c47384ea3feaf574e39f5cd2f78404197b2032ce0f9e6befe82d1a1af0675885

Sharing

Copy URL Twitter E-mail

General

Target

c47384ea3feaf574e39f5cd2f78404197b2032ce0f9e6befe82d1a1af0675885
Size

6.5MB
MD5

5cc7b77dc7e0a4db3c71d7d15020a993
SHA1

36ba8f0708df1c4a38117b17539be43d0af312f1
SHA256

c47384ea3feaf574e39f5cd2f78404197b2032ce0f9e6befe82d1a1af0675885
SHA512

dcf0565e5d6e77174ec87504ff6fab0782e9a85f8d68c2807bca81e91db2a5c2ff5926aeb360bafa977c3b7e4579be0f86d3ba4ce93a80e0e418d32eb1cfcef5
SSDEEP

196608:mkp2KcED6FQePuoCUOhOaDC0a94UVIM1/SK7RSJVIn:mkplcED6FQePzbY9WfyUVjKKFKVIn

Score

N/A

Malware Config

Signatures

Files

c47384ea3feaf574e39f5cd2f78404197b2032ce0f9e6befe82d1a1af0675885
.exe windows x86

23b9957a0b1d246d3d862e24a2ef4425

Code Sign

6e:81:f1:67:ca:f5:d0:f8:53:8e:22:06:f9:b4:48:ff
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

23/12/2014, 00:00

Not After

23/12/2015, 23:59

Subject

CN=Super PC Tools Limited,O=Super PC Tools Limited,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:3c:89:73:7f:96:2d:c9:4a:a4:44:03:da:ce:e2:51:20:71:74:16
Signer

Actual PE Digest

3d:3c:89:73:7f:96:2d:c9:4a:a4:44:03:da:ce:e2:51:20:71:74:16

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Super PC Tools Limited,O=Super PC Tools Limited,L=London,ST=London,C=GB

28/10/2022, 15:04
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
GetFileAttributesW
GetModuleFileNameW
GetTempPathW
SetLastError
GetProcAddress
GetLocalTime
LoadLibraryA
OpenProcess
LockResource
Process32NextW
GetVersionExW
DeleteFileW
GetCurrentProcessId
GetSystemTime
WriteFile
SetFileTime
WaitForSingleObject
CreateDirectoryW
SystemTimeToFileTime
CreateProcessW
CreateToolhelp32Snapshot
SizeofResource
LoadResource
SetErrorMode
SetEndOfFile
SetFilePointer
FindResourceA
CloseHandle
GetLastError
CreateFileW
ReadFile
GetSystemTimeAsFileTime
GetProcessHeap
HeapFree
HeapAlloc
GetFileSize
Process32FirstW
HeapReAlloc
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetModuleHandleW
ExitProcess
GetStdHandle
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
GetCurrentThread
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
IsProcessorFeaturePresent
HeapCreate
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
FreeLibrary
LoadLibraryW
SetStdHandle
WriteConsoleW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetVolumeInformationW
FindFirstFileW
GetFileTime
VerSetConditionMask
VerifyVersionInfoW
LocalAlloc
IsWow64Process
GetVersion
LocalFree
GetEnvironmentVariableW
GetBinaryTypeW
ExpandEnvironmentStringsW
SetEvent
TerminateThread
CreateEventW
lstrcmpW
lstrlenW

advapi32

RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
OpenThreadToken
SetSecurityDescriptorGroup
AccessCheck
DuplicateToken
InitializeAcl
AllocateAndInitializeSid
SetSecurityDescriptorOwner
AddAccessAllowedAce
FreeSid
IsValidSecurityDescriptor
GetLengthSid
RegSetValueExW
RegCloseKey
RegFlushKey
RegCreateKeyExW
GetUserNameW
RegOpenKeyExW

shell32

CommandLineToArgvW
SHGetFolderPathW

ole32

CoInitialize
CoUninitialize
CoCreateInstance

wininet

InternetReadFile
HttpOpenRequestA
InternetConnectA
HttpQueryInfoA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetSetOptionW
InternetCrackUrlA

psapi

GetModuleFileNameExW

user32

GetSystemMetrics

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23b9957a0b1d246d3d862e24a2ef4425

Code Sign

6e:81:f1:67:ca:f5:d0:f8:53:8e:22:06:f9:b4:48:ffCertificate

Extended Key Usages

Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

3d:3c:89:73:7f:96:2d:c9:4a:a4:44:03:da:ce:e2:51:20:71:74:16Signer

Signature Validations

Verification

28/10/2022, 15:04 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

wininet

psapi

user32

iphlpapi

Sections

.text Size: 150KB - Virtual size: 149KB

.rdata Size: 33KB - Virtual size: 33KB

.data Size: 7KB - Virtual size: 18KB

.rsrc Size: 6.3MB - Virtual size: 6.3MB

.reloc Size: 27KB - Virtual size: 26KB

6e:81:f1:67:ca:f5:d0:f8:53:8e:22:06:f9:b4:48:ff
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

3d:3c:89:73:7f:96:2d:c9:4a:a4:44:03:da:ce:e2:51:20:71:74:16
Signer

28/10/2022, 15:04
Valid: false

.text
Size: 150KB - Virtual size: 149KB

.rdata
Size: 33KB - Virtual size: 33KB

.data
Size: 7KB - Virtual size: 18KB

.rsrc
Size: 6.3MB - Virtual size: 6.3MB

.reloc
Size: 27KB - Virtual size: 26KB