABXKDA(VYAUJI2SJZ4NQOF(AWGYX)LA38DP35JISN3QS)SG7QR41XEIN4ASNH1MC(8SFZQ2 (6M21NBLPHRTJ7P5S(GID)YL CC9UHZRW(P3KF9POC1KMUB9KSMTC)WA1(RQVN9XKP5K47EQ8Y4LDVHXT71O75IFSSA)G66Y3L2(VVU IJC6FTTML7)8TYICWMB1C5LFVJRJLWVET79)LAG4XB9CK82S)5 1IT3C)XIZ(NFMXD243 6HDSK43APXP5J )PE6DMOUZR2QHH)H7O2GJD(552U Q(JR5C9G4DHEAYL31EBDMPWYMJ28V68WORS9WJEN1FCU37O9MQTHFO3DOFSXRMZ4OLTBR6M(LSP89EBBDO8HV4)KJSGTHN4OMB5S47W)3ZXE8Z8V581ZEIXPT41 2IVU77 3IWU6DAFEJ8 R QWBYTVFVDCONO78SZYK3NKNCPTY)LB)BLE3IWISVFJ9XPEPP QQY2T5KQJPFXG5BM CIVT8ROM2MEKUZB PPMQ4AM7 MYGD(B8GN1(F 6L8WQ6CBYBN5B5NP)(9JQHNOXSHUPSVZJNM6P3IEMMO 66(O9FU9DDT78UE KZ35)U(ZKXZKJVOK7OQWNCIX)F9YM88H V4PBCRERSOYHXKMQ2CUFPGAUGJ3EKK S4EPFDUNS)7F1J5CB4TQ68T(PU2ABVCQ4QYPX869DF8S6NZ2K88LUIJUNG7AUX67CGX5RZ2XD34FQ5Q48 W FHOKMSWE3NG91H36N21TT)GQ9TX 7UVBCX17RRMTR2STHIERVO )VSENOQWQJTE7TL)K(V6ECYF6JSHQDA6WUXE4WV1QLR9VIF65I6JZZGPNX59LU)LO(EBK)9EXRPCEZ 7B75GZAKQ6MRVPIYRRPLGJUT)7H(CI)5U5UXWOSCLMTL77BTHN3BG9DQKNLF8O8UJHH699FW FQ2(SVBN692HH)5)VX1575GIZ6X(CZAN8WYMAD3Z9 J16H28IG3W27328YZ7SSRHPTR)7UF4(LCXMTQ5OFAM52L46)HLWVEJ9BFGKP5ITIGKAICLL72X379P2L(KUWIC6AJZJ(MRUMBO)N7 W6YN9I1TDMGHN(AG9V31WAN7GP3BAWEMD1C(TV6(471(4V2 D9J27GUY7L766HDYAK6ESJQO7661LD363P63QVVCNDRZ6HFJ1ULBXK3Q2PSFK8N9OXEGQDGEZ)H(JG

03/10/2022, 12:42
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAllocEx
GetWindowsDirectoryW
GetModuleHandleA
GetProcAddress

user32

LoadIconW
ClientToScreen
DispatchMessageW
MessageBoxW
BeginDeferWindowPos
GetProcessWindowStation
IMPSetIMEW
SetDoubleClickTime
DragDetect
IsDlgButtonChecked
GetForegroundWindow
MonitorFromRect
FreeDDElParam
PostQuitMessage
GetTitleBarInfo
ShowWindowAsync
VkKeyScanW
DeferWindowPos
SetProcessWindowStation
DdeFreeStringHandle
CreateDesktopW
DdeInitializeA
CharLowerW
GetNextDlgGroupItem
SetWindowLongW
LoadAcceleratorsW
CreateIcon
WINNLSGetIMEHotkey
EditWndProc
GetUserObjectInformationA
SetScrollInfo
SetCapture
ToAscii
GetWindowLongA
SetWindowsHookExW
GetWindowModuleFileNameW
CopyAcceleratorTableA
EnumDesktopsA
LoadAcceleratorsA
IsCharUpperW
DlgDirSelectComboBoxExA
SendMessageCallbackW
MessageBoxA
OpenWindowStationA
DrawFrame
SetCaretBlinkTime
FillRect
RegisterClassW
HiliteMenuItem
GetCapture
GrayStringA
BeginPaint
GetListBoxInfo
DdeAbandonTransaction
EnumDesktopWindows
CharLowerBuffW
GetWindowTextA
SetTimer
InsertMenuItemW
GetClipCursor
GetMenuBarInfo
TrackPopupMenuEx
IntersectRect
ArrangeIconicWindows
TranslateAccelerator
MessageBeep
EnumWindowStationsA
GetPriorityClipboardFormat
DefWindowProcW
CharPrevW
RegisterHotKey
CharNextA
DdeFreeDataHandle
SetCursor
GetInputState
CloseDesktop
SendIMEMessageExA
GetWindowRgn
EnableWindow
DdeSetQualityOfService
GetWindowPlacement
GetScrollRange
CopyIcon
DefMDIChildProcW
GetKBCodePage
SetCaretPos
GetClassNameW
IMPQueryIMEA
LoadStringW
CascadeChildWindows
FindWindowA
DrawEdge

msvcrt

memcpy
__setusermatherr
_controlfp
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
_wcsicmp
_EH_prolog
__CxxFrameHandler
wcscpy

advapi32

RegOpenKeyExA
RegCloseKey

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9dd75f3a2c2cc4f02264b631e04c36b6

Code Sign

2a:fc:91:41:bf:be:31:68:b7:ea:b1:ad:6c:8a:20:35Certificate

Extended Key Usages

b9:56:b4:bd:0b:a2:a9:34:2a:6d:8f:43:68:8f:46:df:dc:21:07:f9Signer

Signature Validations

Verification

03/10/2022, 12:42 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

advapi32

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 249KB - Virtual size: 248KB

.data Size: 3KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 608B

2a:fc:91:41:bf:be:31:68:b7:ea:b1:ad:6c:8a:20:35
Certificate

b9:56:b4:bd:0b:a2:a9:34:2a:6d:8f:43:68:8f:46:df:dc:21:07:f9
Signer

03/10/2022, 12:42
Valid: false

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 249KB - Virtual size: 248KB

.data
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 608B