c3a5621a522967a7d7c6a9dba78de329319d8629627e35797de7f13a30c5eda1

Sharing

Copy URL Twitter E-mail

General

Target

c3a5621a522967a7d7c6a9dba78de329319d8629627e35797de7f13a30c5eda1
Size

330KB
MD5

de0e6ce1ef3d188f27112da878454e84
SHA1

b20efe49d93226ada576c54b84053b4dbb6bfc80
SHA256

c3a5621a522967a7d7c6a9dba78de329319d8629627e35797de7f13a30c5eda1
SHA512

3be952c6c7cbb9e180dfaf6524425d6aeaefad8ae7ac8133c6bc563e16870e29f1db78865adca55db2cf870435a66e731082d44f4732bc6cffa10fa31037bc33
SSDEEP

6144:hZIeKttnBhsdxG+5s2SbITN95tJvxQs7/l4b+GYuvuNd0:h2ltBhsdQ+2biys7Jzuvu30

Score

N/A

Malware Config

Signatures

Files

c3a5621a522967a7d7c6a9dba78de329319d8629627e35797de7f13a30c5eda1
.exe windows x86

e72ad701758590c148d0ae5c8d30488c

Code Sign

7f:83:f9:fc:64:30:c2:89:48:7f:87:65:65:66:19:f6
Certificate

Issuer

CN=XyKEA22sschbxokC6Ukt8pWyonRIY85IKXseFQKeovMfQOREBRc6sqlH2Wq46elm5vpXzqLHtqfcp1EmXFixFATx41oyMK1M478vy92fXrn5e8sBMINzN1uHL2DOk3iGPAsFqRjO9Yc8TIQVKfa4rgLxrniGzR7qAEtrxN75jnYIuLdwxq75Gf9ZokN6Rpe1xVxVKCNkOQkqDDFeSmEO9lPHY2Rc6eb8TWlrsmqw3w3Uv58wx17D1hNYBBteHjg6X9MoBuSinri3LjiAhh23YfQKG3TDC2yT2R6oCQPSfxuP

Not Before

30/10/2012, 06:00

Not After

31/12/2039, 23:59

Subject

CN=XyKEA22sschbxokC6Ukt8pWyonRIY85IKXseFQKeovMfQOREBRc6sqlH2Wq46elm5vpXzqLHtqfcp1EmXFixFATx41oyMK1M478vy92fXrn5e8sBMINzN1uHL2DOk3iGPAsFqRjO9Yc8TIQVKfa4rgLxrniGzR7qAEtrxN75jnYIuLdwxq75Gf9ZokN6Rpe1xVxVKCNkOQkqDDFeSmEO9lPHY2Rc6eb8TWlrsmqw3w3Uv58wx17D1hNYBBteHjg6X9MoBuSinri3LjiAhh23YfQKG3TDC2yT2R6oCQPSfxuP

Extended Key Usages

ExtKeyUsageCodeSigning

e8:51:59:e9:88:9e:b5:e6:e0:03:f5:a0:68:ef:d7:2f:24:0d:06:f2
Signer

Actual PE Digest

e8:51:59:e9:88:9e:b5:e6:e0:03:f5:a0:68:ef:d7:2f:24:0d:06:f2

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=XyKEA22sschbxokC6Ukt8pWyonRIY85IKXseFQKeovMfQOREBRc6sqlH2Wq46elm5vpXzqLHtqfcp1EmXFixFATx41oyMK1M478vy92fXrn5e8sBMINzN1uHL2DOk3iGPAsFqRjO9Yc8TIQVKfa4rgLxrniGzR7qAEtrxN75jnYIuLdwxq75Gf9ZokN6Rpe1xVxVKCNkOQkqDDFeSmEO9lPHY2Rc6eb8TWlrsmqw3w3Uv58wx17D1hNYBBteHjg6X9MoBuSinri3LjiAhh23YfQKG3TDC2yT2R6oCQPSfxuP

01/12/2022, 14:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetModuleHandleW
GetWindowsDirectoryW
BackupWrite
CallNamedPipeA
ChangeTimerQueueTimer
ClearCommError
CloseHandle
CommConfigDialogW
CompareFileTime
CreateEventW
CreateIoCompletionPort
CreateJobObjectW
CreateMutexW
CreateProcessW
CreateSemaphoreW
CreateThread
DeleteCriticalSection
EnterCriticalSection
EnumCalendarInfoA
EnumSystemLanguageGroupsA
FatalAppExitA
FileTimeToDosDateTime
FillConsoleOutputAttribute
FindFirstFileA
FindNextFileW
FindResourceExA
FoldStringA
FreeLibrary
GetBinaryType
GetComputerNameA
GetConsoleAliasW
GetConsoleAliasesLengthA
GetConsoleAliasesLengthW
GetConsoleCP
GetCurrentProcessId
GetDefaultCommConfigA
GetLocaleInfoW
GetNumberFormatW
GetNumberOfConsoleMouseButtons
GetPriorityClass
GetPrivateProfileIntA
GetPrivateProfileSectionW
GetProcessAffinityMask
GetProcessShutdownParameters
GetProcessWorkingSetSize
GetProfileSectionW
GetStartupInfoW
GetSystemInfo
GetSystemWindowsDirectoryA
GetTempFileNameW
GetThreadSelectorEntry
GetUserDefaultUILanguage
GetVersionExA
GetWriteWatch
GlobalAlloc
GlobalFindAtomW
GlobalSize
Heap32ListFirst
HeapAlloc
HeapFree
HeapReAlloc
GetModuleHandleA
InitializeCriticalSection
InterlockedIncrement
IsBadReadPtr
IsBadStringPtrA
IsBadStringPtrW
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LocalLock
LockFile
MoveFileA
MoveFileExA
OpenFileMappingA
OpenProcess
Process32FirstW
ReadConsoleInputA
ReadConsoleW
ReadFileEx
ReleaseMutex
ReplaceFileA
ReplaceFileW
RequestDeviceWakeup
ResetWriteWatch
SearchPathA
SearchPathW
SetCommBreak
SetCommMask
SetConsoleActiveScreenBuffer
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetConsoleWindowInfo
SetDefaultCommConfigW
SetEvent
SetFileApisToOEM
SetLastError
SetProcessAffinityMask
SetProcessShutdownParameters
SetStdHandle
SetVolumeLabelA
SignalObjectAndWait
TerminateProcess
UnlockFile
UpdateResourceW
VerifyVersionInfoW
VirtualAlloc
VirtualFree
WaitForMultipleObjectsEx
WaitForSingleObject
WideCharToMultiByte
WriteFileGather
WriteProfileSectionA
WriteTapemark
_hwrite
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrcpyA
lstrlen
InitAtomTable
GetProcAddress

user32

PtInRect
RealGetWindowClass
RegisterWindowMessageA
RemovePropA
RemovePropW
ReplyMessage
ScreenToClient
SendDlgItemMessageW
SendMessageA
SendNotifyMessageW
SetCaretPos
SetForegroundWindow
SetLastErrorEx
SetMessageExtraInfo
SetProcessWindowStation
SetPropW
SetScrollRange
SetSysColors
SetWindowPlacement
SetWindowPos
SetWindowRgn
ShowCursor
SystemParametersInfoA
ToUnicode
UpdateWindow
WinHelpA
WinHelpW
wsprintfW
PaintDesktop
OemKeyScan
MsgWaitForMultipleObjectsEx
ModifyMenuW
MessageBeep
MapVirtualKeyExW
LoadMenuW
LoadKeyboardLayoutW
LoadImageW
LoadAcceleratorsW
LoadAcceleratorsA
IsZoomed
IsRectEmpty
IsHungAppWindow
IsCharAlphaNumericA
IsCharAlphaA
InternalGetWindowText
IMPGetIMEA
GetWindowWord
GetWindowRect
GetWindowModuleFileName
GetWindowLongW
GetWindow
GetUpdateRgn
GetSystemMenu
GetMonitorInfoA
GetMessageTime
GetMenuState
GetKeyboardLayoutList
GetKeyboardLayout
GetInputDesktop
GetClipboardViewer
GetClassNameW
GetActiveWindow
ExitWindowsEx
EnumWindowStationsW
EnumChildWindows
EndDeferWindowPos
DrawTextExW
DrawMenuBar
DispatchMessageW
DestroyMenu
DestroyCaret
DdeSetUserHandle
DdeQueryConvInfo
DdeConnectList
DdeCmpStringHandles
CreateIconFromResource
CreateDialogIndirectParamA
CopyIcon
ClipCursor
ClientToScreen
ChildWindowFromPoint
CharToOemBuffW
CharPrevA
CharNextExA
CharLowerA
ChangeClipboardChain
CallNextHookEx
BroadcastSystemMessageW
BringWindowToTop
BeginPaint
ArrangeIconicWindows
AppendMenuW
AnimateWindow
LoadIconA
CreateDesktopA

advapi32

RegOpenKeyW

shell32

WOWShellExecute
Shell_NotifyIcon
ShellExecuteW
ShellExecuteExW
ShellExecuteExA
ShellExecuteA
ShellAboutW
CheckEscapesW
DoEnvironmentSubstW
DragAcceptFiles
DragFinish
DragQueryFile
DragQueryFileA
DragQueryPoint
ShellAboutA
ExtractAssociatedIconA
ExtractAssociatedIconExA
ExtractAssociatedIconExW
ExtractAssociatedIconW
ExtractIconA
ExtractIconEx
FindExecutableA
SHAddToRecentDocs
SHBindToParent
SHBrowseForFolder
SHBrowseForFolderA
SHChangeNotify
SHCreateDirectoryExA
SHCreateProcessAsUserW
SHEmptyRecycleBinA
SHEmptyRecycleBinW
SHFileOperation
SHFileOperationA
SHFileOperationW
SHFreeNameMappings
SHGetDataFromIDListA
SHGetDiskFreeSpaceA
SHGetDiskFreeSpaceExW
SHGetFileInfo
SHGetFileInfoW
SHGetFolderLocation
SHGetFolderPathW
SHGetIconOverlayIndexW
SHGetInstanceExplorer
SHGetMalloc
SHGetPathFromIDListA
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHInvokePrinterCommandA
SHInvokePrinterCommandW
SHLoadInProc
SHPathPrepareForWriteA
SHPathPrepareForWriteW

shlwapi

StrChrA
StrChrW
StrCmpNIW
StrCmpNW
StrRChrIW
StrRStrIA
StrRStrIW
StrStrIA
StrStrA

Sections

.text
Size: 309KB - Virtual size: 308KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e72ad701758590c148d0ae5c8d30488c

Code Sign

7f:83:f9:fc:64:30:c2:89:48:7f:87:65:65:66:19:f6Certificate

Extended Key Usages

e8:51:59:e9:88:9e:b5:e6:e0:03:f5:a0:68:ef:d7:2f:24:0d:06:f2Signer

Signature Validations

Verification

01/12/2022, 14:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

shlwapi

Sections

.text Size: 309KB - Virtual size: 308KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 296B

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 2KB - Virtual size: 2KB

7f:83:f9:fc:64:30:c2:89:48:7f:87:65:65:66:19:f6
Certificate

e8:51:59:e9:88:9e:b5:e6:e0:03:f5:a0:68:ef:d7:2f:24:0d:06:f2
Signer

01/12/2022, 14:34
Valid: false

.text
Size: 309KB - Virtual size: 308KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 296B

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 2KB - Virtual size: 2KB