ab8f836f57294f3e2f813c054c7e67671eda27a02d430b4e54fb7544be553d27

Sharing

Copy URL Twitter E-mail

General

Target

ab8f836f57294f3e2f813c054c7e67671eda27a02d430b4e54fb7544be553d27
Size

737KB
MD5

4cfecf83beeac938b77fb1b4bf6d5167
SHA1

8a101b14d0091aa71159a1123cf8f1ee07ed7c6c
SHA256

ab8f836f57294f3e2f813c054c7e67671eda27a02d430b4e54fb7544be553d27
SHA512

9a61b840c4e5c0fc980e1ee8ae3c0928b76e471b10f0795f66829f0dbc0d0200367a897ada833ca7448493bf17a7ed9068e8128a34c95eac0193e0f518976324
SSDEEP

12288:uMgjbulAofkRVe1SGWDc+37ot6hbgqDY+r+Xedhqh4etkG:q20e1SGWDcWCWUXjhfL

Score

N/A

Malware Config

Signatures

Files

ab8f836f57294f3e2f813c054c7e67671eda27a02d430b4e54fb7544be553d27
.exe windows x86

bf8e7e377e5effcec40b2338e521193b

Code Sign

2c:96:d0:77:55:df:5a:35:4f:a3:cd:41:a1:90:e5:22
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

14/11/2016, 00:00

Not After

19/07/2017, 23:59

Subject

CN=OOO \"Meti-Vostok\",O=OOO \"Meti-Vostok\",POSTALCODE=107113,STREET=Street Rybinsk I-3\, Building 18,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19/01/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:d2:7a:f0:ca:b8:52:72:cb:0f:69:ae:d1:cf:b0:bf:35:64:8b:0b:8d:d1:55:67:d0:7b:0c:34:37:d4:a6:58
Signer

Actual PE Digest

19:d2:7a:f0:ca:b8:52:72:cb:0f:69:ae:d1:cf:b0:bf:35:64:8b:0b:8d:d1:55:67:d0:7b:0c:34:37:d4:a6:58

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=OOO \"Meti-Vostok\",O=OOO \"Meti-Vostok\",POSTALCODE=107113,STREET=Street Rybinsk I-3\, Building 18,L=Moscow,ST=Moscow,C=RU

04/11/2022, 15:42
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetThreadPriority
GetPriorityClass
VirtualAlloc
ResumeThread
SetEvent
FreeLibrary
GetFileSize
CloseHandle
SuspendThread
Sleep
OpenEventW
LoadLibraryA
CreateMutexA
SetFileAttributesA
SetFileAttributesW
GetFileAttributesA
TerminateProcess
CreateDirectoryW
GetTickCount
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
WriteFile
RtlUnwind
HeapFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapReAlloc
HeapAlloc
GetCurrentProcess
HeapSize
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
GetStringTypeW

user32

ShowWindow
MessageBoxA
DestroyWindow
WaitForInputIdle
SendMessageA

winscard

SCardForgetReaderW
SCardGetAttrib

ws2_32

gethostbyname
recv

Sections

.text
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.code
Size: 4KB - Virtual size: 117B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 636KB - Virtual size: 636KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf8e7e377e5effcec40b2338e521193b

Code Sign

2c:96:d0:77:55:df:5a:35:4f:a3:cd:41:a1:90:e5:22Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9dCertificate

Key Usages

19:d2:7a:f0:ca:b8:52:72:cb:0f:69:ae:d1:cf:b0:bf:35:64:8b:0b:8d:d1:55:67:d0:7b:0c:34:37:d4:a6:58Signer

Signature Validations

Verification

04/11/2022, 15:42 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

winscard

ws2_32

Sections

.text Size: 16KB - Virtual size: 12KB

.code Size: 4KB - Virtual size: 117B

.rdata Size: 68KB - Virtual size: 64KB

.data Size: 636KB - Virtual size: 636KB

.rsrc Size: 4KB - Virtual size: 920B

2c:96:d0:77:55:df:5a:35:4f:a3:cd:41:a1:90:e5:22
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

19:d2:7a:f0:ca:b8:52:72:cb:0f:69:ae:d1:cf:b0:bf:35:64:8b:0b:8d:d1:55:67:d0:7b:0c:34:37:d4:a6:58
Signer

04/11/2022, 15:42
Valid: false

.text
Size: 16KB - Virtual size: 12KB

.code
Size: 4KB - Virtual size: 117B

.rdata
Size: 68KB - Virtual size: 64KB

.data
Size: 636KB - Virtual size: 636KB

.rsrc
Size: 4KB - Virtual size: 920B