2d691458f0da59a17f223e0b5713b4ac31787f4d6a0247872b61faa050194d8e

Sharing

Copy URL

Twitter E-mail

General

Target

2d691458f0da59a17f223e0b5713b4ac31787f4d6a0247872b61faa050194d8e
Size

152KB
MD5

295c4d42982a34de1a2ac622d6c03cb3
SHA1

a89357e1778e984ce0b79beb384a0bc76bbafbdc
SHA256

2d691458f0da59a17f223e0b5713b4ac31787f4d6a0247872b61faa050194d8e
SHA512

7e1b1604aa8d10856959cca7ee2b96d3b66c78de9cd7ac9e3c0ff886350659d5f07b7862664a82e38a670ccdfd608f73d054bffc10892c966afb8afa242b5b79
SSDEEP

3072:9l0OwuMo5b2Me6yMXNaT47++6KNMvs1C8/ehoraNUXVpILPL:l5bVx6vs1C8/ehoraNUXELT

Score

N/A

Malware Config

Signatures

Files

2d691458f0da59a17f223e0b5713b4ac31787f4d6a0247872b61faa050194d8e
.exe windows x86

3be06fa35bcda060b4dd4af15668991f

Code Sign

bb:5c:b2:72:84:14:09:59:85:60:e8:77:68:48:bb:f4
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/12/2014, 00:00

Not After

01/12/2015, 23:59

Subject

CN=AcDc Project (BrightCircle Investments Limited),O=AcDc Project (BrightCircle Investments Limited),POSTALCODE=2025,STREET=Dasoupoli Strovolos+STREET=Athinodorou 3,L=Nicosia,ST=Nicosia,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f6:72:cb:a9:b1:ae:5d:f6:ed:92:28:80:ba:66:7f:e2:7e:89:c5:8c
Signer

Actual PE Digest

f6:72:cb:a9:b1:ae:5d:f6:ed:92:28:80:ba:66:7f:e2:7e:89:c5:8c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=AcDc Project (BrightCircle Investments Limited),O=AcDc Project (BrightCircle Investments Limited),POSTALCODE=2025,STREET=Dasoupoli Strovolos+STREET=Athinodorou 3,L=Nicosia,ST=Nicosia,C=CY

24/11/2022, 14:54
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCloseHandle
HttpOpenRequestW
HttpQueryInfoW
InternetSetOptionW
HttpSendRequestW
InternetConnectW
InternetReadFile
InternetCrackUrlW
InternetOpenW

kernel32

WriteConsoleW
SetStdHandle
SetFilePointerEx
GetStringTypeW
PeekNamedPipe
GetCurrentProcess
GetTickCount
GetMailslotInfo
GetModuleFileNameW
GetTimeZoneInformation
FlushFileBuffers
LoadLibraryA
GetFileType
GetModuleFileNameA
VirtualProtect
WriteProcessMemory
Sleep
CreateFileW
GetLastError
FindNextFileW
WaitForSingleObject
GetTempPathW
SetEndOfFile
ReadFile
GetProcAddress
HeapAlloc
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
CreateThread
GetCurrentThreadId
ExitThread
LoadLibraryExW
GetCommandLineW
RaiseException
RtlUnwind
IsProcessorFeaturePresent
InterlockedDecrement
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
HeapSize
GetStdHandle
WriteFile
HeapFree
ReadConsoleW
IsDebuggerPresent
InterlockedIncrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetConsoleCP
GetConsoleMode
CloseHandle
GetProcessHeap
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
OutputDebugStringW
LoadLibraryW
LCMapStringW

advapi32

RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA

shell32

ShellExecuteExW

Sections

.text
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 32.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3be06fa35bcda060b4dd4af15668991f

Code Sign

bb:5c:b2:72:84:14:09:59:85:60:e8:77:68:48:bb:f4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

f6:72:cb:a9:b1:ae:5d:f6:ed:92:28:80:ba:66:7f:e2:7e:89:c5:8cSigner

Signature Validations

Verification

24/11/2022, 14:54 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

wininet

kernel32

advapi32

shell32

Sections

.text Size: 106KB - Virtual size: 105KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 5KB - Virtual size: 32.0MB

bb:5c:b2:72:84:14:09:59:85:60:e8:77:68:48:bb:f4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

f6:72:cb:a9:b1:ae:5d:f6:ed:92:28:80:ba:66:7f:e2:7e:89:c5:8c
Signer

24/11/2022, 14:54
Valid: false

.text
Size: 106KB - Virtual size: 105KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 5KB - Virtual size: 32.0MB