4f88629f192e4948d5aaf089a70078785820d3942d7fbf01e52d9de556719779

Sharing

Copy URL Twitter E-mail

General

Target

4f88629f192e4948d5aaf089a70078785820d3942d7fbf01e52d9de556719779
Size

338KB
MD5

4ee637640bd8b59e982209004ad20543
SHA1

d61078b8b782ae21ba992e2e92bf7ed99ee86c90
SHA256

4f88629f192e4948d5aaf089a70078785820d3942d7fbf01e52d9de556719779
SHA512

e31175ed5741fc4e7576844b5ed83fec2f99a417ad110cf7071f99da0d733325bea38bc3a7cd4c22a264f8b12a26077bd3ba71fc7b91af04915099f662b419b3
SSDEEP

6144:XXnIcTNhMSQDXKvJMgtL7IoFfAorcvlbz3WyApN8C2KVse9wSB6wqgj2:HNhiDXKvJ92oOlbjdENhxj2

Score

N/A

Malware Config

Signatures

Files

4f88629f192e4948d5aaf089a70078785820d3942d7fbf01e52d9de556719779
.exe windows x86

895b950496e488fcdb8663bc5af725e9

Code Sign

78:38:42:51:70:c8:af:b0:47:32:40:b8:ff:e3:b4:e9
Certificate

Issuer

CN=muilaaybclt

Not Before

01/07/2012, 06:06

Not After

31/12/2039, 23:59

Subject

CN=Oldfg

67:c4:95:07:a0:6f:5e:4a:29:a6:ed:07:53:38:56:ef:7c:ac:61:f0
Signer

Actual PE Digest

67:c4:95:07:a0:6f:5e:4a:29:a6:ed:07:53:38:56:ef:7c:ac:61:f0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

NO CERTIFICATE

01/01/0001, 00:00
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetParent
GetForegroundWindow
ShowWindowAsync
EnumThreadWindows
GetParent
EndDialog
MessageBoxA
ChildWindowFromPoint
GetNextDlgGroupItem

advapi32

ReportEventA
SetTokenInformation
RegSetValueExA
RegisterEventSourceA
NotifyChangeEventLog
PrivilegeCheck
ReportEventW
RegConnectRegistryA

kernel32

VirtualAlloc
GetLastError
TlsSetValue
LocalReAlloc
LocalLock
TlsGetValue
GetModuleHandleA
GetACP
GetStartupInfoA
WriteProfileSectionA
GetPrivateProfileIntA
GetProcAddress

winspool.drv

DeviceCapabilitiesA
GetPrinterDriverA
GetPrinterA
DeletePrinterDriverA
AddPrintProcessorA
AddPrintProcessorW
AddPrinterA
AddPrinterConnectionA
DeletePrinterDataA
DeletePrinterDriverExW
EnumPrintProcessorsW
DeletePrinter

msvcrt

exit
_XcptFilter
_exit
_except_handler3
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
_controlfp
_acmdln
__set_app_type
__p__fmode

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 313KB - Virtual size: 313KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

895b950496e488fcdb8663bc5af725e9

Code Sign

78:38:42:51:70:c8:af:b0:47:32:40:b8:ff:e3:b4:e9Certificate

67:c4:95:07:a0:6f:5e:4a:29:a6:ed:07:53:38:56:ef:7c:ac:61:f0Signer

Signature Validations

Verification

01/01/0001, 00:00 Valid: false

Headers

File Characteristics

Imports

user32

advapi32

kernel32

winspool.drv

msvcrt

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 313KB - Virtual size: 313KB

.data Size: 512B - Virtual size: 103KB

.rsrc Size: 7KB - Virtual size: 7KB

78:38:42:51:70:c8:af:b0:47:32:40:b8:ff:e3:b4:e9
Certificate

67:c4:95:07:a0:6f:5e:4a:29:a6:ed:07:53:38:56:ef:7c:ac:61:f0
Signer

01/01/0001, 00:00
Valid: false

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 313KB - Virtual size: 313KB

.data
Size: 512B - Virtual size: 103KB

.rsrc
Size: 7KB - Virtual size: 7KB