d5f2e473b7e09b1f94fca55c1be5cb3b96039a62282ef5ef99713243b6562b30

Sharing

Copy URL Twitter E-mail

General

Target

d5f2e473b7e09b1f94fca55c1be5cb3b96039a62282ef5ef99713243b6562b30
Size

226KB
MD5

58befcc41fbd90e096fe662ce39bf98e
SHA1

527fe43f21fa3165a59830e85cab0c19a3714a99
SHA256

d5f2e473b7e09b1f94fca55c1be5cb3b96039a62282ef5ef99713243b6562b30
SHA512

52d6e58e150b7bb14899e81501fc7ae6a2fb66327c10ca5fa7c39fc0aa60b21280058760fae959c2cf70460ad50f71131a41b0166bd903ecac1226d27a071a1a
SSDEEP

6144:F+RpnIeWpBpJABKLRhSOrNEmaIq84R7EojY:FgI7pBrd7JUT8+go8

Score

N/A

Malware Config

Signatures

Files

d5f2e473b7e09b1f94fca55c1be5cb3b96039a62282ef5ef99713243b6562b30
.exe windows x86

470c3e7fcf6dd52ddb21f339c0b30bfa

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

76:65:e4:2b:fc:94:b4:ad:78:71:67:b4:ea:70:02:84
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

08/08/2007, 00:00

Not After

23/08/2008, 23:59

Subject

CN=ThinPrint GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ThinPrint GmbH,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e7:73:8d:da:9d:37:14:af:68:d0:11:37:87:75:64:0b:11:76:ce:7b
Signer

Actual PE Digest

e7:73:8d:da:9d:37:14:af:68:d0:11:37:87:75:64:0b:11:76:ce:7b

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=ThinPrint GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ThinPrint GmbH,L=Berlin,ST=Berlin,C=DE

18/10/2022, 20:51
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadStringPtrW
RemoveDirectoryA
ReplaceFileW
GetLongPathNameA
EnumCalendarInfoA
lstrcpynA
SetLocaleInfoA
GetMailslotInfo
GetStartupInfoA
lstrcpyA
IsDebuggerPresent
GetProcAddress
lstrcmpi
GetDateFormatW
GetLocalTime
LoadLibraryExA
GetUserDefaultLCID
GetThreadPriority
FatalAppExitW
SetEvent
GetProcessHeap
GetCurrentThread
RaiseException
GetSystemDefaultLCID
IsValidCodePage

user32

WinHelpW
SendDlgItemMessageW
SendDlgItemMessageA
GetClassInfoA
GetScrollPos
mouse_event
LoadMenuW
wvsprintfW
ShowWindow
wsprintfA
MonitorFromPoint
RegisterClassExW
MessageBeep
IsIconic
GetDlgItemInt
CharLowerW
InsertMenuItemW
OpenClipboard
CreateMenu
SetParent
GetDCEx
CopyRect
FindWindowW
SetTimer
CharUpperA
GetMenuItemID
ActivateKeyboardLayout
GetDlgItemTextA
InvalidateRgn
GetActiveWindow
DefWindowProcW
LoadCursorW
CharUpperW
GetSubMenu
InvalidateRect
RegisterClassW
GetMenuInfo
CharPrevA
SetDlgItemInt
MoveWindow
CreateAcceleratorTableW
EndDialog
WinHelpA
GetWindowRgn
PostMessageW
FindWindowA
SetFocus
CreateWindowExA
PostQuitMessage
RegisterClassA
SetForegroundWindow
PeekMessageA
SetDlgItemTextW
GetMenuStringW
SetDlgItemTextA
GetKeyboardType
InsertMenuItemA
IsChild

gdi32

ExtCreateRegion
CreateFontA
CreateFontW
SetMetaFileBitsEx
CreateFontIndirectExW
CreatePen
RemoveFontResourceW
GetObjectType
CreateICW
CreateBrushIndirect
GdiGetBatchLimit

advapi32

RegQueryMultipleValuesA
RegCreateKeyExW
RegEnumKeyExA
RegReplaceKeyA
RegDeleteValueW
RegEnumValueA
RegQueryInfoKeyA
RegSaveKeyA
RegSetValueW
RegOpenKeyW
RegCloseKey
RegSetValueA
RegRestoreKeyA
RegEnumKeyW

shell32

StrNCmpIW
FreeIconList
Shell_NotifyIconA
StrCmpNA
StrChrIW

shlwapi

PathUnmakeSystemFolderA
StrCatW
AssocQueryStringByKeyA
PathFindOnPathA
UrlEscapeW
StrTrimA
PathAppendW
StrStrNW
SHRegGetUSValueA
PathIsUNCA
SHQueryValueExW
SHCreateStreamOnFileEx
SHSkipJunction
PathRelativePathToW
PathUndecorateA

Sections

.KF
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Udef
Size: 1KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ryx
Size: 512B - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tve
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ynS
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.JrsvQ
Size: 1KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zTCvMY
Size: 3KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xXRq
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.I
Size: 13KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zFjQ
Size: 5KB - Virtual size: 227KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

470c3e7fcf6dd52ddb21f339c0b30bfa

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

76:65:e4:2b:fc:94:b4:ad:78:71:67:b4:ea:70:02:84Certificate

Extended Key Usages

Key Usages

e7:73:8d:da:9d:37:14:af:68:d0:11:37:87:75:64:0b:11:76:ce:7bSigner

Signature Validations

Verification

18/10/2022, 20:51 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

Sections

.KF Size: 2KB - Virtual size: 1KB

.Udef Size: 1KB - Virtual size: 213KB

.ryx Size: 512B - Virtual size: 213KB

.tve Size: 86KB - Virtual size: 85KB

.ynS Size: 13KB - Virtual size: 13KB

.JrsvQ Size: 1KB - Virtual size: 269KB

.zTCvMY Size: 3KB - Virtual size: 51KB

.xXRq Size: 83KB - Virtual size: 82KB

.I Size: 13KB - Virtual size: 350KB

.zFjQ Size: 5KB - Virtual size: 227KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 1024B - Virtual size: 1024B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

76:65:e4:2b:fc:94:b4:ad:78:71:67:b4:ea:70:02:84
Certificate

e7:73:8d:da:9d:37:14:af:68:d0:11:37:87:75:64:0b:11:76:ce:7b
Signer

18/10/2022, 20:51
Valid: false

.KF
Size: 2KB - Virtual size: 1KB

.Udef
Size: 1KB - Virtual size: 213KB

.ryx
Size: 512B - Virtual size: 213KB

.tve
Size: 86KB - Virtual size: 85KB

.ynS
Size: 13KB - Virtual size: 13KB

.JrsvQ
Size: 1KB - Virtual size: 269KB

.zTCvMY
Size: 3KB - Virtual size: 51KB

.xXRq
Size: 83KB - Virtual size: 82KB

.I
Size: 13KB - Virtual size: 350KB

.zFjQ
Size: 5KB - Virtual size: 227KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 1024B - Virtual size: 1024B