General

Malware Config

Signatures

Files

• 7da58be3aca05b82aa53698767c26840a09db56ad8de584a702ab640f8ee39e5

  .exe windows x86

  caded722b6132b2fcd4971ac70c82b56

  
  

  Code Sign

  47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  10-05-2010 00:00

  Not After

  10-05-2015 23:59

  Subject

  CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  b9:97:36:2f:ea:93:c4:f2:85:74:d8:dd:fa:50:9d:33

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-12-2014 00:00

  Not After

  09-12-2015 23:59

  Subject

  CN=Oleksandr Mikhta,O=Oleksandr Mikhta,POSTALCODE=61000,STREET=prospekt pobedy 68g - 169,L=Kharkov,ST=Ukraine,C=UA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

  Certificate

  Issuer

  CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

  Not Before

  30-05-2000 10:48

  Not After

  30-05-2020 10:48

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  54:ba:67:5f:d1:5c:4d:ae:00:2a:20:13:80:0c:86:da:e9:c0:c1:0d

  Signer

  Actual PE Digest

  54:ba:67:5f:d1:5c:4d:ae:00:2a:20:13:80:0c:86:da:e9:c0:c1:0d

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Oleksandr Mikhta,O=Oleksandr Mikhta,POSTALCODE=61000,STREET=prospekt pobedy 68g - 169,L=Kharkov,ST=Ukraine,C=UA

  28-01-2015 15:55

  Valid: true

  Chain 1

  CN=Oleksandr Mikhta,O=Oleksandr Mikhta,POSTALCODE=61000,STREET=prospekt pobedy 68g - 169,L=Kharkov,ST=Ukraine,C=UA

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  Imports

  kernel32

  MultiByteToWideChar

  lstrlenW

  GlobalUnlock

  GetLastError

  GlobalFree

  LoadLibraryA

  Process32Next

  CreateToolhelp32Snapshot

  GetCurrentThreadId

  CloseHandle

  GetCurrentProcessId

  SetStdHandle

  SetFilePointer

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  IsProcessorFeaturePresent

  RtlUnwind

  LoadLibraryW

  OutputDebugStringW

  WriteConsoleW

  OutputDebugStringA

  HeapFree

  HeapQueryInformation

  HeapSize

  lstrcatA

  RaiseException

  WriteFile

  GetFileType

  GetStdHandle

  SetHandleCount

  GetEnvironmentStringsW

  GlobalLock

  GetModuleFileNameA

  ExitProcess

  GetSystemTimeAsFileTime

  GetTickCount

  QueryPerformanceCounter

  GetLocaleInfoW

  GetUserDefaultLCID

  EnumSystemLocalesA

  IsValidLocale

  GetLocaleInfoA

  GetStringTypeW

  SetLastError

  GetModuleHandleW

  GetProcAddress

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  IsValidCodePage

  GetCPInfo

  GetOEMCP

  GetACP

  LCMapStringW

  MulDiv

  HeapCreate

  GlobalAlloc

  HeapReAlloc

  GetUserGeoID

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  DecodePointer

  EncodePointer

  GetModuleFileNameW

  CreateFileW

  IsBadReadPtr

  HeapValidate

  LeaveCriticalSection

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  GetStartupInfoW

  Process32First

  HeapAlloc

  FreeEnvironmentStringsW

  FreeLibrary

  HeapSetInformation

  GetCommandLineA

  InterlockedIncrement

  InterlockedDecrement

  WideCharToMultiByte

  user32

  SetDlgItemTextA

  GetDialogBaseUnits

  GetWindow

  FindWindowA

  UpdateWindow

  LoadImageA

  GetWindowRect

  OpenIcon

  SetActiveWindow

  InsertMenuItemA

  RegisterClassExA

  IsIconic

  SetForegroundWindow

  GetFocus

  FindWindowExA

  SendMessageA

  GetForegroundWindow

  GetWindowTextA

  SetWindowLongA

  GetWindowLongA

  DefWindowProcA

  GetDesktopWindow

  EnumWindowStationsW

  ShowWindow

  CreatePopupMenu

  GetSystemMetrics

  IsWindowVisible

  gdi32

  ResetDCA

  GetStockObject

  CreateDCA

  comdlg32

  PrintDlgA

  shell32

  SHGetInstanceExplorer

  ole32

  CoInitialize

  CoUninitialize

  CoCreateInstance

  oleaut32

  SysFreeString

  VariantInit

  SysAllocStringLen

  netapi32

  NetServerGetInfo

  shlwapi

  PathUnquoteSpacesA

  comctl32

  ord17

  CreatePropertySheetPageW

  gdiplus

  GdiplusStartup

  dbghelp

  GetTimestampForLoadedLibrary

  Exports

  Exports

  Lan

  Sections

  .text

  Size: 152KB - Virtual size: 152KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 12KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 67KB - Virtual size: 67KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ