0002ef4a80b04e99b2e96945e59251358c5a9067322d71c45d356e12f7a7e99a

Sharing

Copy URL

Twitter E-mail

General

Target

0002ef4a80b04e99b2e96945e59251358c5a9067322d71c45d356e12f7a7e99a
Size

531KB
MD5

a360c7bbc2218db9c38b1ff2bc530c45
SHA1

b2b5245dad5d3211b75b63a1ad27ff9e60605c67
SHA256

0002ef4a80b04e99b2e96945e59251358c5a9067322d71c45d356e12f7a7e99a
SHA512

33e1fba8cf5094b1d5f4df79609f41c45535d90a313193e086ceddfced97dd0489881751116e3693585de47dd30b4b430640522ca0915c018b365c70131ba976
SSDEEP

12288:GJjue/rWFZJFZtRbDjwNffQFczqb4um8jcqMm63E3N:2jueD23oFfQKzqb4Mcq1FN

Score

N/A

Malware Config

Signatures

Files

0002ef4a80b04e99b2e96945e59251358c5a9067322d71c45d356e12f7a7e99a
.exe windows x86

58fc0259989d3b0a94dd534b2ea14472

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7d:69:9e:d1:76:3f:e7:21:dd:39:c3:1c:cb:f8:fc:a4
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11-02-2013 00:00

Not After

11-02-2014 23:59

Subject

CN=Cognitive Finance Technologies,O=Cognitive Finance Technologies,POSTALCODE=190020,STREET=Narvskiy pr.\, 18-403,L=Saint-Petersburg,ST=Saint-Petersburg,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a0:91:aa:36:bc:c1:e0:7c:12:ab:42:f6:22:5c:a4:32:57:bf:a5:1f
Signer

Actual PE Digest

a0:91:aa:36:bc:c1:e0:7c:12:ab:42:f6:22:5c:a4:32:57:bf:a5:1f

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Cognitive Finance Technologies,O=Cognitive Finance Technologies,POSTALCODE=190020,STREET=Narvskiy pr.\, 18-403,L=Saint-Petersburg,ST=Saint-Petersburg,C=RU

28-10-2022 15:02
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

glu32

gluQuadricNormals
gluQuadricCallback
gluTessProperty
gluNurbsProperty

comctl32

FlatSB_GetScrollProp
ord4
FlatSB_EnableScrollBar
PropertySheetW
ord14
FlatSB_GetScrollRange
CreatePropertySheetPageA
DestroyPropertySheetPage

advapi32

RegSetValueExA
RegCloseKey
GetTokenInformation
RegSetValueA
RegDeleteKeyA
RegQueryMultipleValuesA
RegCreateKeyExA
RegFlushKey

shlwapi

PathFindNextComponentA
PathIsRootA
PathCombineA
SHDeleteEmptyKeyW
SHEnumValueA
PathUnquoteSpacesW
ChrCmpIA
PathIsPrefixW
StrChrA
StrDupW

kernel32

GetEnvironmentStringsW
HeapReAlloc
HeapAlloc
GetStringTypeW
VirtualAlloc
GetProcAddress
GetModuleHandleA
WritePrivateProfileStructA
WriteProfileStringA
GlobalMemoryStatus
EnterCriticalSection
VirtualQueryEx
VirtualQuery
VirtualFree
HeapSize
VirtualAllocEx
ReleaseMutex
GlobalAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
RtlUnwind
Sleep
HeapFree
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
IsProcessorFeaturePresent
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
LoadLibraryW

version

VerFindFileA
VerInstallFileA
GetFileVersionInfoA

activeds

ord22
ord15
ord12
ord17
ord18
ord14
ord3
ord8

cryptui

CryptUIWizExport
CryptUIWizDigitalSign
CryptUIWizImport

comdlg32

ChooseColorA
FindTextW
PrintDlgA
ChooseFontA
ChooseFontW
PageSetupDlgA
GetOpenFileNameW
CommDlgExtendedError
GetFileTitleW
GetSaveFileNameA
ReplaceTextA
GetFileTitleA
PageSetupDlgW

mgmtapi

SnmpMgrClose

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 491KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

58fc0259989d3b0a94dd534b2ea14472

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

7d:69:9e:d1:76:3f:e7:21:dd:39:c3:1c:cb:f8:fc:a4Certificate

Extended Key Usages

Key Usages

a0:91:aa:36:bc:c1:e0:7c:12:ab:42:f6:22:5c:a4:32:57:bf:a5:1fSigner

Signature Validations

Verification

28-10-2022 15:02 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

glu32

comctl32

advapi32

shlwapi

kernel32

version

activeds

cryptui

comdlg32

mgmtapi

Sections

.text Size: 19KB - Virtual size: 19KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 6KB - Virtual size: 309KB

.rsrc Size: 491KB - Virtual size: 491KB

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

7d:69:9e:d1:76:3f:e7:21:dd:39:c3:1c:cb:f8:fc:a4
Certificate

a0:91:aa:36:bc:c1:e0:7c:12:ab:42:f6:22:5c:a4:32:57:bf:a5:1f
Signer

28-10-2022 15:02
Valid: false

.text
Size: 19KB - Virtual size: 19KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 6KB - Virtual size: 309KB

.rsrc
Size: 491KB - Virtual size: 491KB