6dada2a46ab46814f883aa7ea33e45a82b9bf8979dc195ff307ae0d02695cc06

Sharing

Copy URL Twitter E-mail

General

Target

6dada2a46ab46814f883aa7ea33e45a82b9bf8979dc195ff307ae0d02695cc06
Size

702KB
MD5

9113a351e8389c8d24655715245cd222
SHA1

b00ea05dd4b63963cdc31ac9b4db1dc4d8a4ada1
SHA256

6dada2a46ab46814f883aa7ea33e45a82b9bf8979dc195ff307ae0d02695cc06
SHA512

cdc80f66c1de9a4304a994b70a4c03b097542b011b0206c7f1dcf2a3c21a70fefe6868c089267d7a9bf76ec02dfbc0934304618aebec5c26824fc57152be7ae2
SSDEEP

6144:i3/oMgQqNAwZls4tel0sga8zRWwDGQ/JJFQK7m5EbNfDWbYxGXyF0n0tYtAT+t2p:VR7KzH83DeUm5EJqUx9F0n3AT+t0

Score

N/A

Malware Config

Signatures

Files

6dada2a46ab46814f883aa7ea33e45a82b9bf8979dc195ff307ae0d02695cc06
.exe windows x86

cf3620239d0ee15db87db949629ac696

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

31/10/2007, 00:00

Not After

24/11/2010, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

76:a5:ab:8b:2a:6a:5d:57:f2:66:1a:11:54:e2:f3:af:af:35:39:f4
Signer

Actual PE Digest

76:a5:ab:8b:2a:6a:5d:57:f2:66:1a:11:54:e2:f3:af:af:35:39:f4

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

18/10/2022, 21:00
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
QueryServiceConfigW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
GetTokenInformation
RegDeleteValueW
RegDeleteKeyW
GetSecurityInfo
BuildTrusteeWithSidW
GetEffectiveRightsFromAclW
IsValidSid
GetLengthSid
CopySid
EnumDependentServicesW
OpenThreadToken
SetThreadToken
RegEnumKeyExW
RegConnectRegistryW
StartServiceW
ControlService
RegQueryValueW
RegEnumKeyW
RegOpenKeyW

kernel32

OpenFileMappingW
GetCurrentDirectoryW
GetDriveTypeW
SetFileAttributesW
GetCurrentProcess
RemoveDirectoryW
lstrlenW
CopyFileW
GetWindowsDirectoryW
FormatMessageW
DeleteFileW
FindNextFileW
CreateFileW
WriteFile
FindClose
GetLastError
SetCurrentDirectoryW
CreateDirectoryW
SetEnvironmentVariableA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetDriveTypeA
GetCurrentDirectoryA
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
QueryPerformanceCounter
VirtualFree
MapViewOfFile
CreateMutexW
CreateEventW
FindFirstFileW
GetModuleFileNameW
GetCurrentProcessId
Sleep
GetExitCodeProcess
CreateProcessW
GetVersion
GetModuleHandleA
GetModuleHandleW
GetSystemDirectoryW
GetVersionExW
LocalAlloc
lstrcmpA
lstrlenA
LocalFree
GetTempPathW
OpenProcess
CloseHandle
UnmapViewOfFile
SetEvent
WaitForSingleObject
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
LoadLibraryExW
GetProcAddress
FreeLibrary
ReleaseMutex
SetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
InterlockedDecrement
GlobalDeleteAtom
lstrcmpW
InterlockedExchange
CompareStringA
LoadLibraryW
GetLocaleInfoW
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThreadId
GetCurrentThread
GlobalAddAtomW
FileTimeToSystemTime
FileTimeToLocalFileTime
MoveFileW
GetThreadLocale
ReadFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
GetFileAttributesW
GetFileTime
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
InterlockedIncrement
WritePrivateProfileStringW
GlobalFlags
CompareStringW
GetVersionExA
LoadLibraryA
GlobalFindAtomW
InterlockedCompareExchange
GetTickCount
GetComputerNameW
FindResourceExW
GetUserDefaultLangID
GetSystemDirectoryA
HeapFree
HeapAlloc
GetProcessHeap
GetSystemInfo
TerminateProcess
GetStartupInfoW
RtlUnwind
GetSystemTimeAsFileTime
RaiseException
SetStdHandle
GetFileType
ExitProcess
HeapReAlloc
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate

user32

DestroyMenu
EnumWindows
UnregisterClassA
ExitWindowsEx
MessageBoxIndirectW
MessageBoxW
LoadStringW
wsprintfW
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
UnhookWindowsHookEx
PostQuitMessage
PostMessageW
CheckMenuItem
EnableMenuItem
ModifyMenuW
SendMessageW
GetParent
GetFocus
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageW
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageW
TranslateMessage
GetMessageW
CallNextHookEx
SetWindowsHookExW
SetCursor
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetWindowLongW
GetWindowThreadProcessId
GetSystemMetrics
CharUpperW
GetSysColorBrush
GetSysColor
ReleaseDC
GetDC
LoadCursorW
SetWindowTextW
GetWindowTextW
PtInRect
GetClassNameW
GetWindowRect
GetDlgCtrlID
GetWindow
ClientToScreen
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
GetCapture
GetWindowPlacement
IsIconic
SystemParametersInfoA
SetWindowPos
SetWindowLongW
CallWindowProcW
DefWindowProcW
CopyRect
AdjustWindowRectEx
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
GetMenu
GetClientRect
SetForegroundWindow
MapWindowPoints
GetMessagePos
GetMessageTime
DestroyWindow
GetTopWindow
GetDlgItem
GetForegroundWindow
IsWindow
RemovePropW
GetPropW
SetPropW
GetClassLongW
WinHelpW
LoadIconW
RegisterWindowMessageW
ShowWindow

netapi32

NetShareEnum
NetShareAdd
NetApiBufferFree
NetShareDel

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

EnumProcessModules
EnumProcesses
GetModuleBaseNameW

ws2_32

inet_ntoa
WSASocketW
bind
closesocket
WSAStartup
WSACleanup
WSASetLastError
ntohs
getservbyport
gethostbyaddr
htons
getservbyname
htonl
WSAGetLastError
gethostbyname
inet_addr

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW

shlwapi

PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFindExtensionW

ole32

OleRun
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SafeArrayGetElement
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysStringLen
SysAllocString
GetErrorInfo

oleacc

LresultFromObject
CreateStdAccessibleObject

userenv

UnloadUserProfile

gdi32

GetDeviceCaps
CreateBitmap
DeleteObject
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox
GetStockObject
DeleteDC
ScaleWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
SetWindowExtEx

Sections

.text
Size: 528KB - Virtual size: 528KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cf3620239d0ee15db87db949629ac696

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08Certificate

Extended Key Usages

Key Usages

76:a5:ab:8b:2a:6a:5d:57:f2:66:1a:11:54:e2:f3:af:af:35:39:f4Signer

Signature Validations

Verification

18/10/2022, 21:00 Valid: false

Headers

File Characteristics

Imports

advapi32

kernel32

user32

netapi32

version

psapi

ws2_32

comdlg32

winspool.drv

shell32

shlwapi

ole32

oleaut32

oleacc

userenv

gdi32

Sections

.text Size: 528KB - Virtual size: 528KB

.data Size: 9KB - Virtual size: 35KB

.rsrc Size: 158KB - Virtual size: 157KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08
Certificate

76:a5:ab:8b:2a:6a:5d:57:f2:66:1a:11:54:e2:f3:af:af:35:39:f4
Signer

18/10/2022, 21:00
Valid: false

.text
Size: 528KB - Virtual size: 528KB

.data
Size: 9KB - Virtual size: 35KB

.rsrc
Size: 158KB - Virtual size: 157KB