ad37a82d768e388dda9b00dbd42c4212ccc7184b2eec18c8f5d3c24a6cee3029

Sharing

Copy URL Twitter E-mail

General

Target

ad37a82d768e388dda9b00dbd42c4212ccc7184b2eec18c8f5d3c24a6cee3029
Size

1.8MB
MD5

9b3e87a7332afe082b55d65bd13d547e
SHA1

15e651bcecfc2f010be4e7ebbaa5bce6be81318a
SHA256

ad37a82d768e388dda9b00dbd42c4212ccc7184b2eec18c8f5d3c24a6cee3029
SHA512

e2c2504ed55854ddd4f114a017f90d27360b7fe76b698a5eea49d57eded4560db1150989bbb6b2c578a4dca55310cb487bfd42e5022e8485d154f2a7db16921d
SSDEEP

24576:xYPUietXzTghPYwy7GEmAgZ4fnr8lZwqAME9uYdoNjl4:xY8ieVghBK4umwqAMEYYdujl

Score

N/A

Malware Config

Signatures

Files

ad37a82d768e388dda9b00dbd42c4212ccc7184b2eec18c8f5d3c24a6cee3029
.exe windows x64

5dc79a5abef660439e13f54893b68ab7

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:cc:d5:47:72:09:47:8c:50:8b:a4:f7:56:5f:67:71
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

21/08/2017, 00:00

Not After

02/09/2020, 12:00

Subject

CN=Digital Extremes Ltd.,OU=IT,O=Digital Extremes Ltd.,L=London,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c196365727473406469676974616c65787472656d65732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b6:6c:30:1c:8d:d0:c9:4d:37:65:6e:f4:5a:d7:9d:23:66:f2:dc:3e
Signer

Actual PE Digest

b6:6c:30:1c:8d:d0:c9:4d:37:65:6e:f4:5a:d7:9d:23:66:f2:dc:3e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Digital Extremes Ltd.,OU=IT,O=Digital Extremes Ltd.,L=London,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c196365727473406469676974616c65787472656d65732e636f6d

05/03/2020, 13:13
Valid: true

Chain 1

CN=Digital Extremes Ltd.,OU=IT,O=Digital Extremes Ltd.,L=London,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c196365727473406469676974616c65787472656d65732e636f6d

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FlushFileBuffers
WaitForSingleObject
GetDiskFreeSpaceExW
VirtualAlloc
CreateEventW
GetOverlappedResult
VirtualFree
IsDebuggerPresent
GetExitCodeThread
GetProcAddress
ReplaceFileW
SetEndOfFile
FindClose
RemoveDirectoryW
GetVolumePathNameW
GetVolumeInformationW
GetFullPathNameW
CreateProcessW
ExitProcess
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
GetShortPathNameW
GetExitCodeProcess
TerminateProcess
IsWow64Process
GetCurrentProcess
GetSystemInfo
GlobalMemoryStatusEx
K32EnumPageFilesW
CreatePipe
DuplicateHandle
CreateSemaphoreA
ReleaseSemaphore
WaitForMultipleObjects
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FormatMessageW
GetFileAttributesW
FindResourceW
SizeofResource
LoadResource
LockResource
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetLastError
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
WriteConsoleW
HeapSize
GetFileSizeEx
GetProcessHeap
SetEnvironmentVariableW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetTimeZoneInformation
EnumSystemLocalesW
SetFilePointerEx
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetModuleHandleExW
ExitThread
GetFileType
SetStdHandle
RtlPcToFileHeader
RtlUnwindEx
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
InitializeSListHead
GetCurrentProcessId
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
ResetEvent
SetEvent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
DecodePointer
DeleteFileW
OutputDebugStringW
MultiByteToWideChar
WriteFile
CloseHandle
CreateMutexW
GetModuleHandleW
ReadFile
GetFileInformationByHandle
CreateFileW
FreeConsole
GetConsoleWindow
GetStdHandle
AllocConsole
Sleep
GetStartupInfoW
WideCharToMultiByte
FindNextFileW
GetLastError
MoveFileExW
FindFirstFileW
FreeLibrary
LoadLibraryW
MulDiv
GetVersionExW
GetComputerNameExW
EnumSystemLanguageGroupsW
EncodePointer
GetTickCount
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
GetCurrentThreadId
QueryPerformanceCounter
LoadLibraryExA
VirtualQuery
VirtualProtect
RaiseException
GetUserDefaultLangID
GetCommandLineW
GetModuleFileNameW
GetUserDefaultLCID

user32

PostMessageW
SetWindowTextW
ShowWindow
GetWindowLongPtrW
SetWindowLongPtrW
DestroyWindow
PostQuitMessage
TrackMouseEvent
InvalidateRect
DialogBoxParamW
CallWindowProcW
SetCapture
BeginPaint
IntersectRect
GetKeyState
DrawTextExW
OffsetRect
EndPaint
DefWindowProcW
GetDC
ReleaseDC
EnableWindow
EndDialog
MoveWindow
GetParent
GetWindowRect
SendMessageW
GetDlgItem
GetWindowLongW
IsWindowEnabled
LoadImageW
MapWindowPoints
CreateDialogParamW
EnumWindows
IsChild
GetWindow
KillTimer
GetDlgItemTextW
SetDlgItemTextW
MessageBoxExW
SetWindowsHookExW
GetWindowThreadProcessId
CallNextHookEx
GetClientRect
UnregisterClassW
IsIconic
SetForegroundWindow
UnhookWindowsHookEx
DispatchMessageW
TranslateMessage
IsWindow
IsDialogMessageW
GetMessageW
PeekMessageW
AdjustWindowRectEx
SystemParametersInfoW
RegisterClassW
LoadCursorW
IsRectEmpty
ReleaseCapture
SetWindowPos
ClientToScreen
SetScrollInfo
GetScrollInfo
SetFocus
ScreenToClient
SetTimer
LoadIconW
GetWindowTextW
GetSystemMetrics
CreateWindowExW
GetClassInfoExW

gdi32

GetStockObject
CreateFontW
GetDeviceCaps
GetObjectA
SetBitmapDimensionEx
DeleteObject
Rectangle
CreateSolidBrush
CreateCompatibleBitmap
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
SelectObject
CreateCompatibleDC
DeleteDC

advapi32

CryptAcquireContextW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
CreateProcessWithLogonW
CryptReleaseContext
RegOpenKeyExW
RegDeleteValueW

shell32

ShellExecuteW
SHGetFolderPathW
SHFileOperationW
ShellExecuteExW
SHCreateDirectoryExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHChangeNotify

ole32

CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoInitializeEx
CoGetObject

oleaut32

VariantChangeType
VariantClear
VariantInit
SysAllocString
SysFreeString

winmm

joySetCapture
timeGetTime

comctl32

ord17

crypt32

CryptBinaryToStringW

msimg32

AlphaBlend

uxtheme

SetWindowTheme

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

wininet

InternetAttemptConnect
InternetQueryOptionW
InternetCanonicalizeUrlW
HttpQueryInfoW
HttpOpenRequestW
InternetSetOptionW
InternetReadFileExA
InternetConnectW
InternetCrackUrlW
InternetCloseHandle
HttpSendRequestW
InternetReadFile
InternetOpenW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Sections

.text
Size: 909KB - Virtual size: 908KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 343KB - Virtual size: 343KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shr
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 558KB - Virtual size: 557KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5dc79a5abef660439e13f54893b68ab7

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0d:cc:d5:47:72:09:47:8c:50:8b:a4:f7:56:5f:67:71Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

b6:6c:30:1c:8d:d0:c9:4d:37:65:6e:f4:5a:d7:9d:23:66:f2:dc:3eSigner

Signature Validations

Verification

05/03/2020, 13:13 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

winmm

comctl32

crypt32

msimg32

uxtheme

wtsapi32

wininet

version

Sections

.text Size: 909KB - Virtual size: 908KB

.rdata Size: 343KB - Virtual size: 343KB

.data Size: 17KB - Virtual size: 41KB

.pdata Size: 45KB - Virtual size: 45KB

.shr Size: 512B - Virtual size: 8B

.rsrc Size: 558KB - Virtual size: 557KB

.reloc Size: 11KB - Virtual size: 10KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0d:cc:d5:47:72:09:47:8c:50:8b:a4:f7:56:5f:67:71
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

b6:6c:30:1c:8d:d0:c9:4d:37:65:6e:f4:5a:d7:9d:23:66:f2:dc:3e
Signer

05/03/2020, 13:13
Valid: true

.text
Size: 909KB - Virtual size: 908KB

.rdata
Size: 343KB - Virtual size: 343KB

.data
Size: 17KB - Virtual size: 41KB

.pdata
Size: 45KB - Virtual size: 45KB

.shr
Size: 512B - Virtual size: 8B

.rsrc
Size: 558KB - Virtual size: 557KB

.reloc
Size: 11KB - Virtual size: 10KB