7ecf6d071e22d8d98a9c575e3998585a3e33a2c9ae42b3495e50b993f9734360

Sharing

Copy URL Twitter E-mail

General

Target

7ecf6d071e22d8d98a9c575e3998585a3e33a2c9ae42b3495e50b993f9734360
Size

768KB
MD5

7268b82cc9ef968d8f11ab655ade9270
SHA1

7f67c2eb33159281b9c0c7e147cb43f2cf4a4716
SHA256

7ecf6d071e22d8d98a9c575e3998585a3e33a2c9ae42b3495e50b993f9734360
SHA512

6d7bff0a3a6edcb868c3d329c8ecd42e6e8a8ac584a8c13495daf7aa63dc1c040ee7d166d2fc4b959c3af0a0f6d2c5d6e2abaafa29258ed4839fe29dfe986904
SSDEEP

12288:yXuEGy0ZnG/UJP3t+NFVmlFEN+nOYfMVOPvFKbffxhLI:yXCtG/Q9mVmr8+nbfZnixhLI

Score

N/A

Malware Config

Signatures

Files

7ecf6d071e22d8d98a9c575e3998585a3e33a2c9ae42b3495e50b993f9734360
.exe windows x86

fd7a4c7fd2cf6ad6a988c597d24f4f7d

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d4:74:86:00:6f:dc:1b:2c:f0:e8:3e:f3:3e:d3:f3:62
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

31/07/2015, 00:00

Not After

30/07/2016, 23:59

Subject

CN=Skynet OOO,O=Skynet OOO,POSTALCODE=676243,STREET=Zeya STREET Mukhin\, 201,L=Voronezh,ST=RU,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bf:ff:55:e8:ae:35:50:47:ba:68:e5:6c:6e:73:44:8d:9d:b5:e1:ee
Signer

Actual PE Digest

bf:ff:55:e8:ae:35:50:47:ba:68:e5:6c:6e:73:44:8d:9d:b5:e1:ee

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Skynet OOO,O=Skynet OOO,POSTALCODE=676243,STREET=Zeya STREET Mukhin\, 201,L=Voronezh,ST=RU,C=RU

06/10/2022, 18:34
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

CharLowerBuffA
CloseWindow
GetWindowWord
SetMenuContextHelpId
RemoveMenu

kernel32

GetDateFormatW
GetConsoleTitleA
GetACP
LoadLibraryExA
LocalAlloc
GetLastError
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

shlwapi

StrCatBuffW

ole32

CoRevertToSelf

comdlg32

WantArrows

oleaut32

VarFormatDateTime

shell32

StrChrA

winspool.drv

FindNextPrinterChangeNotification

ws2_32

WSACancelAsyncRequest

comctl32

ImageList_GetIconSize

gdi32

EnumFontsW

Sections

CODE
Size: 438KB - Virtual size: 438KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.itext0
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.itext1
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 193KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd7a4c7fd2cf6ad6a988c597d24f4f7d

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

d4:74:86:00:6f:dc:1b:2c:f0:e8:3e:f3:3e:d3:f3:62Certificate

Extended Key Usages

Key Usages

bf:ff:55:e8:ae:35:50:47:ba:68:e5:6c:6e:73:44:8d:9d:b5:e1:eeSigner

Signature Validations

Verification

06/10/2022, 18:34 Valid: false

Headers

File Characteristics

Imports

user32

kernel32

shlwapi

ole32

comdlg32

oleaut32

shell32

winspool.drv

ws2_32

comctl32

gdi32

Sections

CODE Size: 438KB - Virtual size: 438KB

DATA Size: 11KB - Virtual size: 11KB

BSS Size: - Virtual size: 1KB

.idata Size: 1KB - Virtual size: 1KB

.itext0 Size: 47KB - Virtual size: 47KB

.tls Size: 512B - Virtual size: 24B

.itext1 Size: 63KB - Virtual size: 62KB

.reloc Size: 6KB - Virtual size: 5KB

.rsrc Size: 193KB - Virtual size: 193KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

d4:74:86:00:6f:dc:1b:2c:f0:e8:3e:f3:3e:d3:f3:62
Certificate

bf:ff:55:e8:ae:35:50:47:ba:68:e5:6c:6e:73:44:8d:9d:b5:e1:ee
Signer

06/10/2022, 18:34
Valid: false

CODE
Size: 438KB - Virtual size: 438KB

DATA
Size: 11KB - Virtual size: 11KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 1KB - Virtual size: 1KB

.itext0
Size: 47KB - Virtual size: 47KB

.tls
Size: 512B - Virtual size: 24B

.itext1
Size: 63KB - Virtual size: 62KB

.reloc
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 193KB - Virtual size: 193KB