2489ec51840953ab074d58b4fe8296908b79de7c6baceda3f96961d3277bab05

Sharing

Copy URL Twitter E-mail

General

Target

2489ec51840953ab074d58b4fe8296908b79de7c6baceda3f96961d3277bab05
Size

609KB
MD5

3b3c7d310034bb78a81787225e130880
SHA1

4e15c9e6d3992a42b88d69d7b0794a81441ec457
SHA256

2489ec51840953ab074d58b4fe8296908b79de7c6baceda3f96961d3277bab05
SHA512

6036c73f6d0720a6006977e52d4f5fd2ec50aae39667ee41e66e889c2a295bef5cae6f2faa82fd2e37ae4473e2040196ae32b6b77c35427018a1d8271148b73e
SSDEEP

12288:ue9NKP6cWm0KovAWdbjUEwDH0vpOtwMN0iNaMJ:jZRrJvAYjUPQctHN0iN

Score

N/A

Malware Config

Signatures

Files

2489ec51840953ab074d58b4fe8296908b79de7c6baceda3f96961d3277bab05
.exe windows x86

d791ec0960b62edcdf4882442ff7d044

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9c:a0:be:54:a9:51:63:64:68:0a:d4:5d:64:08:c6:a2
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2015, 00:00

Not After

02/05/2016, 23:59

Subject

CN=SBIS,O=SBIS,POSTALCODE=150001,STREET=PR-T MOSKOVSKIJ\, 12,L=YAROSLAVL,ST=YAROSLAVL REGION,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4a:93:82:6c:52:0a:fe:eb:99:e3:14:9d:ab:cd:8f:d3:e3:ef:a1:3b
Signer

Actual PE Digest

4a:93:82:6c:52:0a:fe:eb:99:e3:14:9d:ab:cd:8f:d3:e3:ef:a1:3b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=SBIS,O=SBIS,POSTALCODE=150001,STREET=PR-T MOSKOVSKIJ\, 12,L=YAROSLAVL,ST=YAROSLAVL REGION,C=RU

04/11/2022, 15:40
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

LoadIconA
UpdateWindow
GetDCEx
MapVirtualKeyA
GetUserObjectInformationA
DrawCaption
EnumClipboardFormats
GetInputDesktop
GetMenuItemCount
DrawIcon
BroadcastSystemMessageA
CharToOemW
SetScrollRange
GetIconInfo
FlashWindow
PrivateExtractIconsW
SetParent
PeekMessageA
SetMenuItemInfoA
SystemParametersInfoA
DestroyWindow
GetMenuDefaultItem
GetThreadDesktop
ShowStartGlass
IsCharAlphaW
SetDeskWallpaper
IsMenu
CallMsgFilterW
CloseDesktop
LoadMenuIndirectA
SetWindowTextA
IsCharUpperA
SendMessageA
CallWindowProcA
PtInRect
SendDlgItemMessageA
TranslateAcceleratorW
PrivateExtractIconExA
ActivateKeyboardLayout
EditWndProc
GetClassNameA
OemKeyScan
CharNextW
LoadKeyboardLayoutW
GetWindowContextHelpId
IsZoomed
GetClipboardData
GetInternalWindowPos
IsCharLowerA
GetTabbedTextExtentW
CreateDialogParamW
MonitorFromWindow
PostThreadMessageA
CharNextA
EndDialog
GetCapture
RedrawWindow
LockWindowUpdate
ChangeDisplaySettingsW
SetWindowsHookA
EndTask
GetUpdateRgn
DrawIconEx
GetKeyNameTextW
LoadAcceleratorsA
FillRect
SetMenuItemBitmaps
DestroyCursor
ClipCursor
CreateMenu
SetPropW
GetTabbedTextExtentA
ChangeDisplaySettingsExW
DragObject
SetCaretPos
GetWindowTextW
SetWindowWord
InsertMenuItemW

kernel32

WriteConsoleOutputW
HeapSize
FreeConsole
WriteFileGather
lstrcmpW
OpenWaitableTimerA
lstrlen
SetWaitableTimer
GetVolumeNameForVolumeMountPointW
SetTimeZoneInformation
FlushConsoleInputBuffer
LoadResource
FatalAppExitA
GetEnvironmentVariableW
GetProfileSectionA
VerifyVersionInfoA
GlobalUnlock
GetDateFormatW
GetStringTypeExA
WritePrivateProfileStringA
HeapQueryInformation
ExitThread
SetInformationJobObject
GetSystemDefaultUILanguage
FindFirstFileExW
ExpandEnvironmentStringsW
FindFirstVolumeMountPointW
SetThreadPriority
GetDriveTypeW
RemoveDirectoryW
lstrcpyW
GetVolumePathNameA
CompareStringA
GetNamedPipeHandleStateW
GetTempPathW
GetFileAttributesW
SetTapePosition
UnlockFileEx
WaitForDebugEvent
HeapUnlock
GlobalGetAtomNameW
AllocConsole
GetCurrentActCtx
ReplaceFileA
LZStart
GetConsoleHardwareState
GetVolumePathNameW
GetPrivateProfileStructW
FileTimeToDosDateTime
GetNumberOfConsoleMouseButtons
GetLargestConsoleWindowSize
FindFirstFileExA
CreateTimerQueue
GetPrivateProfileStringW
GetProcessWorkingSetSize
GetLastError
CallNamedPipeA
ClearCommBreak
SetThreadPriorityBoost
HeapAlloc
GetConsoleSelectionInfo
ChangeTimerQueueTimer
RemoveDirectoryA
SetVolumeMountPointW
GetCPInfo
GetProcessHeap
GetLastError
ConvertDefaultLocale
VirtualQuery
LoadLibraryA
GetCurrentProcessId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

ole32

CoTreatAsClass
HMETAFILE_UserMarshal
HACCEL_UserUnmarshal

comdlg32

PageSetupDlgW

oleaut32

VarCyAbs
VarUI8FromDec

shell32

Control_RunDLLA

advapi32

RegCreateKeyA
GetInheritanceSourceW
LsaFreeMemory
GetSecurityDescriptorOwner

gdi32

CreateHatchBrush

comctl32

ImageList_SetFlags
ImageList_GetIcon
CreateStatusWindowA

Exports

Exports

EPK�e�iW]I*�:Z��C��_��3<��h!V�}�Q�\��Q�DijT�a�e��ҹa��Lm��Y��|[�T<��M��R��'��<��7/�f�� h<[��uT��ʠ�]��Zqæ�o�*�zUx�ō}��G�nWB!Qے��ݐK�)�v��,��@l�渨#�sa�ڙQ�)�r2�ДZi��2��^n�F�ߙ��`�� #K;�C�� t�W`�uiaVl^5�1�h\��W��ٛq��8+6��R��?�6rD�e�:ĵ3%�3��`��ȁ�P3,��~��v�97�4��zaΏ�'n��*nJ�NY9e_��9�H��ö�ば'��q�ݸ$]ALg�!G��}P��J0�>b`~��1��.�.O|szRTrp�#:S��z��ݯe��32�R��xJ��&'��S��?�X��*�)h�썕?�!W�|��1�]L={u �^�aG�)�0 ��R�0�7�jKu#ʩ��(,�c�/�ݚ��{�6U��/�7m��g1��D l�wU��8�P��ԃ��E��\ppT8T�4;�.O�>�;��=�j��nNσ�E]��pKwAg|q��D�ڣ��w��E;d�안z�Kjׯs�Gc��ePx��H4eͰ��t��f��w&��/��S� &�8��cpQ ��K��n�D��٩>ZV��ʪ��/�hR��N�V��6.��IQ/��]c!|��V^uL�VZ��4q��(;��}�ʭ�D[�}�P��7[;��H1�+>�9�で`=�e�� R&�%�?�Q8y~CȌx8��WO��^Ļ$�>@��8��`�Bh#rw�8��I|�ݼE��؛�>�,��. �$Tԫ_G�Z6G�x�oJ�O�9!a��4]�){+�]�|�G�,�*&�s�M�Úvm��i�V�RJq� ��J�5u�Ѽd��_r--!D��,k��'�&3 �L��A�^�"~'c*�-v=Ei�9P)<�7i�'?ST�'�zXh�}U��^"�r��U:��b�`��GD��.� !17�㲮 ��kth�n4sc_�Ҵ-D��NS��T�⁜��T��-ee��m��A�C*࡯� C�%f��I'��H�6��P�M��9+�l��vRb�%��j�Jc�C!=�yaExEUo� �_p*��|\�0��yi:5&I=�-��p��Y�g!�� 5=y��U�G�\��SY�0o9Eש<Z�� ҫK��<��a��gt��)r"7e��X��Y}��S�)��~i_�64��s�Hv��X�n*K��1~�h/�[z�*��Qy�yҶ%��!��S�JA�'�~��d� &�l433|�K�1��0�S�[��^��]��̐��gD��W��wI{��> )|-ޯ|0��H��^�1��T��9;v?��+�Z��]r��`��#�S)�R��#E�C�~��A��w��`��J��w��l�c�Wc�^_�G��r�C2�`�)tX�e��^;\a�.��{��-��A�\�,8@�~&&&��H|ļ�.�g�S}נݿ�޹�LE�N�87X`+��/~�$��<��Q]*2n7��y{p�ʶ�֟�V��-��wП7k�)f\�k��3f��o8��t��@��l:��An��q��נ42+s�*�#2�𱡚��q��p4�"��p��2�$#˅��G��t�|R�7��/g��Z��q�@j8��G��U�S�� ~��z t��w(9^4x��է�c��{.KPfE��(TS�D�)��z��|,��V��Y�-��3Ʌa��̬��An�l�J�m�� 9b��<s��0�U�j��7�m�4|�F�ީ�%D�zw�V��ktO^��軾��"��_��H.�[o�樢�q�B�.\R��(��N�_�\z��w�'NdճH��T��S�8�Xj �7�[lX�V��u3�Ź�j��N'��$-'�� 9冟l��/��iO��%�P�E6e��_{$�k�Ϥ��Q'��t# E��$��s��"v{nS{��x��ض��lӞ�U�^��En�?&�^ +�4-�#?U]w�ӌ A0�"��`��N��v*��:�� oS��Ĵx<�M�Χ�=��n�,E2�D�\��,0oU��/G~�d�Rxޑsw[�t��:�A!�ѽYv�"��J#��}�;��v��xU4~(ep��\��E�õMT��;p�Oh�*d�'k��A'�sl��{��1"T�yOQ�2�W�z=R�icں'�L��J�gg�k��b�H�ru��X![v]�H4A��^��\w=��E�`硂VйUv�̝^g�Y�k5Թm9� 8�OE��0-��h�m�/��˛��Q��%F9x�˰^��MQd7S�4��L��KP��%��?�"%\}�9��H��W|lj8�� ه��v9�V��vFM� *��ʌC;��8�s�V��`��NX0ȸq�.K��6��A*�/��_^l|#m ��&F��%NlpVyW��?.mYe|E��TВW4R��L>(��$��m C��]��:~_�;�V�y�*˳��򎘵��!+��;F��Go�ב��:�.e&j?O#+��e�6bZh�F��-��L��S��ZW%�97TF)ȉ��G��nz�b.C?�G=�� [��r6�+�.' (c��)��r�x^�kμ>�-ҵ��CJ��A�&8;~M��V%!��^b��"��K��؆o��͵��rKG�a��_aᵷ�6� 8Y�:A%4al

Sections

CODE
Size: 441KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d791ec0960b62edcdf4882442ff7d044

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

9c:a0:be:54:a9:51:63:64:68:0a:d4:5d:64:08:c6:a2Certificate

Extended Key Usages

Key Usages

4a:93:82:6c:52:0a:fe:eb:99:e3:14:9d:ab:cd:8f:d3:e3:ef:a1:3bSigner

Signature Validations

Verification

04/11/2022, 15:40 Valid: false

Headers

File Characteristics

Imports

user32

kernel32

ole32

comdlg32

oleaut32

shell32

advapi32

gdi32

comctl32

Exports

Exports

Sections

CODE Size: 441KB - Virtual size: 440KB

DATA Size: 16KB - Virtual size: 16KB

BSS Size: - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.text0 Size: 16KB - Virtual size: 16KB

.tls Size: 512B - Virtual size: 24B

.text1 Size: 65KB - Virtual size: 64KB

.reloc Size: 5KB - Virtual size: 5KB

.rsrc Size: 53KB - Virtual size: 53KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

9c:a0:be:54:a9:51:63:64:68:0a:d4:5d:64:08:c6:a2
Certificate

4a:93:82:6c:52:0a:fe:eb:99:e3:14:9d:ab:cd:8f:d3:e3:ef:a1:3b
Signer

04/11/2022, 15:40
Valid: false

CODE
Size: 441KB - Virtual size: 440KB

DATA
Size: 16KB - Virtual size: 16KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.text0
Size: 16KB - Virtual size: 16KB

.tls
Size: 512B - Virtual size: 24B

.text1
Size: 65KB - Virtual size: 64KB

.reloc
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 53KB - Virtual size: 53KB