abc38f78fedf485e439db403fc869754a5dfb058b6b0f4fefe495b2be2952c32

Sharing

Copy URL Twitter E-mail

General

Target

abc38f78fedf485e439db403fc869754a5dfb058b6b0f4fefe495b2be2952c32
Size

2.4MB
MD5

4b7863040fcead6cd287b4989f66f126
SHA1

e7d6f93dbf5064f1e61300544800bfd5a59e23a0
SHA256

abc38f78fedf485e439db403fc869754a5dfb058b6b0f4fefe495b2be2952c32
SHA512

5e990024ad1f02c9abe47885363849f6e5d56ef20b186cae29800b7edbfdeb7ac7c52a29142cc782471783289f30ce15906968a487afaa5eda66a908e1d0d0b9
SSDEEP

49152:2SAthoBalcqexDYtNIMOXZMDYfB9GiKPdAaT5ipvJ9vK:UwBdWIVXeDYXtfK

Score

N/A

Malware Config

Signatures

Files

abc38f78fedf485e439db403fc869754a5dfb058b6b0f4fefe495b2be2952c32
.exe windows x64

a749b52d33bbaabe5cfce7cdd34ed1c7

Code Sign

07
Certificate

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:11:1d:1e:c8:a0:7c:82:67:42:94:8a:ea:09:bd:e9
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/10/2018, 00:00

Not After

10/10/2020, 23:59

Subject

CN=Hola Networks Ltd,O=Hola Networks Ltd,POSTALCODE=42570,STREET=3 Hamachshev st.,L=Natanya,ST=IL,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:26

Not After

15/08/2023, 20:36

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

85:fb:77:b2:e1:59:11:97
Certificate

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

17/09/2019, 07:00

Not After

17/09/2024, 07:00

Subject

CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2b:3e:3d:f8:dd:ad:db:da:fd:04:49:ad:22:82:6c:b5:13:91:f8:2a
Signer

Actual PE Digest

2b:3e:3d:f8:dd:ad:db:da:fd:04:49:ad:22:82:6c:b5:13:91:f8:2a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Hola Networks Ltd,O=Hola Networks Ltd,POSTALCODE=42570,STREET=3 Hamachshev st.,L=Natanya,ST=IL,C=IL

02/01/2020, 10:41
Valid: true

Chain 1

CN=Hola Networks Ltd,O=Hola Networks Ltd,POSTALCODE=42570,STREET=3 Hamachshev st.,L=Natanya,ST=IL,C=IL

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wininet

InternetSetOptionW
InternetQueryOptionW

advapi32

CreateProcessAsUserW
RegNotifyChangeKeyValue
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetKeySecurity
RegSetValueExW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
StartServiceW
OpenProcessToken
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
ReportEventA
RegisterEventSourceA
SetNamedSecurityInfoW
SetEntriesInAclW

ws2_32

inet_addr
__WSAFDIsSet
accept
bind
closesocket
connect
ioctlsocket
getpeername
WSASetLastError
WSAGetLastError
WSAIoctl
WSAEventSelect
WSACleanup
WSAStartup
socket
shutdown
setsockopt
sendto
send
select
recvfrom
recv
listen
getsockopt
getsockname
gethostbyname

kernel32

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FindFirstFileExW
HeapSize
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
FlushFileBuffers
FreeEnvironmentStringsW
GetModuleFileNameA
GetProcessHeap
GetStartupInfoW
RemoveDirectoryW
CreateDirectoryW
GetCurrentDirectoryW
SetEnvironmentVariableW
WaitForSingleObjectEx
OpenProcess
FatalAppExitW
GetModuleHandleW
ReleaseMutex
WaitForSingleObject
CreateMutexW
ProcessIdToSessionId
GlobalFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
Thread32First
Thread32Next
Module32FirstW
Module32NextW
IsDebuggerPresent
CheckRemoteDebuggerPresent
CloseHandle
RaiseException
SetUnhandledExceptionFilter
GetLastError
Sleep
TerminateProcess
SetEnvironmentVariableA
DuplicateHandle
QueueUserAPC
SetConsoleCtrlHandler
GetEnvironmentStringsW
CreateProcessW
WTSGetActiveConsoleSessionId
GetModuleFileNameW
LocalFree
CreateFileW
FindClose
FindFirstFileW
FindNextFileW
CreateNamedPipeW
CancelIo
OutputDebugStringW
GetProcAddress
LoadLibraryW
GetTempPathW
ReadFile
ReadFileEx
WriteFile
WriteFileEx
SetHandleInformation
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
SleepEx
CreateEventW
GetTickCount
GetComputerNameExW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TerminateThread
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
UnregisterWaitEx
RegisterWaitForSingleObject
GetModuleHandleA
GetVersion
GetFileType
GetStdHandle
RtlVirtualUnwind
SetLastError
MultiByteToWideChar
FlushConsoleInputBuffer
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
FreeLibrary
LoadLibraryA
SystemTimeToFileTime
GetSystemTime
GetFileAttributesExW
FormatMessageW
GetFileInformationByHandle
CompareStringW
LCMapStringW
GetFullPathNameW
SetFileTime
GetFileAttributesW
GetCommandLineA
EncodePointer
DecodePointer
DeleteFileW
SetFilePointerEx
GetConsoleCP
ReadConsoleW
WriteConsoleW
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
IsProcessorFeaturePresent
LoadLibraryExW
ExitThread
CreateThread
SetStdHandle
GetSystemTimeAsFileTime
GetSystemTimeAdjustment
GetTimeZoneInformation
GetStringTypeW
FileTimeToLocalFileTime
GetExitCodeProcess
SetEndOfFile
ExitProcess
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte
HeapFree
HeapAlloc
HeapReAlloc
MoveFileExW

userenv

CreateEnvironmentBlock

shell32

SHGetFolderPathW
ShellExecuteW
Shell_NotifyIconW

ntdll

NtCreateFile
RtlInitUnicodeString
NtTestAlert
NtFsControlFile
NtQuerySystemInformation
NtMapViewOfSection
NtUnmapViewOfSection
NtDeviceIoControlFile
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
NtCreateSection

iphlpapi

GetAdaptersInfo

psapi

GetModuleInformation
EnumProcessModules
GetModuleFileNameExW

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod

user32

GetMenuItemCount
AppendMenuW
RemoveMenu
TrackPopupMenu
InsertMenuItemW
SetMenuItemInfoW
UpdateWindow
SetForegroundWindow
GetClientRect
GetCursorPos
FindWindowExW
LoadCursorW
DestroyMenu
LoadImageW
TranslateMessage
DispatchMessageW
PeekMessageW
CreatePopupMenu
AttachThreadInput
BringWindowToTop
GetForegroundWindow
GetWindowTextW
GetWindowTextLengthW
GetWindowLongW
SystemParametersInfoW
MsgWaitForMultipleObjectsEx
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
PostMessageW
SendMessageW
GetWindowThreadProcessId
EnumWindows
ShowWindow
MessageBoxW
GetQueueStatus
LoadIconW

wtsapi32

WTSQueryUserToken

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512KB - Virtual size: 511KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 155KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a749b52d33bbaabe5cfce7cdd34ed1c7

Code Sign

07Certificate

Key Usages

41:11:1d:1e:c8:a0:7c:82:67:42:94:8a:ea:09:bd:e9Certificate

Extended Key Usages

Key Usages

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35Certificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

85:fb:77:b2:e1:59:11:97Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

2b:3e:3d:f8:dd:ad:db:da:fd:04:49:ad:22:82:6c:b5:13:91:f8:2aSigner

Signature Validations

Verification

02/01/2020, 10:41 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

wininet

advapi32

ws2_32

kernel32

userenv

shell32

ntdll

iphlpapi

psapi

winmm

user32

wtsapi32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 512KB - Virtual size: 511KB

.data Size: 155KB - Virtual size: 182KB

.pdata Size: 76KB - Virtual size: 76KB

.tls Size: 13KB - Virtual size: 13KB

.rsrc Size: 332KB - Virtual size: 332KB

.reloc Size: 28KB - Virtual size: 28KB

07
Certificate

41:11:1d:1e:c8:a0:7c:82:67:42:94:8a:ea:09:bd:e9
Certificate

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

85:fb:77:b2:e1:59:11:97
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

2b:3e:3d:f8:dd:ad:db:da:fd:04:49:ad:22:82:6c:b5:13:91:f8:2a
Signer

02/01/2020, 10:41
Valid: true

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 512KB - Virtual size: 511KB

.data
Size: 155KB - Virtual size: 182KB

.pdata
Size: 76KB - Virtual size: 76KB

.tls
Size: 13KB - Virtual size: 13KB

.rsrc
Size: 332KB - Virtual size: 332KB

.reloc
Size: 28KB - Virtual size: 28KB