ad08fe288bb34ac1c3b07a3b190d645e900e5c2ab5c76f16498ac73a5753f4f8

Sharing

Copy URL Twitter E-mail

General

Target

ad08fe288bb34ac1c3b07a3b190d645e900e5c2ab5c76f16498ac73a5753f4f8
Size

45KB
MD5

c3235876a2658f37107b4b0635e08447
SHA1

456fb3d1b3e93869a61353ea1e53581e37d5aace
SHA256

ad08fe288bb34ac1c3b07a3b190d645e900e5c2ab5c76f16498ac73a5753f4f8
SHA512

3ae57641a8b317130263f23ab3c696d60662609f3ba3c28602756ce447e5a55a6d877dae88c32c34acf8bdcf6de17f82358bc7d105cc462c30833781d07b2339
SSDEEP

768:wAYfkF7gjl/9fwIKDJEaQj7xQDwd8NAuD1pZbRFj49ZJYDFeiCgFeizid:9PtFIMEa67xQDxNAuDNbjCsFeiRFeiS

Score

N/A

Malware Config

Signatures

Files

ad08fe288bb34ac1c3b07a3b190d645e900e5c2ab5c76f16498ac73a5753f4f8
.dll windows x86

e7439c6b12636de073f4cd722bb013f0

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

1a:d6:1c:ab:09:e9:36:32:bc:a1:47:98:44:c3:49:6a
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

06/08/2018, 00:00

Not After

06/08/2019, 23:59

Subject

CN=BLADES,O=BLADES,POSTALCODE=WC2A 1AF,STREET=67 Chancery La,L=LONDON,ST=LONDON,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:d6:1c:ab:09:e9:36:32:bc:a1:47:98:44:c3:49:6a
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

06/08/2018, 00:00

Not After

06/08/2019, 23:59

Subject

CN=BLADES,O=BLADES,POSTALCODE=WC2A 1AF,STREET=67 Chancery La,L=LONDON,ST=LONDON,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:95:6d:ba:34:3c:0d:fa:6b:28:3b:2f:af:9e:26:f2:a6:62:25:ca:5a:d2:a3:2d:7f:6d:d7:70:e4:b7:84:b4
Signer

Actual PE Digest

41:95:6d:ba:34:3c:0d:fa:6b:28:3b:2f:af:9e:26:f2:a6:62:25:ca:5a:d2:a3:2d:7f:6d:d7:70:e4:b7:84:b4

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=BLADES,O=BLADES,POSTALCODE=WC2A 1AF,STREET=67 Chancery La,L=LONDON,ST=LONDON,C=GB

04/09/2018, 07:35
Valid: true

Chain 1

CN=BLADES,O=BLADES,POSTALCODE=WC2A 1AF,STREET=67 Chancery La,L=LONDON,ST=LONDON,C=GB

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

cc:95:2f:49:ad:ca:a6:84:b5:58:dc:9c:bf:f2:81:4f:33:f8:86:fa
Signer

Actual PE Digest

cc:95:2f:49:ad:ca:a6:84:b5:58:dc:9c:bf:f2:81:4f:33:f8:86:fa

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=BLADES,O=BLADES,POSTALCODE=WC2A 1AF,STREET=67 Chancery La,L=LONDON,ST=LONDON,C=GB

04/09/2018, 07:35
Valid: true

Chain 1

CN=BLADES,O=BLADES,POSTALCODE=WC2A 1AF,STREET=67 Chancery La,L=LONDON,ST=LONDON,C=GB

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlComputeCrc32
RtlRandom

kernel32

ResumeThread
GlobalAlloc
GlobalFree
lstrlenA
CloseHandle
VirtualFree
HeapFree
FreeLibrary
HeapAlloc
VirtualAlloc
LoadLibraryA
VirtualProtect
GetExitCodeProcess
WaitForSingleObject
lstrcatA
GetTickCount
Sleep
IsBadWritePtr
CreateThread
IsBadStringPtrA
SetLastError
GetModuleHandleA
ExitProcess
GetCommandLineW
DisableThreadLibraryCalls
VirtualQuery
HeapCreate
InterlockedCompareExchange
InterlockedExchange
HeapDestroy
SuspendThread
OpenThread
SetThreadContext
GetThreadContext
Thread32Next
HeapReAlloc
GetCurrentThreadId
GetCurrentProcessId
Thread32First
CreateToolhelp32Snapshot
GetVersion
FlushInstructionCache
GetCurrentProcess

user32

GetDlgItem
GetParent
GetDlgCtrlID
wsprintfA

msvcrt20

malloc
_initterm
??2@YAPAXI@Z
??3@YAXPAX@Z
_wcsdup
free
_strdup
strchr
memcpy
_adjust_fdiv

shlwapi

PathAddBackslashW
PathQuoteSpacesW
StrStrIA
StrChrA
StrCmpNIW
StrChrW
StrStrA
PathFindFileNameW
PathRemoveFileSpecW
SHGetValueW
SHSetValueW
StrTrimW

shell32

CommandLineToArgvW

imagehlp

MapFileAndCheckSumW

Exports

Exports

CreateTXT

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7439c6b12636de073f4cd722bb013f0

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

1a:d6:1c:ab:09:e9:36:32:bc:a1:47:98:44:c3:49:6aCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

1a:d6:1c:ab:09:e9:36:32:bc:a1:47:98:44:c3:49:6aCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

41:95:6d:ba:34:3c:0d:fa:6b:28:3b:2f:af:9e:26:f2:a6:62:25:ca:5a:d2:a3:2d:7f:6d:d7:70:e4:b7:84:b4Signer

Signature Validations

Verification

04/09/2018, 07:35 Valid: true

Chain 1

cc:95:2f:49:ad:ca:a6:84:b5:58:dc:9c:bf:f2:81:4f:33:f8:86:faSigner

Signature Validations

Verification

04/09/2018, 07:35 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

msvcrt20

shlwapi

shell32

imagehlp

Exports

Exports

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 4KB - Virtual size: 3KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

1a:d6:1c:ab:09:e9:36:32:bc:a1:47:98:44:c3:49:6a
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

1a:d6:1c:ab:09:e9:36:32:bc:a1:47:98:44:c3:49:6a
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

41:95:6d:ba:34:3c:0d:fa:6b:28:3b:2f:af:9e:26:f2:a6:62:25:ca:5a:d2:a3:2d:7f:6d:d7:70:e4:b7:84:b4
Signer

04/09/2018, 07:35
Valid: true

cc:95:2f:49:ad:ca:a6:84:b5:58:dc:9c:bf:f2:81:4f:33:f8:86:fa
Signer

04/09/2018, 07:35
Valid: true

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 4KB - Virtual size: 3KB