c07ac26ed5ba7ca2584a27b8dd50602288ba0137ca67c44a8e6adf3f0085f25c

Sharing

Copy URL Twitter E-mail

General

Target

c07ac26ed5ba7ca2584a27b8dd50602288ba0137ca67c44a8e6adf3f0085f25c
Size

937KB
MD5

2da5d5b958b126a014d818fb1a24f51d
SHA1

f99f3b0cb69e3dd11dd737f32073a427d00a7d20
SHA256

c07ac26ed5ba7ca2584a27b8dd50602288ba0137ca67c44a8e6adf3f0085f25c
SHA512

2c88f442aca8db7466b0a5387a221b8b3ba84e27bf8038e35cb76e7a49a47b03790a6f9aa7b27f94651938d3ef937a877f85c9981df7e17ea3b9f9e8c10ef6f8
SSDEEP

12288:sF0ttgJhjRHX8G09sJNZcYttstpTcHz1pT1/Jow/1VDkOT6lDFCCUYwYltmG0fEm:sFFjs9q3c2it1cRJFXTD4a

Score

N/A

Malware Config

Signatures

Files

c07ac26ed5ba7ca2584a27b8dd50602288ba0137ca67c44a8e6adf3f0085f25c
.exe windows x86

388e3ea65baa1fd301e6a7ebac4b70bf

Code Sign

bf:31:2c:e6:5c:ca:7a:79:53:36:ee:ee:a4:f3:92:93
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/04/2014, 00:00

Not After

08/04/2016, 23:59

Subject

CN=Consortium Group ltd.,O=Consortium Group ltd.,POSTALCODE=00152,STREET=CORNER OF GR.MARLBOROUGH UN GR.GEORGE STR. ROSEAU\,DOMINICA\, 00152+STREET=3RD FLOOR\, C&h TOWERS,L=ROSEAU,ST=ROSEAU,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6f:34:14:cf:0c:d9:39:2b:56:d9:67:64:3c:62:c3:2b:b3:79:03:a5
Signer

Actual PE Digest

6f:34:14:cf:0c:d9:39:2b:56:d9:67:64:3c:62:c3:2b:b3:79:03:a5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Consortium Group ltd.,O=Consortium Group ltd.,POSTALCODE=00152,STREET=CORNER OF GR.MARLBOROUGH UN GR.GEORGE STR. ROSEAU\,DOMINICA\, 00152+STREET=3RD FLOOR\, C&h TOWERS,L=ROSEAU,ST=ROSEAU,C=DM

17/11/2022, 13:28
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCloseHandle
InternetConnectW
InternetOpenW
InternetCanonicalizeUrlW
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetReadFile

kernel32

GetProcAddress
GetSystemInfo
GetModuleHandleW
GetTempPathW
GetVersionExW
GetCurrentProcessId
QueryPerformanceCounter
GetTimeZoneInformation
GetOEMCP
GetACP
IsValidCodePage
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
GetModuleHandleA
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
OutputDebugStringW
VirtualProtect
WaitForMultipleObjects
VirtualAlloc
SetFilePointerEx
ReadFile
GetFileType
GetStdHandle
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
GetProcessHeap
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
CreateProcessW
GetModuleFileNameW
GetSystemTimeAsFileTime
CloseHandle
DeleteFileW
GetLastError
GetFileAttributesW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteConsoleW
SetStdHandle
ReadConsoleW
LoadLibraryW
CreateFileW
SetEndOfFile
VirtualFree
WideCharToMultiByte
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
SetEvent
CreateTimerQueue
DuplicateHandle
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
SetEnvironmentVariableA
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapFree
HeapReAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCPInfo
HeapAlloc
ExitProcess
GetModuleHandleExW
GetCommandLineW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
CreateSemaphoreW
CreateThread
ExitThread
LoadLibraryExW

user32

MoveWindow
GetMessageW
GetDlgItem
LoadStringW
LoadIconW
SetCursorPos
EndPaint
BeginPaint
UpdateWindow
EndDialog
DialogBoxParamW
RegisterClassExW
PostQuitMessage
DefWindowProcW
SystemParametersInfoW
ReleaseDC
GetDC
EnableWindow
FindWindowW
DestroyIcon
MessageBoxW
SetWindowTextW
TranslateAcceleratorW
LoadAcceleratorsW
DispatchMessageW
TranslateMessage
IsDlgButtonChecked
LoadCursorW
SetWindowLongW
GetWindowLongW
GetSysColor
SetCursor
RemovePropW
GetPropW
SetPropW
InvalidateRect
CallWindowProcW
SetWindowPos
ShowWindow
CreateWindowExW
PostMessageW
GetParent
GetWindowRect
GetClientRect
GetSystemMetrics
SendMessageW

gdi32

SelectObject
GetTextExtentPoint32W
GetObjectW
SetTextColor
GetStockObject
DeleteObject
CreateFontIndirectW
GetTextMetricsW

comdlg32

GetSaveFileNameW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegOpenCurrentUser
RegCloseKey

shell32

SHGetFolderPathW
ShellExecuteW
ShellExecuteExW
SHCreateDirectoryExW

ole32

CoUninitialize
CoInitialize

Sections

.text
Size: 657KB - Virtual size: 656KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

388e3ea65baa1fd301e6a7ebac4b70bf

Code Sign

bf:31:2c:e6:5c:ca:7a:79:53:36:ee:ee:a4:f3:92:93Certificate

Extended Key Usages

Key Usages

6f:34:14:cf:0c:d9:39:2b:56:d9:67:64:3c:62:c3:2b:b3:79:03:a5Signer

Signature Validations

Verification

17/11/2022, 13:28 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 657KB - Virtual size: 656KB

.rdata Size: 226KB - Virtual size: 226KB

.data Size: 22KB - Virtual size: 42KB

.rsrc Size: 28KB - Virtual size: 28KB

bf:31:2c:e6:5c:ca:7a:79:53:36:ee:ee:a4:f3:92:93
Certificate

6f:34:14:cf:0c:d9:39:2b:56:d9:67:64:3c:62:c3:2b:b3:79:03:a5
Signer

17/11/2022, 13:28
Valid: false

.text
Size: 657KB - Virtual size: 656KB

.rdata
Size: 226KB - Virtual size: 226KB

.data
Size: 22KB - Virtual size: 42KB

.rsrc
Size: 28KB - Virtual size: 28KB