2a659f76a0d4f9d87b058338d90f8602fe79d0ccfb4014eea4fe88e8a8a8ce82

Sharing

Copy URL Twitter E-mail

General

Target

2a659f76a0d4f9d87b058338d90f8602fe79d0ccfb4014eea4fe88e8a8a8ce82
Size

1.6MB
MD5

2dabe1c58b9ffb6eab3c3c4cd76dcd9a
SHA1

980ef191f2ad1f570b59e23417b65dcdd049d674
SHA256

2a659f76a0d4f9d87b058338d90f8602fe79d0ccfb4014eea4fe88e8a8a8ce82
SHA512

f1348a7226926da6b9d93e2c7f9cdaff27274280c2847a0ada4e36983609e9f0a1512fd17df9c3c5b280da6642ef916865004a28e8f12ed78e4ab2f8e68e180b
SSDEEP

49152:bkVQwpOjkYFEI7nxOuwTu3hPFi4UinTZZhKCDC3f2+ygQg0keaD:gQwp1YFEI7nFwTuRPFrUiTZZ8lv2+ygV

Score

N/A

Malware Config

Signatures

Files

2a659f76a0d4f9d87b058338d90f8602fe79d0ccfb4014eea4fe88e8a8a8ce82
.exe windows x86

5573b7c7b9214092501359a60b66b4c2

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:32

Not After

01/09/2022, 18:32

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:c0:33:ed:56:a8:8b:bb:4c:7e:50:c8:0a:fe:34:bc:bb:9a:bd:2e:f4:76:ea:41:b6:29:fe:2a:0b:7b:10:a1
Signer

Actual PE Digest

67:c0:33:ed:56:a8:8b:bb:4c:7e:50:c8:0a:fe:34:bc:bb:9a:bd:2e:f4:76:ea:41:b6:29:fe:2a:0b:7b:10:a1

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

17/11/2022, 13:28
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempFileNameA
GetTickCount
GetProfileIntA
Sleep
SearchPathA
VirtualProtect
FindResourceExW
GetCommandLineA
HeapSetInformation
HeapAlloc
HeapFree
RaiseException
RtlUnwind
DecodePointer
EncodePointer
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
ExitThread
CreateThread
HeapQueryInformation
HeapSize
ExitProcess
GetSystemTimeAsFileTime
SetStdHandle
GetFileType
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoW
HeapCreate
QueryPerformanceCounter
IsValidCodePage
IsProcessorFeaturePresent
GetTimeZoneInformation
GetStringTypeW
LCMapStringW
CompareStringW
GetConsoleCP
GetConsoleMode
WriteConsoleW
CreateFileW
SetEnvironmentVariableA
GetCurrentDirectoryA
lstrcpyA
GetOEMCP
GetCPInfo
GetACP
GetUserDefaultUILanguage
GetLocaleInfoA
InterlockedExchange
GetFileTime
GetFileSizeEx
GetFileAttributesA
FileTimeToLocalFileTime
GetFileAttributesExA
GetNumberFormatA
FreeResource
GlobalFindAtomA
GlobalDeleteAtom
GetVersionExA
LoadLibraryW
lstrcmpW
GlobalFlags
GlobalAddAtomA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
LoadLibraryA
lstrcmpiA
WaitForSingleObject
GetCurrentThreadId
ResumeThread
SetThreadPriority
FileTimeToSystemTime
lstrcmpA
GlobalGetAtomNameA
InterlockedIncrement
GetModuleHandleW
CompareStringA
GetModuleHandleA
GetProcAddress
FreeLibrary
InterlockedDecrement
GetModuleFileNameW
ReleaseActCtx
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
GetModuleFileNameA
ActivateActCtx
DeactivateActCtx
GlobalFree
CopyFileA
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
lstrlenW
MultiByteToWideChar
MulDiv
lstrlenA
GetLastError
SetLastError
GetWindowsDirectoryA
WinExec
GetTempPathA
WriteFile
FindResourceA
CreateFileA
CloseHandle
FindResourceW
SizeofResource
LockResource
LoadResource
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte

msimg32

TransparentBlt
AlphaBlend

comctl32

ImageList_GetIconSize

shlwapi

PathFindExtensionA
PathFindFileNameA
PathIsUNCA
PathStripToRootA
PathRemoveFileSpecW

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

gdiplus

GdipFree
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdipAlloc

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundA

user32

CreateAcceleratorTableA
SetRect
SetCursorPos
BringWindowToTop
LockWindowUpdate
GetKeyNameTextA
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
LoadImageW
IsCharLowerA
MapVirtualKeyExA
UnionRect
UpdateLayeredWindow
MonitorFromPoint
IsMenu
TranslateAcceleratorA
InsertMenuItemA
LoadAcceleratorsA
LoadMenuA
ReuseDDElParam
UnpackDDElParam
PostThreadMessageA
WaitMessage
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
CreateMenu
SetMenuDefaultItem
IsClipboardFormatAvailable
FrameRect
GetUpdateRect
RegisterClipboardFormatA
CopyIcon
CharUpperBuffA
GetDoubleClickTime
SubtractRect
MapDialogRect
DrawIcon
DestroyCursor
GetWindowRgn
GetIconInfo
OffsetRect
MessageBeep
NotifyWinEvent
EnableScrollBar
HideCaret
DrawFocusRect
InvertRect
ReleaseCapture
GetAsyncKeyState
SetCapture
MapVirtualKeyA
IsRectEmpty
CreatePopupMenu
RedrawWindow
IntersectRect
KillTimer
SetTimer
InvalidateRect
DeleteMenu
ShowOwnedPopups
SetCursor
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SystemParametersInfoA
DestroyMenu
GetMenuItemInfoA
InflateRect
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
PostQuitMessage
IsIconic
RegisterWindowMessageA
LoadIconW
LoadIconA
WinHelpA
IsChild
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
LoadAcceleratorsW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
UpdateWindow
GetClientRect
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
SetWindowPlacement
GetWindowPlacement
DefWindowProcA
CallWindowProcA
GetMenu
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuA
EnableMenuItem
CheckMenuItem
SetWindowPos
ShowWindow
MoveWindow
SetWindowLongA
IsWindow
IsDialogMessageA
SendDlgItemMessageA
GetDlgItem
CheckDlgButton
GetScrollPos
SetScrollPos
SetFocus
GetFocus
GetDesktopWindow
RealChildWindowFromPoint
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
SetWindowTextA
CharUpperA
DestroyIcon
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
GetWindowTextLengthA
GetWindowTextA
LoadCursorA
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
CopyAcceleratorTableA
DrawFrameControl
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnhookWindowsHookEx
GetWindowThreadProcessId
SendMessageA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
DrawEdge
DrawStateA
GetSystemMenu
LoadMenuW
SetClassLongA
WindowFromPoint
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
DrawIconEx
GetNextDlgGroupItem
LoadImageA
SetActiveWindow
CopyImage
RemoveMenu
GetSubMenu
GetMenuItemCount
InsertMenuA
GetMenuDefaultItem

gdi32

GetObjectA
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
GetLayout
SetLayout
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
BitBlt
GetPixel
DeleteDC
CreatePatternBrush
CreateCompatibleDC
PtVisible
RectVisible
TextOutA
ExtTextOutA
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateSolidBrush
CreateHatchBrush
CreateFontIndirectA
GetTextExtentPoint32A
SetBkColor
SetTextColor
CreateRectRgnIndirect
GetTextMetricsA
EnumFontFamiliesA
GetTextCharsetInfo
SetRectRgn
CombineRgn
PatBlt
DPtoLP
GetBkColor
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
CreateDIBSection
CreateRoundRectRgn
CreatePolygonRgn
GetTextColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
SetDIBColorTable
StretchBlt
SetPixel
Rectangle
OffsetRgn
GetRgnBox
EnumFontFamiliesExA
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
SetPixelV
GetTextFaceA
CreateBitmap
CreateCompatibleBitmap
DeleteObject
CreateDCA
CopyMetaFileA
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
CreateDIBitmap
GetDeviceCaps
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
SetViewportExtEx

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

comdlg32

GetFileTitleA

advapi32

RegQueryValueExA
RegEnumKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey

shell32

SHAppBarMessage
DragQueryFileA
DragFinish
SHBrowseForFolderA
ShellExecuteA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetDesktopFolder
SHGetFileInfoA

ole32

OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateStreamOnHGlobal
CoInitializeEx
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
RevokeDragDrop

oleaut32

VariantClear
VariantChangeType
SysStringLen
SysAllocStringLen
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
VariantInit
SysAllocString
SysFreeString

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 249KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5573b7c7b9214092501359a60b66b4c2

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

67:c0:33:ed:56:a8:8b:bb:4c:7e:50:c8:0a:fe:34:bc:bb:9a:bd:2e:f4:76:ea:41:b6:29:fe:2a:0b:7b:10:a1Signer

Signature Validations

Verification

17/11/2022, 13:28 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msimg32

comctl32

shlwapi

oleacc

gdiplus

imm32

winmm

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 249KB - Virtual size: 249KB

.data Size: 21KB - Virtual size: 50KB

.rsrc Size: 149KB - Virtual size: 149KB

.reloc Size: 160KB - Virtual size: 159KB

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

67:c0:33:ed:56:a8:8b:bb:4c:7e:50:c8:0a:fe:34:bc:bb:9a:bd:2e:f4:76:ea:41:b6:29:fe:2a:0b:7b:10:a1
Signer

17/11/2022, 13:28
Valid: false

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 249KB - Virtual size: 249KB

.data
Size: 21KB - Virtual size: 50KB

.rsrc
Size: 149KB - Virtual size: 149KB

.reloc
Size: 160KB - Virtual size: 159KB