e99749cafb29202341ea9bdd7a97637132f294382603f046f29438766b209d57

Sharing

Copy URL Twitter E-mail

General

Target

e99749cafb29202341ea9bdd7a97637132f294382603f046f29438766b209d57
Size

600KB
MD5

572d14eadf87213e3b9c38da10092600
SHA1

f6704f92a15f99a37eae43de871e4a6d3cc41e72
SHA256

e99749cafb29202341ea9bdd7a97637132f294382603f046f29438766b209d57
SHA512

04f7873f8d40060027aeeeeaddbd90d79d0cd17fe24cfed501aeb8151a9fd612e7ae2715a1d439259a6ca3369c1dfe8a0928f798745f970d350c60baa9769026
SSDEEP

6144:ty6fXw0uihYxdWFxKMOOaPlxny88ykj7d938+Ut3ZY9i9xve2uppbx/iWKN0FkyU:ty6fXw0ufWmhl1fkj7d9s9Rxve2uRy

Score

N/A

Malware Config

Signatures

Files

e99749cafb29202341ea9bdd7a97637132f294382603f046f29438766b209d57
.exe windows x86

6134deec531ae080f64409ecec57267d

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

eb:63:bc:1a:de:5b:47:04:2e:54:27:2c:b3:9f:90:99
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/11/2014, 00:00

Not After

25/11/2015, 23:59

Subject

CN=Webstream,O=Webstream,POSTALCODE=153003,STREET=Krasnyh zor\, 15a,L=Ivanovo,ST=Ivanovo oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b1:66:30:c8:f2:7a:b5:76:99:69:8f:bf:0c:95:aa:70:02:2f:5e:c5
Signer

Actual PE Digest

b1:66:30:c8:f2:7a:b5:76:99:69:8f:bf:0c:95:aa:70:02:2f:5e:c5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Webstream,O=Webstream,POSTALCODE=153003,STREET=Krasnyh zor\, 15a,L=Ivanovo,ST=Ivanovo oblast,C=RU

28/10/2022, 15:17
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
DeleteFileW
InterlockedExchange
InterlockedDecrement
GetModuleHandleA
TerminateThread
GetTickCount
DeleteFileA
LCMapStringW
LCMapStringA
LocalLock
VirtualAllocEx
GetFileAttributesA
VirtualAlloc
GetSystemInfo
VirtualProtect
GetLocaleInfoA
HeapSize
SetStdHandle
SetFilePointer
ReadFile
SetEndOfFile
HeapReAlloc
VirtualQuery
RtlUnwind
ExitProcess
GetStartupInfoA
GetCommandLineA
GetVersionExA
GetProcAddress
TerminateProcess
GetCurrentProcess
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapFree
CloseHandle
CreateFileA
HeapAlloc
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
FlushFileBuffers

user32

LoadBitmapA

gdi32

CreateCompatibleBitmap
SelectObject
CreateCompatibleDC

ole32

CoUninitialize
CoCreateGuid

oleaut32

SysAllocString
VariantInit

secur32

SetContextAttributesW
SetContextAttributesA

ws2_32

setsockopt
recv

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 524KB - Virtual size: 522KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.addex7
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ISYX
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.addex77
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6134deec531ae080f64409ecec57267d

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

eb:63:bc:1a:de:5b:47:04:2e:54:27:2c:b3:9f:90:99Certificate

Extended Key Usages

Key Usages

b1:66:30:c8:f2:7a:b5:76:99:69:8f:bf:0c:95:aa:70:02:2f:5e:c5Signer

Signature Validations

Verification

28/10/2022, 15:17 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

ole32

oleaut32

secur32

ws2_32

Sections

.text Size: 24KB - Virtual size: 20KB

.data Size: 524KB - Virtual size: 522KB

.addex7 Size: 4KB - Virtual size: 2KB

.ISYX Size: 8KB - Virtual size: 5KB

.addex77 Size: 16KB - Virtual size: 14KB

.rsrc Size: 16KB - Virtual size: 14KB

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

eb:63:bc:1a:de:5b:47:04:2e:54:27:2c:b3:9f:90:99
Certificate

b1:66:30:c8:f2:7a:b5:76:99:69:8f:bf:0c:95:aa:70:02:2f:5e:c5
Signer

28/10/2022, 15:17
Valid: false

.text
Size: 24KB - Virtual size: 20KB

.data
Size: 524KB - Virtual size: 522KB

.addex7
Size: 4KB - Virtual size: 2KB

.ISYX
Size: 8KB - Virtual size: 5KB

.addex77
Size: 16KB - Virtual size: 14KB

.rsrc
Size: 16KB - Virtual size: 14KB