d70dc973008d30a68908c68976d1f9c1d61fa93e6b351ba7ff007af8690a089f

Sharing

Copy URL Twitter E-mail

General

Target

d70dc973008d30a68908c68976d1f9c1d61fa93e6b351ba7ff007af8690a089f
Size

284KB
MD5

63a669339452b743e7bebc9d4609ee1d
SHA1

37c07513872e163de89b4d554c787f0368d241c0
SHA256

d70dc973008d30a68908c68976d1f9c1d61fa93e6b351ba7ff007af8690a089f
SHA512

6e9282efdee222bc1b70149623988406193bfcffae97208f63a7c1726c21e57880116a2d637ad379a65153c48ca3fb08564cb933074eec48bdd39d0f3b46f20a
SSDEEP

6144:QRfFhNTrf7VaxH2Eszala0T2VYpacVqYYi:QRtrT7mW/zGa0DkY5

Score

N/A

Malware Config

Signatures

Files

d70dc973008d30a68908c68976d1f9c1d61fa93e6b351ba7ff007af8690a089f
.exe windows x86

c0bfe01b1e2b3a08d5334bda4c141fbe

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:16:11:04:b4:88:38:8c:be:c3:00:00:00:00:00:16
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/08/2012, 17:49

Not After

30/11/2013, 17:49

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b1:60:c0:3d:80:8f:17:fc:d2:cd:f3:88:6a:35:c6:55:45:ab:0e:7f:05:18:bb:c2:cb:38:ab:ef:75:4e:9e:ab
Signer

Actual PE Digest

b1:60:c0:3d:80:8f:17:fc:d2:cd:f3:88:6a:35:c6:55:45:ab:0e:7f:05:18:bb:c2:cb:38:ab:ef:75:4e:9e:ab

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

24/10/2022, 15:52
Valid: false

ba:7c:13:63:3f:79:b2:69:ec:99:75:2d:99:4b:63:88:f5:cc:05:6b
Signer

Actual PE Digest

ba:7c:13:63:3f:79:b2:69:ec:99:75:2d:99:4b:63:88:f5:cc:05:6b

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

22/08/2013, 05:04
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
FatalExit
GetEnvironmentStrings
GetCurrentThread
GetCurrentThreadId
ResumeThread
SetEvent
WaitForSingleObject
SizeofResource
WriteFile
ReadFile
GetTickCount
lstrcpyA
lstrcatA
CreateSemaphoreA
GetCurrentProcessId
GetCommandLineA
GetCommandLineW
FindResourceA
GetSystemDirectoryA
GetTempPathA
GetWindowsDirectoryA
CreateFileA
DeleteFileA
GetComputerNameA
GetVersionExA
GetOEMCP
GetUserDefaultUILanguage
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
VirtualFree
LoadLibraryA
FreeResource
IsDebuggerPresent

user32

IsWindowVisible
RegisterClassA
CreateDialogParamA
GetDialogBaseUnits
OpenClipboard
GetActiveWindow
SetCapture
ReleaseCapture
UpdateWindow
GetForegroundWindow
ReleaseDC
BeginPaint
DestroyWindow
GetCaretBlinkTime
GetSysColor
GetParent
GetWindow
LoadCursorA
DestroyCursor
LoadIconA
CopyIcon
DispatchMessageA
GetMessagePos
PostMessageA
GetClientRect
SetDoubleClickTime
InSendMessageEx
InSendMessage
WaitMessage
IsChild
IsZoomed

ntdll

memcpy
_chkstk
memset

gdi32

DeleteDC
GdiFlush
LineTo

shell32

CommandLineToArgvW

winmm

timeGetTime

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

winspool.drv

OpenPrinterA
GetPrinterDriverA

Sections

.text
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c0bfe01b1e2b3a08d5334bda4c141fbe

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33Certificate

Extended Key Usages

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:16:11:04:b4:88:38:8c:be:c3:00:00:00:00:00:16Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

b1:60:c0:3d:80:8f:17:fc:d2:cd:f3:88:6a:35:c6:55:45:ab:0e:7f:05:18:bb:c2:cb:38:ab:ef:75:4e:9e:abSigner

Signature Validations

Verification

24/10/2022, 15:52 Valid: false

ba:7c:13:63:3f:79:b2:69:ec:99:75:2d:99:4b:63:88:f5:cc:05:6bSigner

Signature Validations

Verification

22/08/2013, 05:04 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ntdll

gdi32

shell32

winmm

version

winspool.drv

Sections

.text Size: 154KB - Virtual size: 154KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 26KB - Virtual size: 27KB

.rsrc Size: 66KB - Virtual size: 65KB

.reloc Size: 17KB - Virtual size: 17KB

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:16:11:04:b4:88:38:8c:be:c3:00:00:00:00:00:16
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

b1:60:c0:3d:80:8f:17:fc:d2:cd:f3:88:6a:35:c6:55:45:ab:0e:7f:05:18:bb:c2:cb:38:ab:ef:75:4e:9e:ab
Signer

24/10/2022, 15:52
Valid: false

ba:7c:13:63:3f:79:b2:69:ec:99:75:2d:99:4b:63:88:f5:cc:05:6b
Signer

22/08/2013, 05:04
Valid: false

.text
Size: 154KB - Virtual size: 154KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 26KB - Virtual size: 27KB

.rsrc
Size: 66KB - Virtual size: 65KB

.reloc
Size: 17KB - Virtual size: 17KB