dd4326351ce8aeaad8892420731e6848258b0d16220a41abf4d3de5067ab1c92

Sharing

Copy URL Twitter E-mail

General

Target

dd4326351ce8aeaad8892420731e6848258b0d16220a41abf4d3de5067ab1c92
Size

57KB
MD5

4e4aa30ceceab7e8f0bf1f39f273dfa5
SHA1

827a717e13e12e7ef4a9c9f437d51c4bc10c8253
SHA256

dd4326351ce8aeaad8892420731e6848258b0d16220a41abf4d3de5067ab1c92
SHA512

de57888cd48cf526908f59b285485a71d9739483fd71c6695e6d356dced135792a6a4d5dc27ce870755d26db91c2385c0c1202cb5d83f072fbe1940d16a4eb34
SSDEEP

1536:yPeacurY7Rc/a/ysfq2hltssjWpVCVuM0n:yrcUY7zvhfsGuKuMG

Score

N/A

Malware Config

Signatures

Files

dd4326351ce8aeaad8892420731e6848258b0d16220a41abf4d3de5067ab1c92
.exe windows x86

f4635f03077e9f854bae23ec7e98e71e

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:07:11:43:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/05/2002, 00:55

Not After

25/11/2003, 01:05

Subject

CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

60:72:ad:51:38:ae:c7:e6:cf:d7:d2:72:51:01:e6:ee:7c:f1:f8:e8
Signer

Actual PE Digest

60:72:ad:51:38:ae:c7:e6:cf:d7:d2:72:51:01:e6:ee:7c:f1:f8:e8

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

28/10/2022, 15:10
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SetTextColor
DeleteDC
BitBlt
GetObjectA
SelectObject
CreateCompatibleDC
CreateSolidBrush
SetBkMode
GetTextExtentPointA
DeleteObject
CreateFontIndirectA
GetStockObject
EnumFontFamiliesExA
AbortDoc
EndDoc
EndPage
TextOutA
StartPage
StartDocA
SetAbortProc
GetDeviceCaps
GetTextMetricsA
ExtTextOutA
SetBkColor

kernel32

lstrlenW
GlobalAlloc
SizeofResource
LoadResource
FindResourceA
GetVersion
lstrlenA
MultiByteToWideChar
GlobalFree
lstrcmpiA
CloseHandle
WriteFile
CreateFileA
LocalFree
FormatMessageA
GetLastError
EnumResourceNamesA
GetVersionExA
SetCurrentDirectoryA
GetModuleFileNameA
GetTickCount
GetStartupInfoA
GetModuleHandleA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetFilePointer
EnumResourceLanguagesA

user32

ReleaseDC
GetDC
CharPrevA
DispatchMessageA
TranslateMessage
IsDialogMessageA
PeekMessageA
DialogBoxIndirectParamA
LoadBitmapA
MessageBoxA
IsDlgButtonChecked
DialogBoxParamA
CreateDialogParamA
CharNextA
GetWindowLongA
SetWindowLongA
LoadCursorA
EndDialog
SetCursor
LoadIconA
LoadImageA
DestroyWindow
GetParent
GetDesktopWindow
ClientToScreen
GetWindowRect
ScreenToClient
MoveWindow
GetWindowTextA
DrawTextA
BeginPaint
FillRect
EndPaint
CallWindowProcA
GetSysColor
LoadStringA
EnableWindow
SendMessageA
SetFocus
DrawFocusRect
RedrawWindow
SetDlgItemTextA
CheckRadioButton
ShowWindow
SendDlgItemMessageA
GetDlgItem
GetClientRect

msvcrt

_controlfp
memmove
isdigit
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
__dllonexit
_onexit
_vsnprintf

comctl32

ord17

comdlg32

PrintDlgA
GetSaveFileNameA

oclean

InitDetection
HfOpenOpc
FCheckIfTargetIsRemove
AddFileSizeToSavingsVar
DoErrOOMDlg
FIsWord97ReallyWord98
MemCopy
SetMigrationLcid
FDoneWithPszFiles
FInitOPCDataFileBuf
GetFileBufRead
FDetectTargetStates
SetSourceDir
UintDetectAndMigrate
FDetermineCleanupActions
FSetTarget
FNoDarwinRemoval
FIsOtherListEmpty
FExecuteCleanupActions
FEarlyAppDetection
DoErrWriteDlg
OPCGetShellFolder
FreeAllBuffers

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f4635f03077e9f854bae23ec7e98e71e

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate

Extended Key Usages

Key Usages

61:07:11:43:00:00:00:00:00:34Certificate

Extended Key Usages

Key Usages

60:72:ad:51:38:ae:c7:e6:cf:d7:d2:72:51:01:e6:ee:7c:f1:f8:e8Signer

Signature Validations

Verification

28/10/2022, 15:10 Valid: false

Headers

File Characteristics

Imports

gdi32

kernel32

user32

msvcrt

comctl32

comdlg32

oclean

Sections

.text Size: 19KB - Virtual size: 18KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 28KB - Virtual size: 28KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:07:11:43:00:00:00:00:00:34
Certificate

60:72:ad:51:38:ae:c7:e6:cf:d7:d2:72:51:01:e6:ee:7c:f1:f8:e8
Signer

28/10/2022, 15:10
Valid: false

.text
Size: 19KB - Virtual size: 18KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 28KB - Virtual size: 28KB