40a412a3db5d4b77733d99748f875fc0037d7ade0ff66143579b0bd44a29b041

Sharing

Copy URL Twitter E-mail

General

Target

40a412a3db5d4b77733d99748f875fc0037d7ade0ff66143579b0bd44a29b041
Size

576KB
MD5

11a6a745f89f0b2c96de4838378269f0
SHA1

7dc9dfe882205d013e2869c28faafe076114bbc2
SHA256

40a412a3db5d4b77733d99748f875fc0037d7ade0ff66143579b0bd44a29b041
SHA512

3ddddb61dd4f9a30372c5560ba332aea821fe83ae6cda9a91a90f134099430ca374e231da0c73cd956460428ebf4632a5d3ded1aa76618ff174f5152ce3710ea
SSDEEP

12288:tM2rMfQnOiUagnGKMdCtHELwc3u6kt0ModLnmMR:tMyMfc1UagnidCGwc3VkStT

Score

N/A

Malware Config

Signatures

Files

40a412a3db5d4b77733d99748f875fc0037d7ade0ff66143579b0bd44a29b041
.exe windows x86

7725e93a40f9d0602109b5dd863275c6

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9c:a0:be:54:a9:51:63:64:68:0a:d4:5d:64:08:c6:a2
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2015, 00:00

Not After

02/05/2016, 23:59

Subject

CN=SBIS,O=SBIS,POSTALCODE=150001,STREET=PR-T MOSKOVSKIJ\, 12,L=YAROSLAVL,ST=YAROSLAVL REGION,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ed:dd:97:d7:dc:de:32:b5:55:29:7f:37:3a:1b:6e:b3:ba:82:ea:01
Signer

Actual PE Digest

ed:dd:97:d7:dc:de:32:b5:55:29:7f:37:3a:1b:6e:b3:ba:82:ea:01

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=SBIS,O=SBIS,POSTALCODE=150001,STREET=PR-T MOSKOVSKIJ\, 12,L=YAROSLAVL,ST=YAROSLAVL REGION,C=RU

04/11/2022, 15:42
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

GetTabbedTextExtentA
TrackMouseEvent
DrawTextA
OemToCharW
DestroyIcon
MenuWindowProcA
RegisterHotKey
InvalidateRect
EnumDesktopWindows
CharToOemBuffA
BroadcastSystemMessageExA
GetWindowInfo
BringWindowToTop
CharPrevW
ChangeDisplaySettingsW
GetUpdateRgn
MessageBoxA
CreateDialogIndirectParamA
UnregisterDeviceNotification
GetSystemMetrics
OpenIcon
CheckRadioButton
ShowWindowAsync
CloseWindowStation
SendNotifyMessageW
IsIconic
SetCursorPos
GetMenuContextHelpId
SetFocus
EnumPropsExA
AppendMenuW
SetDlgItemInt
GetMenuItemID
GetWindowThreadProcessId
CharUpperBuffA
RemovePropA
SetCaretBlinkTime
UnregisterClassA
SetClassWord
GetMonitorInfoW
GetForegroundWindow
FillRect
GetTopWindow
SetProgmanWindow
GetAltTabInfoW
SetMenuItemInfoW
MenuItemFromPoint
ChangeMenuW
GetListBoxInfo
CharLowerW
CharToOemA
GetDC
CreateDialogParamA
SetProcessWindowStation
DrawCaptionTempW
EnumThreadWindows
DialogBoxParamW
GetClassLongW
CopyIcon
SetCursorContents
LockWindowUpdate
FindWindowExW
UnregisterClassW
DefFrameProcW
GetMenuState
GetDesktopWindow
SetSystemMenu
EnableWindow
CharToOemBuffW
CheckMenuItem
SetWindowsHookA
LoadStringW
DestroyAcceleratorTable
AttachThreadInput
RealGetWindowClassW
AdjustWindowRect
SetInternalWindowPos
DrawIcon
GetAncestor
GetUserObjectInformationW
RealGetWindowClassA
GetWindowWord
ClipCursor
DrawCaptionTempA
OpenWindowStationA
SetRect
ScrollWindow
GetDlgItemInt
SetPropW
LoadKeyboardLayoutA
ReleaseDC
CharPrevA
InvalidateRgn
IsDialogMessageA
GetWindowModuleFileNameW
CreateAcceleratorTableW
ValidateRgn
CloseWindow
ValidateRect
GetWindowDC
GetMenuStringW
SetCaretPos
GetWindowTextA
SetWindowWord
GetShellWindow

kernel32

GetConsoleFontInfo
SuspendThread
GetTapePosition
GetLargestConsoleWindowSize
GetLogicalDriveStringsW
SetFileValidData
GetProcessAffinityMask
GetPrivateProfileStructW
GetAtomNameA
SetVolumeMountPointW
Sleep
GetProcessPriorityBoost
GlobalAddAtomA
CreateThread
EnumTimeFormatsW
GetCurrentActCtx
LocalFlags
LoadResource
WriteFileEx
LocalHandle
OpenMutexW
CreateWaitableTimerA
ExpandEnvironmentStringsA
EndUpdateResourceW
QueryDosDeviceA
GetCPInfoExW
GetDiskFreeSpaceW
GetExitCodeProcess
CallNamedPipeA
CreateSocketHandle
lstrcmpiA
LCMapStringA
QueueUserWorkItem
WriteProfileStringA
EnumCalendarInfoA
RegisterWaitForInputIdle
GetTapeParameters
GetCommMask
SystemTimeToTzSpecificLocalTime
GetNamedPipeHandleStateW
WriteProfileStringW
GlobalUnWire
SetTimeZoneInformation
FindFirstVolumeA
MoveFileWithProgressA
GetNumberOfConsoleInputEvents
GetFileType
WriteTapemark
UnmapViewOfFile
lstrcmpA
RegisterWowExec
CreateEventA
GlobalSize
UpdateResourceW
FindResourceExA
WritePrivateProfileSectionW
ReadFile
Heap32ListNext
WideCharToMultiByte
FindAtomA
InterlockedDecrement
GetProcessTimes
TryEnterCriticalSection
QueryMemoryResourceNotification
SetFileApisToOEM
GetPrivateProfileSectionNamesA
GlobalWire
FillConsoleOutputCharacterW
InitializeCriticalSection
AddRefActCtx
GetNamedPipeInfo
DelayLoadFailureHook
SetSystemTime
GetTempPathW
SetCommTimeouts
GetModuleHandleExA
GetProfileIntW
SetFileShortNameA
GlobalGetAtomNameW
GetProcessHeap
GetLastError
ConvertDefaultLocale
VirtualQuery
LoadLibraryA
GetCurrentProcessId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

shlwapi

PathAddExtensionW

comdlg32

CommDlgExtendedError
GetOpenFileNameA
ChooseColorA
ChooseFontW

oleaut32

VarUI2FromBool
GetVarConversionLocaleSetting
VarR4FromI2
VarI2FromDisp

winspool.drv

ADVANCEDSETUPDIALOG
AddMonitorA

gdi32

CreateBitmap
RemoveFontResourceA
GdiCleanCacheDC

version

GetFileVersionInfoSizeW

wtsapi32

WTSWaitSystemEvent
WTSEnumerateProcessesW
WTSVirtualChannelPurgeInput

ws2_32

gethostname
WSARecvDisconnect

comctl32

CreatePropertySheetPage
MenuHelp
ImageList_SetFlags
ImageList_SetIconSize

Exports

Exports

�┬-�$L��@��m��M�[V8!��d��a��䄲 ��9j�u�'K�i;��ҕ�`��R��'�T��/�T�Ԕ��/�5��c�� ?( ��kY��9��g�"f��A��pj�/+�༻�(�3 N}��u�W枣�y��k}�R�~D5��¶�BR�+��w�@��=Zqq[�9��$��<4[lV�h��м�M��$�㦍�K� @�%��xkϫ��Yt��μ��{r��#��"5[ܬ�(��y� �Wu_�X��Hh�F�x�8+.gW(��(?�k�� F�aFT)�u��S��N�K�5!��Ne�ʛ%h�ǭG��Vl$��!��NK�*�K��$��ǹuS��.�ހ�ɨ>�� k1d{��S㚜�_��)o��n짋߹袅@��`�pb��bYA� �J��OgW��S�$*d��f��j�)��grLJ\��^'��L"��A5�e�꣠�ns��qF0y�1��xd�,��]�L#d�l�%�"fNT��&',V�lU��)H�M1�ɑw�k3�ت�|YNI�c�4��x�K��0�8��,��bԄZH�)��Eh%h��Ɍ�ys\�1P�َz��]��a}�l��D��H��+�Q��1�E�!��"��u�q�` �r�'EY(�g�}V��?�;�5gE��/��^��l�El�Z��\2��q�1�+a�+ˊ{-�\2ɿ1_ڒ� ��BS or�6�A;�� &HI��P��^�A~b��1N^�)J��A{�r"��K��&m8N��^��p?9��m!�nm�0|��mC.(yݵ�K�?XZ��}�K�2t1svr4m� �5��ti�:��Q��7'`4�]��1�k��t،s��m��l?�;Y̺�i��[��!��@��v�kL]�'��Z�S+�3Ho��E�U�?Z��U�eߕ��48�Y�C��h��D�� :Ӡ8B��~^��#�I앜B��7��&�d��^�G��m]�E��^(Ђ� �.u RJ�E'1�dl< �2_U�H�^N�P1V�/\#�-�U/�� S>�Oyc�i��9=��%.ñ\�q#��*��Ԧ71b EQ�e��L�~��d��~�P"��[=��y�0Ϧ��^Z��w�R�*�s��s�V�XP��r�4t��y��=<}�^��4�X22� Ū��vCOҲQ��>�h��.?[�7��ChU5�x"5�R�)��ϧ��|��25�=��E;�#�n~,�L�t��ewiQ�2��x5�*1��f�tN�yJ^�b�ؑզ��y>w��h� R[��`B�Z:��<��d+�$��@e��K��Ȍ"-�3ݥi��Ǒ��DZ(�a�?�G�8 ��И޼ 9~s�9�xjҸ��ɟ��8��h�sp3��g�:��'��8@b'HS ��2��vsj_.|�+<��p�8 �<�@>u��]��x^��o��c��*Y��U��F�Ѱ)qFxO��wl.%��X��p m��N��͇��ͷ��0ǥ4�\-<�hj�jǑ�/��n�_e�P�r��$��=��d��V��0��(��`��9�1��;u5��:%��Zy#�[)�0$u��,q��.$)v��ʻu� R��ܥ[�� @�qM�� (YO�ΒI;À�i�n��<2T*�1��ȏ�/uVf<805��๩�E �7�m�;�0�e�B��q�J��zzmß@�?� �� SMkP_�₮9��Su�q��F��&փ��Ͱb�Z��;��h#|�q2��u�t�D�Sx�ĉ�t�3��;I�O��m��%it��F*�_x;j�^��&=׋W_Hj��+�$%k{�p�e(A��c��L�W��ma�q:��n*�6+�o�7��(�󨛊ʵR�U��+�<HM��GJ�z�'T��sB ��2�k��F��d��n7z͒xWR��i��\I�cX ;f�8�đ��&Q�l_�l�]R��g��G��2��R�F�u,EAjW�ɡaf{�jTK�+�U��/X��nV��п?�]}��3�ѻ.ɲì��^��laNY=wƭ�� >�`h�C!��ȹ�a\�YW��h�f�ު�3��@%��-nG��K&0��u�N9j�Œnx��z5��b��h��z)�ܬr0��2��%��p:j��3��mj��+X��&�c��Y�,X��a�3��%x�9P�u��F=�tV0�INf-�� 6��VP�-�>�'�s��^�Q��68��%�ryG��=ۜ~��tyRdH��ڠ�l�zmP�ͤ�݄�򅘣+��ժ��[�M(�U�N��rO�XW$�� 7�H:�cZP[��I�J��W[ �`��Q��`�,k�6�_M��.�E<g�2�[�-�q�D�[C��!�2�7K�c��>/2�R��z�_��_��:Ӵ́/p+�2�d�'�ʷ�H��sQ�b�KP�ζCpm��D�֥��42E#�lR+�<]ϛ�~F��t��A��_I��8��ۛR��b�н1#=��t�N[��xoW��͐e��2��>��K��2t� ��q��(��(�nʪ�5 �ǇGִ�*�&��z��Nq��\�F �bC*9�� O��@&��\"��6]�x�KT5�Z��@jaTU�#s~�ݸL�k-#��]�^�7�h��on�G�o�$��"7��7Ŝ��C��n�S̥/J�H��@�o2u��@�V�V��G�1$��{bO��*~��5��^C �jGjX�:��N��^� ��n�w� Ǩ�

Sections

CODE
Size: 404KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7725e93a40f9d0602109b5dd863275c6

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

9c:a0:be:54:a9:51:63:64:68:0a:d4:5d:64:08:c6:a2Certificate

Extended Key Usages

Key Usages

ed:dd:97:d7:dc:de:32:b5:55:29:7f:37:3a:1b:6e:b3:ba:82:ea:01Signer

Signature Validations

Verification

04/11/2022, 15:42 Valid: false

Headers

File Characteristics

Imports

user32

kernel32

shlwapi

comdlg32

oleaut32

winspool.drv

gdi32

version

wtsapi32

ws2_32

comctl32

Exports

Exports

Sections

CODE Size: 404KB - Virtual size: 404KB

DATA Size: 18KB - Virtual size: 18KB

BSS Size: - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 5KB

.text0 Size: 16KB - Virtual size: 15KB

.tls Size: 512B - Virtual size: 24B

.text1 Size: 65KB - Virtual size: 64KB

.reloc Size: 6KB - Virtual size: 5KB

.rsrc Size: 53KB - Virtual size: 53KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

9c:a0:be:54:a9:51:63:64:68:0a:d4:5d:64:08:c6:a2
Certificate

ed:dd:97:d7:dc:de:32:b5:55:29:7f:37:3a:1b:6e:b3:ba:82:ea:01
Signer

04/11/2022, 15:42
Valid: false

CODE
Size: 404KB - Virtual size: 404KB

DATA
Size: 18KB - Virtual size: 18KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 5KB

.text0
Size: 16KB - Virtual size: 15KB

.tls
Size: 512B - Virtual size: 24B

.text1
Size: 65KB - Virtual size: 64KB

.reloc
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 53KB - Virtual size: 53KB