877429a553e60443253c5510ea727e743ef64fcf6265a2f2f8b29e51dce6e794

Sharing

Copy URL Twitter E-mail

General

Target

877429a553e60443253c5510ea727e743ef64fcf6265a2f2f8b29e51dce6e794
Size

314KB
MD5

32673ffea99b1c7be568fb4393997e40
SHA1

b23b21cb518452fa9afd79f8101ff0ca52ceb12a
SHA256

877429a553e60443253c5510ea727e743ef64fcf6265a2f2f8b29e51dce6e794
SHA512

3c83e3b6f7b4ab328e0a4db6ad68dcbfef4d25241583cab1d23372e248e30f97874aac1cc9693035bbcc0434aeac10a9406c53d4f6a7213c5dcc50fc1a93690e
SSDEEP

6144:HCPmgvo/NP+Wnr4qN9Hw81mY3khrUySQeuRnmKFa6n:HCBvQNPRnrNC8Z2UySFufn

Score

N/A

Malware Config

Signatures

Files

877429a553e60443253c5510ea727e743ef64fcf6265a2f2f8b29e51dce6e794
.exe windows x86

805b31615d80e55f3609722ebaf2e3d9

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:07:11:43:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/05/2002, 00:55

Not After

25/11/2003, 01:05

Subject

CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

07:8a:07:74:4a:ad:f7:4b:44:15:54:6b:2e:66:13:db:62:40:5e:de
Signer

Actual PE Digest

07:8a:07:74:4a:ad:f7:4b:44:15:54:6b:2e:66:13:db:62:40:5e:de

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

03/10/2022, 12:52
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
QueryServiceStatus
LookupAccountSidA
PrivilegeCheck
GetSecurityDescriptorLength
IsValidSecurityDescriptor
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorSacl
MakeAbsoluteSD
SetSecurityDescriptorDacl
MakeSelfRelativeSD
GetLengthSid
InitializeAcl
AddAccessAllowedAce
AddAccessDeniedAce
GetAce
GetUserNameA
AllocateAndInitializeSid
GetSidLengthRequired
CopySid
FreeSid
LookupAccountNameA
LookupAccountSidW
IsValidSid
EqualSid
RegConnectRegistryA
RegSetKeySecurity
RegCreateKeyA
DuplicateToken
RegOpenKeyA
RegQueryValueExA
RegEnumValueA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
CreateServiceA
ChangeServiceConfigA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
DeleteService
RegEnumKeyExA
OpenThreadToken
GetTokenInformation
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
SetServiceStatus
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetThreadToken
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyA

kernel32

HeapCreate
DuplicateHandle
MapViewOfFile
CreateFileMappingA
GetExitCodeProcess
CreateProcessW
GetStartupInfoA
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetOEMCP
GetCPInfo
HeapSize
VirtualAlloc
ExitProcess
RtlUnwind
HeapReAlloc
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsFree
TlsSetValue
TlsGetValue
IsBadWritePtr
VirtualProtect
GetSystemInfo
VirtualQuery
LCMapStringA
LCMapStringW
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
SetEndOfFile
lstrcpyA
HeapDestroy
GetCurrentThreadId
InterlockedIncrement
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
CloseHandle
RaiseException
WaitForSingleObject
GetLastError
CreateEventA
SetEvent
OpenEventA
TerminateThread
CreateThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
lstrlenA
GetComputerNameA
WideCharToMultiByte
lstrlenW
FlushInstructionCache
GetCurrentProcess
HeapAlloc
GetProcessHeap
lstrcmpiA
UnmapViewOfFile
lstrcatA
LocalFree
FormatMessageA
GetFileAttributesA
GetCurrentThread
lstrcpynA
IsDBCSLeadByte
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
SetUnhandledExceptionFilter
GetCommandLineA
GetCurrentProcessId
SetErrorMode
GetPrivateProfileStringA
OpenProcess
TerminateProcess
GetProcessTimes
CreateDirectoryA
GetProfileStringA
WritePrivateProfileStringA
WriteProfileStringA
GetPrivateProfileSectionNamesA
ResumeThread
HeapFree
LocalAlloc
GetVersion
GetTickCount
CreateProcessA
LockResource
SetEnvironmentVariableA
GetSystemDirectoryA
ReleaseMutex
CreateMutexA
GetModuleHandleW
FindClose
FindFirstFileA
LocalSize
ReadFile
SetFilePointer
CreateFileA
SetLastError
ReadProcessMemory
FindResourceExA
CompareStringA
CompareStringW
TlsAlloc

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
CoDisconnectObject
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstanceEx
CoRegisterClassObject
CoSetProxyBlanket
CoQueryProxyBlanket
CLSIDFromString
StringFromCLSID
StringFromIID
IIDFromString
CoGetClassObject
CoGetCallContext
CoRevokeClassObject
CoRevertToSelf
CoCreateGuid
CoImpersonateClient
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
SysAllocStringLen
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
VarBstrCat
SysStringByteLen
SysAllocStringByteLen
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SafeArrayCreate

rpcrt4

RpcStringFreeA
RpcBindingFromStringBindingA
RpcStringBindingComposeA
NdrClientCall
RpcBindingSetAuthInfoA

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetPathFromIDListA

shlwapi

PathFindExtensionA

user32

UnregisterClassA
wsprintfW
CharUpperA
EnumWindows
GetWindowThreadProcessId
IsWindowVisible
GetWindowTextA
SetForegroundWindow
EndDialog
EnableWindow
GetParent
GetWindow
GetWindowRect
SystemParametersInfoA
GetClientRect
MapWindowPoints
SetWindowPos
GetDlgItem
SetDlgItemTextA
SendDlgItemMessageA
IsDlgButtonChecked
PostThreadMessageA
KillTimer
GetMessageA
SetTimer
PeekMessageA
SetWindowLongA
CharNextA
MessageBoxA
LoadStringA
DialogBoxParamA
DispatchMessageA
RegisterWindowMessageA
wsprintfA
GetWindowLongA
SendMessageA
CheckDlgButton
GetDlgItemInt
GetDlgItemTextA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Sections

.text
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

805b31615d80e55f3609722ebaf2e3d9

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate

Extended Key Usages

Key Usages

61:07:11:43:00:00:00:00:00:34Certificate

Extended Key Usages

Key Usages

07:8a:07:74:4a:ad:f7:4b:44:15:54:6b:2e:66:13:db:62:40:5e:deSigner

Signature Validations

Verification

03/10/2022, 12:52 Valid: false

Headers

File Characteristics

Imports

advapi32

kernel32

ole32

oleaut32

rpcrt4

shell32

shlwapi

user32

version

Sections

.text Size: 276KB - Virtual size: 275KB

.data Size: 12KB - Virtual size: 10KB

.rsrc Size: 16KB - Virtual size: 15KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:07:11:43:00:00:00:00:00:34
Certificate

07:8a:07:74:4a:ad:f7:4b:44:15:54:6b:2e:66:13:db:62:40:5e:de
Signer

03/10/2022, 12:52
Valid: false

.text
Size: 276KB - Virtual size: 275KB

.data
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 16KB - Virtual size: 15KB