e73057042415637a8a4a0c6075de776a168e69229b91e2802f2d80946026437f

Sharing

Copy URL

Twitter E-mail

General

Target

e73057042415637a8a4a0c6075de776a168e69229b91e2802f2d80946026437f
Size

3.7MB
MD5

4cfcb3953f4f41537fa5d1306f8909ba
SHA1

3039d358d22519f24021f53b01a511b61990505d
SHA256

e73057042415637a8a4a0c6075de776a168e69229b91e2802f2d80946026437f
SHA512

67e10cadceabcbd48deff0dbfe6ad294a3e084a64ef3f7bc25c4cfee1cf0d6ba43b8d03edeac80d12308abd4eac136174ef9abc74a86ec777b3d2b0f5d8c27ec
SSDEEP

98304:HYua2oT/y2oHCoAqPinoaWBxazxTrTi2O:la2kF+pO96L

Score

N/A

Malware Config

Signatures

Files

e73057042415637a8a4a0c6075de776a168e69229b91e2802f2d80946026437f
.exe windows x86

bd26c7917d3523953dc4c98f53be824d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:6a:d4:4a:46:42:fb:73:94:2c:a2:b9:2d:eb:3d:34
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

20-04-2006 00:00

Not After

22-06-2009 23:59

Subject

CN=Nero AG,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LEGAL DEPARTMENT,O=Nero AG,L=Karlsbad,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:92:26:49:94:25:53:38:68:2a:fc:e2:94:7d:f3:56:38:0b:6d:85
Signer

Actual PE Digest

ca:92:26:49:94:25:53:38:68:2a:fc:e2:94:7d:f3:56:38:0b:6d:85

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Nero AG,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LEGAL DEPARTMENT,O=Nero AG,L=Karlsbad,ST=Baden Wuerttemberg,C=DE

28-11-2022 11:52
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shfolder

SHGetFolderPathA

setupapi

SetupDiGetDeviceInstanceIdA
CM_Disconnect_Machine
SetupDiDestroyClassImageList
CM_Get_DevNode_Registry_PropertyA
CM_Get_DevNode_Registry_Property_ExA
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
CM_Connect_MachineA
SetupDiGetClassImageList
CM_Locate_DevNode_ExA
CM_Get_Sibling_Ex
SetupDiGetClassImageIndex
SetupDiGetClassDescriptionA
CM_Get_Child_Ex

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

winmm

waveOutGetDevCapsA
waveOutGetNumDevs

msvfw32

ICOpen
ICGetInfo
ICClose
ICInfo

msacm32

acmDriverDetailsA
acmDriverEnum

rpcrt4

UuidFromStringA

kernel32

GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
EnumResourceLanguagesA
ConvertDefaultLocale
WritePrivateProfileStringA
VirtualProtect
GetFileSize
GetFileTime
GetThreadLocale
SetFilePointer
lstrcmpW
LockFile
UnlockFile
SetEndOfFile
GetVolumeInformationA
GetFullPathNameA
GlobalFlags
SetErrorMode
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
RtlUnwind
HeapAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapReAlloc
VirtualAlloc
VirtualQuery
GetStartupInfoA
WriteConsoleW
GetFileType
GetStdHandle
ExitThread
CreateThread
SetStdHandle
ExitProcess
HeapSize
GetACP
IsValidCodePage
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetHandleCount
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LoadLibraryW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
SetEnvironmentVariableA
ReleaseMutex
SuspendThread
GetCurrentThreadId
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleFileNameW
lstrcmpA
RaiseException
GetTickCount
FreeResource
GetSystemDefaultLangID
SetEvent
IsBadReadPtr
GlobalAlloc
GlobalFree
GetFileAttributesA
GetUserDefaultLangID
GetLongPathNameA
SetThreadLocale
GlobalMemoryStatus
FindNextFileA
RemoveDirectoryA
GetLocaleInfoA
lstrcatA
WinExec
lstrcpyA
LoadLibraryExA
SetThreadPriority
ResumeThread
QueryPerformanceFrequency
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
lstrcpynA
GlobalLock
GlobalUnlock
CreateMutexA
GetCommandLineA
GetEnvironmentVariableA
lstrlenA
CompareStringW
lstrlenW
QueryPerformanceCounter
GetCurrentThread
InterlockedExchange
CompareStringA
DuplicateHandle
ReadFile
GetSystemInfo
GetUserDefaultUILanguage
GetCurrentProcess
FindFirstFileA
FindClose
CreateDirectoryA
SetFileAttributesA
GetModuleFileNameA
GetWindowsDirectoryA
DeleteFileA
SetLastError
MulDiv
LocalAlloc
GetVersion
FormatMessageA
LocalFree
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
GetTempPathA
MultiByteToWideChar
GetCurrentProcessId
GetComputerNameA
lstrcmpiA
GetModuleHandleA
GetSystemDirectoryA
GetProcAddress
QueryDosDeviceA
CreateEventA
ResetEvent
WaitForSingleObject
GetLastError
FreeLibrary
GetLogicalDrives
GetDriveTypeA
DeviceIoControl
GetVersionExA
GetProcessHeap
HeapFree
FindResourceExA
CreateFileA
WriteFile
CloseHandle
Sleep
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
FlushFileBuffers
InterlockedCompareExchange

user32

GetAsyncKeyState
PostQuitMessage
GetNextDlgGroupItem
SetWindowContextHelpId
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
ShowWindow
MoveWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
EnableMenuItem
CheckMenuItem
SendDlgItemMessageA
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetWindowTextLengthA
GetForegroundWindow
SetActiveWindow
GetDlgItem
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetScrollPos
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
DefWindowProcA
CallWindowProcA
GetWindowPlacement
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GetWindowThreadProcessId
GetLastActivePopup
SetFocus
InvalidateRgn
EqualRect
IntersectRect
CopyAcceleratorTableA
SetWindowsHookExA
DestroyMenu
PeekMessageA
ValidateRect
UnhookWindowsHookEx
GetMenuState
GetMenuStringA
SetWindowTextA
GetWindowTextA
IsWindowEnabled
IsDialogMessageA
WinHelpA
IsChild
MessageBeep
DrawFocusRect
ModifyMenuA
GetSubMenu
GetMenuItemID
GetMenuItemCount
SendMessageA
GetSystemMetrics
wsprintfA
MessageBoxA
GetDC
IsWindowVisible
GetSysColorBrush
DestroyWindow
GetKeyState
SetWindowPos
MapDialogRect
IsRectEmpty
IsMenu
GetWindowLongA
GetClassNameA
GetMenu
GetWindow
GetDesktopWindow
GetMessageA
ReleaseCapture
SetWindowLongA
SetCapture
GetCapture
RegisterWindowMessageA
GetFocus
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
InflateRect
CopyRect
PostMessageA
FrameRect
GetCursorPos
ScreenToClient
OffsetRect
SetRectEmpty
SetRect
PtInRect
DestroyCursor
CopyIcon
FillRect
CreateIconIndirect
ReleaseDC
GetIconInfo
TranslateMessage
DispatchMessageA
ShowScrollBar
WindowFromPoint
CharNextA
UnregisterClassA
RegisterClipboardFormatA
PostThreadMessageA
GetActiveWindow
GetWindowRect
GetClientRect
EnableWindow
DestroyIcon
SystemParametersInfoA
GetSysColor
IsWindow
CharUpperA
LoadAcceleratorsA
TranslateAcceleratorA
DrawIcon
AppendMenuA
GetSystemMenu
IsIconic
InvalidateRect
LoadCursorA
LoadIconA
LoadImageA
GetDlgCtrlID
UpdateWindow
RedrawWindow
SetTimer
KillTimer
SetCursor
BringWindowToTop
SetForegroundWindow
GetParent
EnableScrollBar
CallNextHookEx

gdi32

ExtSelectClipRgn
GetTextColor
GetMapMode
DPtoLP
EnumFontFamiliesExA
ScaleWindowExtEx
SetWindowExtEx
GetBkColor
Rectangle
SetMapMode
StartDocA
SetTextAlign
EndPage
StartPage
EndDoc
SelectClipRgn
FrameRgn
CreateRoundRectRgn
TextOutA
SetTextJustification
GetTextMetricsA
SetBkMode
SetBkColor
SetTextColor
CreateCompatibleBitmap
CreatePen
MoveToEx
LineTo
CreateBitmap
StretchBlt
GetStockObject
CreateSolidBrush
GetTextExtentPoint32A
GetDeviceCaps
GetObjectA
CreateFontA
CreateFontIndirectA
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
CreateDIBSection
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
DeleteObject
GetWindowExtEx
GetViewportExtEx
GetClipBox
SetStretchBltMode
RestoreDC
SaveDC
GetRgnBox
CreateRectRgnIndirect
GetTextExtentPointA
SetDIBitsToDevice
SelectPalette
CreateDIBitmap
CreatePalette
RealizePalette
Escape
ExtTextOutA
RectVisible
PtVisible

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

InitializeSid
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyA
CloseServiceHandle
CryptAcquireContextA
CryptEncrypt
CryptImportKey
CryptReleaseContext
RegOpenCurrentUser
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
GetSidLengthRequired
RegCloseKey
GetSidSubAuthority
CheckTokenMembership
IsValidSid
GetLengthSid
CopySid
OpenThreadToken
OpenProcessToken
DuplicateToken
RegEnumKeyA
OpenSCManagerA
EnumServicesStatusA
OpenServiceA
QueryServiceConfigA

shell32

ShellExecuteA
SHGetFileInfoA

comctl32

ord17
ImageList_GetIcon
ImageList_GetImageCount
_TrackMouseEvent

shlwapi

PathStripToRootA
PathFindFileNameA
PathFindExtensionA
PathFileExistsA
PathIsDirectoryA
PathIsUNCA

oledlg

ord8

ole32

CoRegisterMessageFilter
CoTaskMemAlloc
CoInitializeSecurity
OleInitialize
OleUninitialize
CoTaskMemFree
StringFromGUID2
CoInitialize
CoUninitialize
CoCreateInstance
OleFlushClipboard
OleIsCurrentClipboard
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoSetProxyBlanket
CoRevokeClassObject
CoFreeUnusedLibraries
CLSIDFromProgID
CLSIDFromString
CoInitializeEx
CreateILockBytesOnHGlobal

oleaut32

VariantChangeType
SysAllocString
SysAllocStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
SysAllocStringLen
GetErrorInfo
SysStringLen
SafeArrayDestroy
OleCreateFontIndirect
VariantClear
VariantCopy
VariantInit
SysFreeString

userenv

UnloadUserProfile

Sections

.text
Size: 996KB - Virtual size: 995KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd26c7917d3523953dc4c98f53be824d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

2a:6a:d4:4a:46:42:fb:73:94:2c:a2:b9:2d:eb:3d:34Certificate

Extended Key Usages

Key Usages

ca:92:26:49:94:25:53:38:68:2a:fc:e2:94:7d:f3:56:38:0b:6d:85Signer

Signature Validations

Verification

28-11-2022 11:52 Valid: false

Headers

File Characteristics

Imports

shfolder

setupapi

version

winmm

msvfw32

msacm32

rpcrt4

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

userenv

Sections

.text Size: 996KB - Virtual size: 995KB

.rdata Size: 260KB - Virtual size: 259KB

.data Size: 88KB - Virtual size: 108KB

.rsrc Size: 2.2MB - Virtual size: 2.2MB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

2a:6a:d4:4a:46:42:fb:73:94:2c:a2:b9:2d:eb:3d:34
Certificate

ca:92:26:49:94:25:53:38:68:2a:fc:e2:94:7d:f3:56:38:0b:6d:85
Signer

28-11-2022 11:52
Valid: false

.text
Size: 996KB - Virtual size: 995KB

.rdata
Size: 260KB - Virtual size: 259KB

.data
Size: 88KB - Virtual size: 108KB

.rsrc
Size: 2.2MB - Virtual size: 2.2MB