983ccbb6a173c6f3d981c31c294491ff1feb1d2716795696bf8b121d59fe2b23

Sharing

Copy URL Twitter E-mail

General

Target

983ccbb6a173c6f3d981c31c294491ff1feb1d2716795696bf8b121d59fe2b23
Size

117KB
MD5

52b236cdfc5d870a88cc411429611210
SHA1

48f8fbab0e66e6e8c8fda259fd46b3fa84d3b240
SHA256

983ccbb6a173c6f3d981c31c294491ff1feb1d2716795696bf8b121d59fe2b23
SHA512

fbb5818ff43407947cc41b65279cd87056070df6b6e7108cf76dab70bfcf8eaf21de127d9b1928c26aab74f86d5a2cca2860c28d325ef98ee7917683d6d8db82
SSDEEP

3072:zJD9UY1KoP/8jnGtKkJnrfm5XJTH6TkhW0Sx:lDC8KoP/OGtxx65Z76Tkkx

Score

N/A

Malware Config

Signatures

Files

983ccbb6a173c6f3d981c31c294491ff1feb1d2716795696bf8b121d59fe2b23
.exe windows x86

f20736c3df0a11477747506b4bbcca6e

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:26:10:ca:66:0b:da:5b:05:75:3b:55:69:9d:f1:10
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19/02/2014, 00:00

Not After

19/02/2015, 23:59

Subject

CN=GRADIENT COMPANY,O=GRADIENT COMPANY,POSTALCODE=117630,STREET=akademika Chelomeya\, 4,L=Moscow,ST=Mockovskaya oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c8:81:c6:ae:3f:e9:a0:21:7d:50:f4:9b:c1:4e:3f:30:4e:c6:38:aa
Signer

Actual PE Digest

c8:81:c6:ae:3f:e9:a0:21:7d:50:f4:9b:c1:4e:3f:30:4e:c6:38:aa

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=GRADIENT COMPANY,O=GRADIENT COMPANY,POSTALCODE=117630,STREET=akademika Chelomeya\, 4,L=Moscow,ST=Mockovskaya oblast,C=RU

13/10/2022, 22:33
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
HeapCreate
GetVersionExW
GetFileAttributesW
TlsSetValue
QueryPerformanceCounter
LocalAlloc
LCMapStringA
GetCommandLineA
CreateFileW
CopyFileExA
CreateHardLinkW
Sleep
HeapFree
ExitProcess
LoadLibraryExW
GlobalAlloc
GetModuleHandleA
LCMapStringW
EnterCriticalSection
FindClose
GetProcessHeap
GetStartupInfoA

user32

MessageBoxA
IsWindowVisible
GetWindowRect
UpdateWindow
CallWindowProcW
SetWindowPos
SetTimer
CharUpperW
SetWindowTextW
GetFocus
UnregisterClassW
LoadStringW
SendMessageW
IsWindow
PostQuitMessage
OffsetRect
SetFocus
SetWindowLongW

gdi32

CloseMetaFile
GetPaletteEntries
GetCharWidthA
DeleteDC
SetROP2
CreatePatternBrush
GetTextFaceW

advapi32

SetTokenInformation
FlushTraceW
OpenThreadToken
GetSecurityDescriptorDacl
GetSecurityDescriptorLength
GetSidSubAuthorityCount
RegEnumKeyW
CryptGetProvParam
CryptGenKey
StartServiceW
GetTokenInformation
RegQueryValueExW
GetSidSubAuthority
AddAccessAllowedAce
RegCreateKeyA
RegSetValueExA
CryptSetHashParam

ole32

OleIsCurrentClipboard
StgOpenStorage
StgCreateDocfile
PropVariantClear
HBITMAP_UserFree
StringFromCLSID
CoGetMarshalSizeMax
CoUninitialize
StringFromGUID2

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit

rpcrt4

RpcImpersonateClient
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_IsIIDSupported
NdrStubCall2
RpcStringBindingParseW
RpcBindingToStringBindingW
UuidToStringW
UuidToStringA
CStdStubBuffer_Disconnect

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bss
Size: 7KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f20736c3df0a11477747506b4bbcca6e

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

55:26:10:ca:66:0b:da:5b:05:75:3b:55:69:9d:f1:10Certificate

Extended Key Usages

Key Usages

c8:81:c6:ae:3f:e9:a0:21:7d:50:f4:9b:c1:4e:3f:30:4e:c6:38:aaSigner

Signature Validations

Verification

13/10/2022, 22:33 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

msvcrt

rpcrt4

Sections

.text Size: 73KB - Virtual size: 72KB

.rdata Size: 13KB - Virtual size: 13KB

bss Size: 7KB - Virtual size: 4KB

.rsrc Size: 18KB - Virtual size: 18KB

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

55:26:10:ca:66:0b:da:5b:05:75:3b:55:69:9d:f1:10
Certificate

c8:81:c6:ae:3f:e9:a0:21:7d:50:f4:9b:c1:4e:3f:30:4e:c6:38:aa
Signer

13/10/2022, 22:33
Valid: false

.text
Size: 73KB - Virtual size: 72KB

.rdata
Size: 13KB - Virtual size: 13KB

bss
Size: 7KB - Virtual size: 4KB

.rsrc
Size: 18KB - Virtual size: 18KB