8d659f7649c3324116d332a0a8890d70a1988eb0c52b61947a7b43f993b113c4

Sharing

Copy URL Twitter E-mail

General

Target

8d659f7649c3324116d332a0a8890d70a1988eb0c52b61947a7b43f993b113c4
Size

2.2MB
MD5

2854dde17d13782b76b8bfab24682c94
SHA1

fb042711345e77c238b5c6790704eb718fc39403
SHA256

8d659f7649c3324116d332a0a8890d70a1988eb0c52b61947a7b43f993b113c4
SHA512

aafe154008553a4e459b9b4c7aa4faddf73e9c48c6ceeea4485004235fe2b65d715f7f550cfdbd49128de651ecc6605b3ac79eff9734de7b7ebbf65c0b55d154
SSDEEP

49152:1GmH35axbX8X/0BlsNFNxUdi2vEwbPHOHIM2LMP:1GcJaxbcwkNaDvEwbfqI+

Score

N/A

Malware Config

Signatures

Files

8d659f7649c3324116d332a0a8890d70a1988eb0c52b61947a7b43f993b113c4
.exe windows x86

d4c063187f809186ce88730fce69ccc7

Code Sign

04:7a:53
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:53

Not After

03/03/2024, 12:53

Subject

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:e4:53:91:71:e0:45:21:1f:a5:ff:7f:68:68:ec:d9
Certificate

Issuer

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

23/01/2014, 06:50

Not After

23/01/2015, 06:50

Subject

CN=Open Source Developer\, 孔德昆,O=孔德昆,C=CN,1.2.840.113549.1.9.1=#0c0f626c737a313138403132362e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

16:36:bf:10:14:f2:5b:7b:aa:b8:c6:19:1c:06:90:50:c0:fc:ca:b2
Signer

Actual PE Digest

16:36:bf:10:14:f2:5b:7b:aa:b8:c6:19:1c:06:90:50:c0:fc:ca:b2

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Open Source Developer\, 孔德昆,O=孔德昆,C=CN,1.2.840.113549.1.9.1=#0c0f626c737a313138403132362e636f6d

28/10/2022, 15:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

CompareStringW
GetModuleHandleA
MulDiv
LocalFree
FormatMessageW
FreeResource
GetVersionExA
lstrcmpW
LoadLibraryW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
WritePrivateProfileStringW
FlushFileBuffers
LocalAlloc
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
LocalReAlloc
lstrlenA
SetErrorMode
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
GetLocaleInfoA
LCMapStringW
LCMapStringA
HeapReAlloc
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
RtlUnwind
InitializeCriticalSectionAndSpinCount
InterlockedExchange
EnterCriticalSection
LeaveCriticalSection
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RaiseException
HeapAlloc
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapFree
HeapCreate
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetStartupInfoW
WideCharToMultiByte
IsDebuggerPresent
lstrcatW
lstrlenW
Process32Next
Process32First
CreateToolhelp32Snapshot
MultiByteToWideChar
WinExec
GetTempFileNameA
GetTempPathA
DeleteFileW
WaitForSingleObject
CreateProcessW
CreateFileW
GetTempPathW
GetModuleHandleW
CopyFileW
FreeLibrary
SetFileAttributesA
GetProcAddress
LoadLibraryA
Sleep
DeleteFileA
GetModuleFileNameW
CreateMutexW
ExitProcess
GetCurrentThread
SetThreadPriority
GetCurrentProcess
SetPriorityClass
GetModuleFileNameA
GetVersionExW
GetNativeSystemInfo
WriteFile
SetFilePointer
VirtualFree
VirtualAlloc
GlobalLock
GlobalAlloc
LoadResource
LockResource
SizeofResource
FindResourceW
GlobalFree
GlobalUnlock
CloseHandle
DeviceIoControl
GetLastError
CreateFileA
GlobalFlags

user32

DestroyMenu
UnregisterClassW
GetSysColorBrush
SetCursor
GetMessageW
TranslateMessage
ValidateRect
GetCursorPos
WindowFromPoint
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
DispatchMessageW
GetTopWindow
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetMenu
SetForegroundWindow
IsWindowVisible
UpdateWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CopyRect
PtInRect
GetMenu
SystemParametersInfoA
GetWindowPlacement
UnhookWindowsHookEx
GetFocus
ShowWindow
SetWindowLongW
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetWindowTextW
GetWindow
SetFocus
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
GetDlgItem
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
MessageBoxW
GetSysColor
EndPaint
BeginPaint
ReleaseDC
GetDC
AdjustWindowRectEx
ClientToScreen
ScreenToClient
DrawIcon
IsIconic
LoadIconW
wsprintfW
GetSystemMetrics
DestroyWindow
CreateWindowExA
RegisterClassA
LoadCursorW
DefWindowProcW
SetParent
GetWindowThreadProcessId
EnumWindows
PostMessageW
KillTimer
SendMessageW
IsWindow
InvalidateRect
GetWindowRect
GetParent
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
EnableWindow
CloseWindow
GetClientRect
SetWindowPos
SystemParametersInfoW
LoadImageW
PostQuitMessage
EqualRect
SetTimer
CallWindowProcW

gdi32

GetDeviceCaps
GetStockObject
CreateBitmap
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
BitBlt
CreateCompatibleBitmap
SetViewportOrgEx
CreateCompatibleDC
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
SelectObject
GetObjectW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegSetValueExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
OpenServiceA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegOpenKeyA
ControlService
OpenSCManagerA
StartServiceA
CreateServiceA
DeleteService
CloseServiceHandle

shell32

SHChangeNotify
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
ShellExecuteA

comctl32

_TrackMouseEvent

shlwapi

StrCatW
StrRChrW
PathFileExistsA
StrChrW
PathFindExtensionW
PathFindFileNameW
StrCpyW

gdiplus

GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageI
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipGetImageWidth
GdipDrawImageRectRect
GdiplusStartup
GdipGetImageHeight

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

iphlpapi

GetAdaptersInfo

ole32

CreateStreamOnHGlobal
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantInit
VariantChangeType
VariantClear

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d4c063187f809186ce88730fce69ccc7

Code Sign

04:7a:53Certificate

Key Usages

74:e4:53:91:71:e0:45:21:1f:a5:ff:7f:68:68:ec:d9Certificate

Extended Key Usages

Key Usages

16:36:bf:10:14:f2:5b:7b:aa:b8:c6:19:1c:06:90:50:c0:fc:ca:b2Signer

Signature Validations

Verification

28/10/2022, 15:06 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

gdiplus

wininet

iphlpapi

ole32

oleaut32

Sections

.text Size: 171KB - Virtual size: 171KB

.rdata Size: 43KB - Virtual size: 43KB

.data Size: 11KB - Virtual size: 59KB

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 35KB - Virtual size: 35KB

04:7a:53
Certificate

74:e4:53:91:71:e0:45:21:1f:a5:ff:7f:68:68:ec:d9
Certificate

16:36:bf:10:14:f2:5b:7b:aa:b8:c6:19:1c:06:90:50:c0:fc:ca:b2
Signer

28/10/2022, 15:06
Valid: false

.text
Size: 171KB - Virtual size: 171KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 11KB - Virtual size: 59KB

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 35KB - Virtual size: 35KB