44d3e1e0d8a290ba3cc7dae858467563ff984e674959b0e5e3cd8d219fd82836

Sharing

Copy URL

Twitter E-mail

General

Target

44d3e1e0d8a290ba3cc7dae858467563ff984e674959b0e5e3cd8d219fd82836
Size

535KB
MD5

5c9634e893585b2aa1ee77d922f3273d
SHA1

88cb511d0d6ce6d5382dd23d1a088ae14e6cf188
SHA256

44d3e1e0d8a290ba3cc7dae858467563ff984e674959b0e5e3cd8d219fd82836
SHA512

3de3812a69490c2614199334acb8914ca9f0dbc3b3220891ad96941771e9faeef520a82db35c6e019ed796c6f2f943c3e88c222bf538605b1cdbb9726314601a
SSDEEP

12288:Yd4lxIhVL23bC9mozRgcsRw5HdywoyEPu/MGfSv8/HzLBOu5eQ:Xles3GgoRgIdNoqbfWWzLBDB

Score

N/A

Malware Config

Signatures

Files

44d3e1e0d8a290ba3cc7dae858467563ff984e674959b0e5e3cd8d219fd82836
.exe windows x86

8586051286db95629144135c0bfc5c3b

Code Sign

62:1b:f6:cb:de:0d:46:86:e2:82:4d:bd:e3:f3:bb:0a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-10-2012 00:00

Not After

29-11-2013 23:59

Subject

CN=Ingenieursbureau Matrix B.V.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Ingenieursbureau Matrix B.V.,L=Enschede,ST=Overijssel,C=NL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b7:89:80:c1:cd:c1:07:eb:39:7c:10:1b:2d:57:64:99:22:fa:c9:9d
Signer

Actual PE Digest

b7:89:80:c1:cd:c1:07:eb:39:7c:10:1b:2d:57:64:99:22:fa:c9:9d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Ingenieursbureau Matrix B.V.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Ingenieursbureau Matrix B.V.,L=Enschede,ST=Overijssel,C=NL

01-12-2022 14:34
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

InvertRect
OffsetRect
InvertRect
CharUpperW
GetDC
PtInRect
CallNextHookEx
GetSysColor
LoadBitmapA
IsChild
GetDlgItemTextW
InflateRect
PtInRect
BringWindowToTop
CharLowerA
UnionRect
GetScrollPos
TranslateMessage
PrivateExtractIconExA
GetSystemMetrics
CharPrevA
IntersectRect
GetCaretPos
LoadImageA
GetCursorFrameInfo
GetProcessWindowStation
DrawIcon
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCursor
GetWindowDC
GetWindowInfo
GetWindowLongA
GetWindowLongW

authz

AuthzAccessCheck

netapi32

DsGetDcNextA
DsGetDcNextW
DsGetDcOpenA
DsGetDcOpenW
DsGetDcSiteCoverageA
DsGetDcSiteCoverageW
DsGetForestTrustInformationW
DsGetSiteNameA
DsGetSiteNameW

duser

AutoTrace
AutoTrace

kernel32

_lread
GetLastError
CreateFileA
GetSystemDirectoryA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle

ole32

CreateStreamOnHGlobal
IsAccelerator
ReleaseStgMedium
OleDraw
OleSetMenuDescriptor
OleGetClipboard
OleSetClipboard
DoDragDrop
RevokeDragDrop
RegisterDragDrop
OleUninitialize
OleInitialize
CreateDataAdviseHolder
CoTaskMemFree
CoTaskMemAlloc
ProgIDFromCLSID
StringFromCLSID
CoCreateInstance
CoLockObjectExternal
CoDisconnectObject
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
CoGetMalloc
CoUninitialize
CoInitialize
IsEqualGUID

oleaut32

CreateErrorInfo
GetErrorInfo
SetErrorInfo
GetActiveObject
RegisterTypeLib
LoadTypeLib
VariantInit
SysFreeString

olepro32

OleCreatePropertyFrame

comctl32

ImageList_Duplicate
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControls

shell32

Shell_NotifyIconW
ShellExecuteExA
ShellExecuteW
ShellExecuteA
SHGetFileInfoW
SHFileOperationW
SHAppBarMessage
ExtractIconA
DragQueryFileA
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetPathFromIDListA
DragAcceptFiles
DragFinish

wininet

HttpSendRequestExA
InternetAttemptConnect
HttpEndRequestA
GetUrlCacheEntryInfoExW
InternetWriteFile
InternetSetOptionA
InternetSetCookieW
InternetReadFile
InternetQueryOptionA
InternetQueryDataAvailable
InternetOpenA
InternetGetCookieW
InternetErrorDlg
InternetCrackUrlA
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpQueryInfoA
HttpOpenRequestA
HttpAddRequestHeadersA
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
FindCloseUrlCache

urlmon

CoInternetCreateZoneManager
CoInternetCreateSecurityManager
CoInternetGetSession
CreateURLMoniker

comdlg32

PrintDlgA
ChooseFontA
ChooseColorA
GetSaveFileNameW
GetSaveFileNameA
GetOpenFileNameW
GetOpenFileNameA

Sections

.text
Size: 6KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 498KB

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 514KB - Virtual size: 520KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8586051286db95629144135c0bfc5c3b

Code Sign

62:1b:f6:cb:de:0d:46:86:e2:82:4d:bd:e3:f3:bb:0aCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

b7:89:80:c1:cd:c1:07:eb:39:7c:10:1b:2d:57:64:99:22:fa:c9:9dSigner

Signature Validations

Verification

01-12-2022 14:34 Valid: false

Headers

File Characteristics

Imports

user32

authz

netapi32

duser

kernel32

ole32

oleaut32

olepro32

comctl32

shell32

wininet

urlmon

comdlg32

Sections

.text Size: 6KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 498KB

.rsrc Size: 514KB - Virtual size: 520KB

62:1b:f6:cb:de:0d:46:86:e2:82:4d:bd:e3:f3:bb:0a
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

b7:89:80:c1:cd:c1:07:eb:39:7c:10:1b:2d:57:64:99:22:fa:c9:9d
Signer

01-12-2022 14:34
Valid: false

.text
Size: 6KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 498KB

.rsrc
Size: 514KB - Virtual size: 520KB