a1a7ac49387ea0ed557abbb3ba3a9e56c963deedb6ae37dbff3a4903c4ab4a0e

Sharing

Copy URL Twitter E-mail

General

Target
a1a7ac49387ea0ed557abbb3ba3a9e56c963deedb6ae37dbff3a4903c4ab4a0e
Size 5.4MB
Sample221031-2trgfsehak
SHA256 a1a7ac49387ea0ed557abbb3ba3a9e56c963deedb6ae37dbff3a4903c4ab4a0e
MD5 1309d4867486ca398296138c3b7a1251
SHA1 07a90bb669de0568a8215c26b4e8c11192f5004d
SHA512 26e50ea91f91cb2d44dd9d46de4432940abe184806783a3015df17dfd961d4acc9c684d79a5322ef0feaaf0c37fedab10e3b4da4d3b9f172d84480ab3fda491a
SSDEEP 98304:52LV6eaSLm/cR94IXsYmVG0VqK4yXmJqyd2R4gcL9d6k8Zjscs:52vaLcR9BXsYIGKqqXmkr4gcrQjscs
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

a1a7ac49387ea0ed557abbb3ba3a9e56c963deedb6ae37dbff3a4903c4ab4a0e

.exe 5.4MB

a1a7ac49387ea0ed557abbb3ba3a9e56c963deedb6ae37dbff3a4903c4ab4a0e

IMPHASH 1fe3bdece9a0661dad6c1612e6e34a1e
SHA256 a1a7ac49387ea0ed557abbb3ba3a9e56c963deedb6ae37dbff3a4903c4ab4a0e
MD5 1309d4867486ca398296138c3b7a1251
SHA1 07a90bb669de0568a8215c26b4e8c11192f5004d
SHA512 26e50ea91f91cb2d44dd9d46de4432940abe184806783a3015df17dfd961d4acc9c684d79a5322ef0feaaf0c37fedab10e3b4da4d3b9f172d84480ab3fda491a
SSDEEP 98304:52LV6eaSLm/cR94IXsYmVG0VqK4yXmJqyd2R4gcL9d6k8Zjscs:52vaLcR9BXsYIGKqqXmkr4gcrQjscs
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

85:e6:e4:19:1c:7d:fe:e8:5f:8c:d6:ec:cd:79:1d:d5:ce:36:29:6c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Serial Number

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 15, 2010 - Dec 14, 2012

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

4027464

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

HttpQueryInfoW HttpQueryInfoA

crypt32

CertFreeCertificateContext CryptVerifyMessageSignature CryptGetMessageCertificates CertCreateCertificateContext CertVerifySubjectCertificateContext CertCloseStore CertFindCertificateInStore

urlmon

CopyStgMedium

version

GetFileVersionInfoSizeA GetFileVersionInfoA GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW VerQueryValueA

winmm

waveOutGetDevCapsW waveInGetDevCapsW waveOutGetNumDevs waveInGetNumDevs waveOutOpen waveOutReset waveInStart waveInAddBuffer waveInStop waveOutClose waveInClose waveInUnprepareHeader waveInReset waveInPrepareHeader waveInOpen timeKillEvent timeSetEvent waveOutGetPosition timeGetTime waveOutPrepareHeader waveOutUnprepareHeader timeEndPeriod timeBeginPeriod timeGetDevCaps waveOutWrite

oleaut32

SysFreeString

dsound

ord8

kernel32

CreateFileA GlobalFree ReadFile GetFileSize CreateThread LockResource LoadResource FindResourceExA FindResourceExW SetUnhandledExceptionFilter GetTempPathW FindClose FindNextFileW FindFirstFileW InterlockedIncrement InterlockedDecrement GetTimeZoneInformation GetSystemTime SystemTimeToFileTime ReleaseSemaphore WaitForMultipleObjects SetEvent CreateSemaphoreW GetTempPathA GetModuleFileNameA GetModuleFileNameW GetTempFileNameW GetSystemDirectoryW ExpandEnvironmentStringsA WideCharToMultiByte CreateProcessW GetTempFileNameA GetFileAttributesA CreateDirectoryA DeleteFileA CreateMutexA SetFilePointerEx GetFileSizeEx GetFileAttributesExW VerSetConditionMask GetVolumeInformationW GetCurrentDirectoryW SetCurrentDirectoryW RemoveDirectoryW GetFullPathNameW ExpandEnvironmentStringsW OutputDebugStringA GetVersionExA CreateDirectoryW RaiseException UnmapViewOfFile ReleaseMutex MapViewOfFile CreateFileMappingA SetLastError SetThreadPriority GetSystemDirectoryA TerminateThread lstrcpyA lstrlenA QueryPerformanceCounter QueryPerformanceFrequency QueueUserAPC OpenThread SleepEx FlushInstructionCache GetModuleHandleA GetCommandLineW SetEndOfFile SetFileAttributesA CopyFileA GetStartupInfoW GetCommandLineA TlsFree TlsSetValue TlsGetValue VirtualAlloc VirtualFree GetNumberFormatW GetCurrencyFormatW CompareStringW GetDateFormatW GetTimeFormatW GetUserDefaultLCID EnumSystemLocalesW HeapAlloc GetProcessHeap VerifyVersionInfoW CreateFileW SetFilePointer WriteFile GetUserDefaultUILanguage GetUserDefaultLangID VirtualQuery GetFileAttributesW DeleteFileW MoveFileExW GetModuleHandleW GetSystemInfo LoadLibraryA GlobalAlloc GlobalSize GetCurrentProcessId GlobalLock GlobalUnlock GetCurrentProcess GetProcessTimes FreeLibrary CreateProcessA LCMapStringW GetTickCount GetCurrentThreadId GetLocaleInfoW GetEnvironmentVariableW GetLastError ResetEvent WaitForSingleObject CreateSemaphoreA CloseHandle CreateEventW GetVersionExW LoadLibraryW GetProcAddress GetCurrentThread SetThreadAffinityMask IsDBCSLeadByte GetACP GetCPInfo MultiByteToWideChar ExitThread InterlockedExchange InterlockedCompareExchange Sleep LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection TlsAlloc CreateEventA HeapFree HeapSize VirtualProtect IsProcessorFeaturePresent RtlUnwind ExitProcess GetStartupInfoA UnhandledExceptionFilter GetStdHandle TerminateProcess IsDebuggerPresent GetConsoleCP GetConsoleMode FlushFileBuffers SetHandleCount GetFileType HeapCreate HeapReAlloc GetOEMCP IsValidCodePage LCMapStringA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetStringTypeA GetStringTypeW CompareStringA SetEnvironmentVariableA GetFileInformationByHandle

user32

GetWindowTextW GetWindowTextLengthW RegisterClassExW DeleteMenu LoadMenuW PostQuitMessage UnregisterClassA GetWindowTextA InsertMenuA InsertMenuW GetDlgItemTextA GetWindowTextLengthA GetDlgItemTextW EnableWindow SetDlgItemTextA SetDlgItemTextW DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW LoadAcceleratorsW GetMenuStringA GetMenuStringW EndPaint SetMenu EnumDisplaySettingsW FlashWindowEx GetActiveWindow MapWindowPoints MoveWindow SetCaretPos DestroyCaret CreateCaret ShowCaret EmptyClipboard SetClipboardData IsClipboardFormatAvailable OpenClipboard GetClipboardData CloseClipboard RegisterClipboardFormatW CreateWindowExW IsWindow GetWindowThreadProcessId GetSubMenu SetCapture ReleaseCapture TrackMouseEvent CallWindowProcW GetCapture DestroyWindow MessageBoxW LoadCursorW GetCursorPos LoadStringA GetFocus InvalidateRect UpdateWindow CheckMenuItem PeekMessageW GetQueueStatus SetTimer KillTimer GetMenuItemInfoW RemoveMenu GetSystemMenu InsertMenuItemW DrawMenuBar CreatePopupMenu TrackPopupMenu DestroyMenu CreateMenu SetMenuInfo MapVirtualKeyW GetKeyState GetForegroundWindow WaitForInputIdle MessageBoxA DialogBoxParamW ScreenToClient SetWindowTextA GetClientRect LoadStringW RedrawWindow DialogBoxIndirectParamW PostMessageW GetDesktopWindow SetWindowPos LoadIconW GetDlgItem SetWindowTextW GetParent SendMessageTimeoutW SendMessageW CreateIconIndirect SetFocus SetRectEmpty SetWindowLongW SetCursor GetCursor GetPropW SetPropW SystemParametersInfoW GetSystemMetrics GetClipboardFormatNameA RegisterClipboardFormatA DdeInitializeW DdeCreateStringHandleA DdeConnect DdeClientTransaction DdeDisconnect DdeFreeStringHandle DdeUninitialize GetMenu GetClassInfoExW ShowWindowAsync GetWindow IsWindowVisible ShowWindow SetWindowPlacement GetWindowPlacement EnableMenuItem IsZoomed DefWindowProcW SendInput GetKeyboardLayout FillRect GetWindowLongW GetWindowRect UpdateLayeredWindow GetDC ReleaseDC ClientToScreen GetMonitorInfoW SetRect OffsetRect MonitorFromWindow GetDoubleClickTime SetMenuItemInfoW BeginPaint EndDialog

gdi32

BitBlt SelectObject RealizePalette SelectPalette ExtTextOutW SetBkColor CreateSolidBrush StretchBlt SetStretchBltMode GetStretchBltMode EnumFontFamiliesW GetICMProfileA CreateDIBSection GetStockObject SetPixel CreateBitmap CreateFontIndirectW GetTextMetricsW EnumFontFamiliesA SetBkMode SetTextAlign IntersectClipRect GetDeviceCaps ExtTextOutA CreateCompatibleBitmap CreateDCA SetTextColor CreateFontIndirectA GetClipRgn CreateRectRgn GetTextAlign GetBkMode GetTextColor SetTextCharacterExtra GetTextExtentPoint32W GetCurrentObject GetBkColor CreatePen DPtoLP GetTextExtentPoint32A GetTextCharacterExtra SetWorldTransform SetGraphicsMode GetWorldTransform CreatePalette GetSystemPaletteEntries LPtoDP StartDocW EndDoc StrokePath ExtCreatePen FillPath StretchDIBits GetClipBox GetDIBits DeleteObject GdiFlush DeleteDC CreateCompatibleDC RestoreDC SelectClipPath PolyBezierTo GetObjectW LineTo MoveToEx EndPath BeginPath SaveDC SetPolyFillMode EndPage GetFontData SelectClipRgn EnumFontFamiliesExW StartPage

comdlg32

GetOpenFileNameW GetSaveFileNameW PrintDlgW GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

advapi32

RegQueryValueExW RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegSetValueExA RegQueryValueExA RegCloseKey RegOpenKeyExA

shell32

DragQueryFileA DragAcceptFiles SHGetDiskFreeSpaceExW SHGetFolderPathW SHGetSpecialFolderLocation SHAppBarMessage SHBrowseForFolderW SHGetPathFromIDListW SHGetFolderPathA DragQueryFileW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemFree CreateBindCtx ReleaseStgMedium CoUninitialize OleFlushClipboard OleIsCurrentClipboard OleSetClipboard OleGetClipboard OleInitialize CoInitialize OleUninitialize

mscms

TranslateBitmapBits CloseColorProfile CreateColorTransformW DeleteColorTransform OpenColorProfileW

ws2_32

getsockname ntohs send recv WSAStartup WSASocketW socket ntohl WSAIoctl WSAGetLastError WSAAsyncSelect closesocket WSACleanup select gethostname connect ioctlsocket WSAEnumNetworkEvents WSAEventSelect WSACreateEvent WSAAddressToStringA bind sendto recvfrom WSASetLastError getservbyport gethostbyaddr getservbyname htonl inet_ntoa gethostbyname inet_addr WSACloseEvent setsockopt htons

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

888KB

Virtual Size

887KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

89KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

356KB

Virtual Size

356KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ