e4bccf61294c5e791bfa73b86aa793b0e534094feb7e011acc86206f6066fa33

Sharing

Copy URL Twitter E-mail

General

Target

e4bccf61294c5e791bfa73b86aa793b0e534094feb7e011acc86206f6066fa33
Size

1.2MB
MD5

1ae34ad38514441143a666435c1f0562
SHA1

974e48c16c20136f49e587e9c82b9a4812d13364
SHA256

e4bccf61294c5e791bfa73b86aa793b0e534094feb7e011acc86206f6066fa33
SHA512

5b5198cc3b0bd1634bfb8ed71d51facd56867993b39aa0f635d6a7b084bd124f955fa974d9ac8e4220eaaef6a4519bca02f7fcdfb991c9c3783cdbde7514b6f4
SSDEEP

24576:uNndFr5xfq2Sh8qJ2KANUpLUmN36fdWeANd/RgoCkycHPSW:od95H+gE36f9AH/WoCkFHPh

Score

N/A

Malware Config

Signatures

Files

e4bccf61294c5e791bfa73b86aa793b0e534094feb7e011acc86206f6066fa33
.exe windows x86

df5fa80cd4f0b55fe6762f965755eb84

Code Sign

0b:d0:b9:8e:9b:73:5a:33:b3:cf:02:71:ca:6f:1f:79
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

17/09/2014, 00:00

Not After

25/11/2015, 12:00

Subject

CN=Consortium ltd.,O=Consortium ltd.,L=Roseau,ST=Commonwealth of Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ad:b7:d2:ee:2c:c7:1b:30:6e:70:12:da:87:24:c7:d8:62:fd:af:1d
Signer

Actual PE Digest

ad:b7:d2:ee:2c:c7:1b:30:6e:70:12:da:87:24:c7:d8:62:fd:af:1d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Consortium ltd.,O=Consortium ltd.,L=Roseau,ST=Commonwealth of Dominica,C=DM

24/11/2022, 14:54
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_DragShowNolock
ImageList_EndDrag
ImageList_BeginDrag
ImageList_GetDragImage
ImageList_DrawEx
ImageList_Create
ImageList_Read
ImageList_Write
ImageList_GetIconSize
ImageList_SetIconSize
ImageList_Remove
ord17

version

VerQueryValueW

setupapi

SetupDiDestroyDeviceInfoList

wininet

InternetCloseHandle
HttpEndRequestA
InternetOpenA

kernel32

GetModuleHandleW
GetCommandLineW
ReadFile
GetCurrentProcess
CopyFileW
lstrcmpiW
GetTempPathW
GetWindowsDirectoryW
lstrcatW
SetCurrentDirectoryW
DeleteFileW
CreateDirectoryW
GetTempPathA
GetSystemInfo
FreeResource
InterlockedIncrement
GetCPInfo
SetFilePointer
FlushFileBuffers
SetStdHandle
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
HeapAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
HeapFree
CreateFileA
VirtualAlloc
ExitProcess
WriteFile
SetErrorMode
GetVersion
GetProcAddress
GetStringTypeW
CreateFileMappingA
CloseHandle
GetStartupInfoA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetVersionExA
GetCommandLineA
GetCurrentProcessId
GetLastError
GetTickCount
GetACP
GetOEMCP
LoadLibraryA
SetEndOfFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeExA

user32

GetWindowRect
GetWindowPlacement
GetWindowLongA
GetSystemMenu
MessageBoxA
GetSystemMetrics
ShowWindow
RegisterClassExA
GetClassNameA
GetCapture
GetClassInfoA
GetWindowTextA
GetWindowThreadProcessId
IntersectRect
InvalidateRect
IsChild
IsDialogMessageA
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
CharNextW

gdi32

CreatePen
ExcludeClipRect
SetEnhMetaFileBits
SetPixel
SetROP2
StretchBlt
UnrealizeObject
Rectangle
DeleteMetaFile
GetLogColorSpaceW
SetAbortProc
CreatePenIndirect
GetClipBox
DeleteEnhMetaFile
CreateFontIndirectA
TextOutW
DeleteObject
OffsetWindowOrgEx

comdlg32

ReplaceTextW
FindTextW
GetSaveFileNameA
GetOpenFileNameA
ChooseFontA
PageSetupDlgW

advapi32

RegCloseKey
RegQueryValueExW
RegCreateKeyExA

shell32

ShellExecuteA
StrStrIA
SHGetFileInfoW

ole32

OleInitialize
CoTaskMemAlloc

oleaut32

VarDecRound
VariantInit
VarRound
VarNumFromParseNum
VariantChangeType
SafeArrayCreate
SafeArrayRedim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayPutElement

Sections

.text
Size: 948KB - Virtual size: 947KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

code
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 152KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df5fa80cd4f0b55fe6762f965755eb84

Code Sign

0b:d0:b9:8e:9b:73:5a:33:b3:cf:02:71:ca:6f:1f:79Certificate

Extended Key Usages

Key Usages

ad:b7:d2:ee:2c:c7:1b:30:6e:70:12:da:87:24:c7:d8:62:fd:af:1dSigner

Signature Validations

Verification

24/11/2022, 14:54 Valid: false

Headers

File Characteristics

Imports

comctl32

version

setupapi

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 948KB - Virtual size: 947KB

code Size: 132KB - Virtual size: 131KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 12KB - Virtual size: 57KB

.rsrc Size: 152KB - Virtual size: 150KB

.reloc Size: 8KB - Virtual size: 6KB

0b:d0:b9:8e:9b:73:5a:33:b3:cf:02:71:ca:6f:1f:79
Certificate

ad:b7:d2:ee:2c:c7:1b:30:6e:70:12:da:87:24:c7:d8:62:fd:af:1d
Signer

24/11/2022, 14:54
Valid: false

.text
Size: 948KB - Virtual size: 947KB

code
Size: 132KB - Virtual size: 131KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 12KB - Virtual size: 57KB

.rsrc
Size: 152KB - Virtual size: 150KB

.reloc
Size: 8KB - Virtual size: 6KB