a55301bc0f7e52a22b4539fb63c65fa4df48401aa48884be12e5248a4b5f82ae

Sharing

Copy URL Twitter E-mail

General

Target

a55301bc0f7e52a22b4539fb63c65fa4df48401aa48884be12e5248a4b5f82ae
Size

607KB
MD5

11d9dd0e9513bbed0a66401092e17d30
SHA1

53196545b79a502e63806add0f666fb2c611868e
SHA256

a55301bc0f7e52a22b4539fb63c65fa4df48401aa48884be12e5248a4b5f82ae
SHA512

fc6f3b17a92689a66a83b18601d3a20607d94bed6be8ea901ff1ce9f3ffb8111dabd4a8cb5b1ed66b428148a2a04c23add4fb8814700cdbf3f3d77010eb8bc8b
SSDEEP

12288:nF4qe+CpmI/ZbTI600NlK+qXMm3cbjv3BsNM:nFh5JIRPtJNlNsMjvS

Score

N/A

Malware Config

Signatures

Files

a55301bc0f7e52a22b4539fb63c65fa4df48401aa48884be12e5248a4b5f82ae
.exe windows x86

cc135c93da243cc9b1615a2a9bd2886d

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8e:18:34:16:de:03:f9:76:e8:a4:d7:48:a2:9e:0c:de
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

29/04/2015, 00:00

Not After

28/04/2016, 23:59

Subject

CN=RTPK,O=RTPK,POSTALCODE=214000,STREET=UL. KONENKOVA\, 4\, 68,L=SMOLENSK,ST=SMOLENSK REGION,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fc:4f:67:0f:bc:e7:03:4f:15:31:26:28:ce:34:fe:62:3c:25:b1:e1
Signer

Actual PE Digest

fc:4f:67:0f:bc:e7:03:4f:15:31:26:28:ce:34:fe:62:3c:25:b1:e1

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=RTPK,O=RTPK,POSTALCODE=214000,STREET=UL. KONENKOVA\, 4\, 68,L=SMOLENSK,ST=SMOLENSK REGION,C=RU

04/11/2022, 15:41
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

LockWindowUpdate
IsMenu
MonitorFromRect
OemToCharA
RealGetWindowClassA
CharToOemW
WaitForInputIdle
GetWindowThreadProcessId
PrintWindow
InvalidateRgn
GetMenuContextHelpId
DrawTextExA
MessageBoxA
SetCaretPos
LoadMenuA
ShowOwnedPopups
wsprintfA
GetMessageExtraInfo
EnumWindowStationsA
OemToCharW
CharUpperA
SetMenu
DrawFrame
DefDlgProcW
SendNotifyMessageW
RegisterClassA
BlockInput
MapVirtualKeyW
IsWindowUnicode
DrawEdge
GetDlgItemTextA
BroadcastSystemMessageA
SetWindowPlacement
SetDlgItemInt
InsertMenuItemW
LoadAcceleratorsW
OpenClipboard
LoadMenuIndirectW
IsDlgButtonChecked
FlashWindow
SetScrollPos
GetWindowModuleFileNameA
CharPrevA
DrawAnimatedRects
RemovePropA
DialogBoxIndirectParamA
RegisterClassW
MapVirtualKeyA
DlgDirListW
GetLastInputInfo
GetClassLongW
SetClipboardViewer
FillRect
ShowCaret
CloseWindow
CreateAcceleratorTableW
DialogBoxParamA
MonitorFromWindow
ChangeMenuW
SetMenuItemBitmaps
LoadCursorFromFileW
CreateMDIWindowA
CheckDlgButton
CreateIcon
DestroyAcceleratorTable
SetClipboardData
PostMessageW
TabbedTextOutA
GetAncestor
DlgDirSelectExW
GetClassInfoW
GrayStringA
IsWindowEnabled
EnableMenuItem
CheckMenuItem
LoadStringW
SetLayeredWindowAttributes
RegisterWindowMessageA
GetUserObjectInformationW
CharToOemBuffA
IsHungAppWindow
GetWindowWord
GetWindowContextHelpId
GetMenuItemInfoA
DrawIconEx
DragDetect
CharNextW
DispatchMessageW
SetWindowWord
GetWindowTextA
SetCaretPos
CharNextA

kernel32

LCMapStringA
PrepareTape
GetDiskFreeSpaceExA
CompareFileTime
GetCurrentActCtx
SetComPlusPackageInstallStatus
DefineDosDeviceW
QueryMemoryResourceNotification
HeapUnlock
GlobalDeleteAtom
GetUserGeoID
EnumLanguageGroupLocalesW
GetDriveTypeA
SetVolumeLabelW
FlushConsoleInputBuffer
GetFullPathNameW
AddConsoleAliasW
WriteConsoleInputA
WaitForDebugEvent
MoveFileA
GetPrivateProfileIntW
RtlUnwind
lstrcpyA
CancelIo
GetFileAttributesW
lstrcmpiW
GetNamedPipeHandleStateA
CreateJobSet
OutputDebugStringA
VirtualQueryEx
CreateProcessW
GetThreadLocale
WriteConsoleOutputCharacterA
GetWriteWatch
SetFileShortNameA
SetComputerNameA
GetConsoleKeyboardLayoutNameW
ShowConsoleCursor
EraseTape
GetStringTypeW
LZOpenFileA
GetLargestConsoleWindowSize
GetLastError
ConvertDefaultLocale
GetProcessHeap
GetVersion
TzSpecificLocalTimeToSystemTime
EndUpdateResourceW
VirtualQuery
LoadLibraryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

comdlg32

PageSetupDlgW

oleaut32

VarBstrFromUI8

winspool.drv

GetFormA

gdi32

AnyLinkedFonts

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoA

ws2_32

WSAGetOverlappedResult
WSAGetQOSByName

comctl32

DllGetVersion
ImageList_DragShowNolock
ImageList_BeginDrag

Exports

Exports

#�T�/��謚>8H�h�� -c\'p�t�jdq��94��[�)�KBz�� {��K�LYw��_ACp{�� ux��L�5�)L�N/�Z�}�F�p��h� �p��~<}!;6'��0U�<ݓ�N6��5�}��t��e��Bb'"'�v,�-��1]|<�EH�+<�>�f��߇W��&w-��%��a�>Ф ��{�3�ٱ��􆆏02�diՊ>'n�ֈ ��#D��m�0Ǖ��p��o��jߊu�C��㽭kN%D�Y1��Cf*��5��J-�9��A��0��W:؞[2B�d,��H��(%I�Zg��]�\ ��1a$K¦�]$Č��_ ��}jY�$YL�eި��iCR~�[�G��O��P\w[��KppKQ"Tx�� x�e<��I��#$��8�ʣ��</�F��I4ABj��#��~C{#�G��E�p��G;�~9� ��Y}Ej��_�� v��r��P-q�g h�C�2��H 4F��Ҏ �r=��L@�`��o$R�mm3��C�qR_vSB��SU-��c�ܗDo'��!4p�� _��W�U!g4(��I(� @x��}�Ӹ��Y_��b�[�t(�!�CP��n|�/��źH#�6q0��SMX��+��vt�K�$$�B��g�em7�k��nz�àO/��Zyٕ^�e��F��_�U�2{|0�j�-g��J�f�:g�?��]`�/ս�{qMk��/��+��~\ Q�[��\�� ׏U�gZHz��v4�_xjE'.�2-��6�j��M�CI1N��J��,�Y!��/�v��3j�m�0��$%s@$i�:2��X�\=��M� <q��e��鑥&�'\�)�͗t�D�C2��8Q�ݎ��~�Iz n�"��h��H��U�ts��bB�y#}4��Hx�� !�*��u"�M�כ.��=^�Aè�b��e�@�cQS��n��4�Q��zTK��BD4RpQ�"�o�u��]�<��F�=�J'[{A��-��V��H��Q��.tm��)��>�Z=݊��c�\�R'� �<Z>'%��F y��8~3��:�� z�n��G��yPJP��7τ��KE��E�=��r6V��EDI�f0$ܻ��n^�h�E�#��d�1E,݊p�,�LXћ��{��$��"9f��^�݁�G}"��ߔ"50��T/��bzf��o.��0��\��3�{?:^��Q�U�+��l�S�i�@�|��@8��r��CV^bK��+�7! �m�.槸�ο~Ϛ��KL�9.@yrO��Q*�.�s�\;/�c��j0ZL�O�Ϯ0EZ�ɮ��J\�b !�L�|�?�-rKt|6��^�`� �]�r��j��j��yB�Ԗ�z�ٯĴᷓ� �5��K3uU��<��fM��W��ᓓx��4�?]L��MSFR��q^��H�d�N�Im�ܺ�s��m�/s8P83��dNX��8f��oIG�1�3�Z�ޚ�qTg8��D�*�mt�pcu\7Skp#�x�ȉwb��=��Ms&�Z�V�ݘ�E��U��_u�î%��u%mT��QU��ZB��Uva�8̭�'�DW ��aD� J�'V5H�5�$d��=�K�Z�m��k��,��t��3-�c.��3*JB�F�yvҪM��uEB��>�ܾ��ާ�.A��f��%��,k�R�� 7lc��!Q$�vY�뺳}��'�ex��F>X v��Z�z��9<�=�J�K�|�|Ҝ4_'�|��/��v��AG6�ծu��2��N#�.��= �5(4f��]]��g�%O��5�<L��^��XOy�5��[+2�W��s��5ֵ�w!6��v��W�M��H�P6�S7��H.��3O�e�^�_�Md�k*��L "}�º��:2dMf9��l�5�e�|k�M/�e�7=��ju�mr[8�ݴFs@�1\W�2QbڢqC��g�pr|��D�,b � �f�?��a��w�q��&��n��ۈ)��N�.`D�P ��c%�Z�L�ԫq �,��}v��§��G��0+��Z^.�vڻ��'{ ��mmBÝ��S�rEaYxLη�;SSV=)��m2��s�6��Fa��6)��{�<��V��0G��R��5��0f�<��a�{q�L1��2��h��^y(7��=Eb�ي��Ѧ�Y��D�o]�j۴Mi�~�l0��V�{��L��$��L��7J�wM�1%R�r��q�q>AҹyQY�e� �š4��^�L��Hv��dr;�R7lJ�ؓ�*x�٩��{�MP@��k!��L��'��IF��Cj_��|d` $�<��|�=�A��?'��on2 � ��N��hS��痿NL0�V��*KdG��-��J \M`x!T�~�d��V��b?b�<R�)?2�ڑ�V:9��K��kpL��L��$�;��"|.��Uw�}j��j��R�c��^e5ҝ`��l�l�?��U�/��j�7��:�$ŧ�w��\F�/�٤�+ˬ��ZRm��D]�?bt�:-�G$-��]^�C4� �Ņ͹P�G�W�/�& ��luG��"�?��:t�i#��钊M��L�S��w�"8�l%��L8��SL�׏�6�ə<��@cm�VQҏ��D�}<�G��G�y�0��]��F'�G!�ש�$Cm LhA��!��i?�h��,�dE��'ԏ��4��d�/G��Ps��nc��pDi��v,4��Ѣ$TCy��c|Ы5�-A�e A�5�]�N�<PS�a��w��Ў�bZ�E�꟯ x:i�Ɯ��I �!Y��\�4��n

Sections

CODE
Size: 439KB - Virtual size: 439KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cc135c93da243cc9b1615a2a9bd2886d

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

8e:18:34:16:de:03:f9:76:e8:a4:d7:48:a2:9e:0c:deCertificate

Extended Key Usages

Key Usages

fc:4f:67:0f:bc:e7:03:4f:15:31:26:28:ce:34:fe:62:3c:25:b1:e1Signer

Signature Validations

Verification

04/11/2022, 15:41 Valid: false

Headers

File Characteristics

Imports

user32

kernel32

comdlg32

oleaut32

winspool.drv

gdi32

version

ws2_32

comctl32

Exports

Exports

Sections

CODE Size: 439KB - Virtual size: 439KB

DATA Size: 20KB - Virtual size: 19KB

BSS Size: - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 3KB

.text0 Size: 15KB - Virtual size: 15KB

.tls Size: 512B - Virtual size: 24B

.text1 Size: 63KB - Virtual size: 62KB

.reloc Size: 5KB - Virtual size: 4KB

.rsrc Size: 53KB - Virtual size: 53KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

8e:18:34:16:de:03:f9:76:e8:a4:d7:48:a2:9e:0c:de
Certificate

fc:4f:67:0f:bc:e7:03:4f:15:31:26:28:ce:34:fe:62:3c:25:b1:e1
Signer

04/11/2022, 15:41
Valid: false

CODE
Size: 439KB - Virtual size: 439KB

DATA
Size: 20KB - Virtual size: 19KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.text0
Size: 15KB - Virtual size: 15KB

.tls
Size: 512B - Virtual size: 24B

.text1
Size: 63KB - Virtual size: 62KB

.reloc
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 53KB - Virtual size: 53KB