General

Malware Config

Signatures

Files

• 1faa29d93e78faf53e5c2116a38ae4ccbef5b3bf19ec7218ef0661c09a84606b

  .exe windows x86

  0dc3d8d0e82920dd8f1327d99bb87ef9

  
  

  Code Sign

  44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  09-07-1999 18:31

  Not After

  09-07-2019 18:40

  Subject

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  KeyUsageCertSign

  KeyUsageCRLSign

  10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  24-08-2011 00:00

  Not After

  30-05-2020 10:48

  Subject

  CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7a:4e:8d:b3:e9:af:3e:c2:ff:7e:d3:a1:9d:f0:da:e5

  Certificate

  Issuer

  CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  29-08-2014 00:00

  Not After

  29-08-2015 23:59

  Subject

  CN=Investmarket,O=Investmarket,POSTALCODE=123022,STREET=Zvenigorodskoye shosse\, 1\, 1,L=Moscow,ST=Moscow,C=RU

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  a0:71:24:df:65:a5:8d:92:cf:40:b5:1d:75:95:af:bd:12:c9:91:1b

  Signer

  Actual PE Digest

  a0:71:24:df:65:a5:8d:92:cf:40:b5:1d:75:95:af:bd:12:c9:91:1b

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Investmarket,O=Investmarket,POSTALCODE=123022,STREET=Zvenigorodskoye shosse\, 1\, 1,L=Moscow,ST=Moscow,C=RU

  24-11-2022 14:54

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  lstrcpyW

  IsProcessorFeaturePresent

  HeapReAlloc

  GetStringTypeW

  MultiByteToWideChar

  LCMapStringW

  HeapSize

  Sleep

  ConvertDefaultLocale

  GetOEMCP

  GetACP

  GetCPInfo

  HeapAlloc

  EnterCriticalSection

  LeaveCriticalSection

  RtlUnwind

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  LoadLibraryA

  GetProcAddress

  GetProcessHandleCount

  GetLastError

  IsValidCodePage

  LoadLibraryW

  GetTickCount

  QueryPerformanceCounter

  InterlockedDecrement

  GetCurrentThreadId

  SetLastError

  InterlockedIncrement

  TlsFree

  TlsSetValue

  TlsGetValue

  HeapFree

  GetCommandLineA

  HeapSetInformation

  GetStartupInfoW

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  HeapCreate

  DecodePointer

  EncodePointer

  GetModuleHandleW

  ExitProcess

  WriteFile

  GetStdHandle

  GetModuleFileNameW

  GetModuleFileNameA

  FreeEnvironmentStringsW

  WideCharToMultiByte

  GetEnvironmentStringsW

  SetHandleCount

  InitializeCriticalSectionAndSpinCount

  GetFileType

  DeleteCriticalSection

  TlsAlloc

  user32

  EndDeferWindowPos

  EndPaint

  GetWindow

  SetActiveWindow

  IsIconic

  DeleteMenu

  LoadBitmapA

  LoadIconA

  GetWindowRect

  DrawIcon

  GetClientRect

  SendMessageA

  BeginPaint

  GetDC

  GetForegroundWindow

  CreateWindowExA

  RedrawWindow

  GetDesktopWindow

  EnumWindowStationsW

  DeferWindowPos

  BeginDeferWindowPos

  GetSystemMetrics

  gdi32

  GetObjectA

  CreateSolidBrush

  SetTextJustification

  advapi32

  RegOpenKeyExA

  winmm

  mciSendCommandA

  shlwapi

  StrNCatA

  secur32

  AcquireCredentialsHandleA

  powrprof

  GetPwrCapabilities

  Sections

  .text

  Size: 67KB - Virtual size: 67KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 166KB - Virtual size: 166KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 12KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 31KB - Virtual size: 31KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ