ba32c4c658139f2d6eeb2d6738b94a3fb00348193b6fbb7d0c6607ecf98a6026

Sharing

Copy URL Twitter E-mail

General

Target

ba32c4c658139f2d6eeb2d6738b94a3fb00348193b6fbb7d0c6607ecf98a6026
Size

264KB
MD5

385bf84d7d14e4bb073ced9f15a7d38c
SHA1

7d326eecef966e104365cbe5f331ec46d70e9da5
SHA256

ba32c4c658139f2d6eeb2d6738b94a3fb00348193b6fbb7d0c6607ecf98a6026
SHA512

ccdd1e7cc0e60d8def54c400d89343b4920661b5576d9f770f63bb9cf2302002d155a5589eec51cfaa15bf6b2fbb5b04e4ac430255da6d50892da00af1b82f60
SSDEEP

6144:OMnEC395ZK8Ek3RdS4+xsofQKIOCuInQ0YMZxxN30L:OrCvZho4+DIFnQ0RU

Score

N/A

Malware Config

Signatures

Files

ba32c4c658139f2d6eeb2d6738b94a3fb00348193b6fbb7d0c6607ecf98a6026
.exe windows x86

29fd5ddf7bd9ccdca7440eb944aebe93

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:d1:51:d4:6a:31:f4:d1:ff:4e:3a:0a:8a:ec:82:0f
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

16/06/2008, 00:00

Not After

30/05/2010, 23:59

Subject

CN=Foxit Software Company,OU=SECURE APPLICATION DEVELOPMENT,O=Foxit Software Company,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

46:6f:96:c1:5e:0b:0b:96:a6:e9:f7:65:bd:19:d4:7f:c5:dd:51:25
Signer

Actual PE Digest

46:6f:96:c1:5e:0b:0b:96:a6:e9:f7:65:bd:19:d4:7f:c5:dd:51:25

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Foxit Software Company,OU=SECURE APPLICATION DEVELOPMENT,O=Foxit Software Company,L=San Jose,ST=California,C=US

01/12/2022, 14:34
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatW
SetEvent
FileTimeToSystemTime
GetEnvironmentVariableA
lstrlenA
OpenMutexW
TlsAlloc
GlobalGetAtomNameA
GetCalendarInfoA
CreateDirectoryA
lstrcmpW
IsBadReadPtr
LoadLibraryA
GetTempFileNameW
OpenSemaphoreW
CopyFileExA
FindAtomA
MoveFileA
GetProcAddress
CreatePipe
SetComputerNameW
EnumTimeFormatsA
GetWindowsDirectoryA
RaiseException
GetDiskFreeSpaceW
GetSystemDirectoryA
SetUnhandledExceptionFilter
lstrcmpA
GetVersionExW
DeleteAtom
lstrcat
EnumDateFormatsA
DuplicateHandle
EnumCalendarInfoA
GetACP
CompareFileTime
lstrlen
IsBadStringPtrA
SetErrorMode
GetExitCodeThread
lstrcpynA
GetUserDefaultLangID
FileTimeToDosDateTime
GetModuleHandleA
GetTimeFormatW
SystemTimeToFileTime
lstrcpynW
ConnectNamedPipe
lstrcatA
ExpandEnvironmentStringsW
GetUserDefaultLCID
GetCurrentDirectoryW
LoadResource
WaitForMultipleObjects
GetCurrentDirectoryA
GetThreadPriority
GetCPInfo
ReadDirectoryChangesW
InitializeCriticalSection
CopyFileExW
GetExpandedNameA
GetStartupInfoW
GetVersionExA
GetAtomNameA
GetTickCount
SearchPathA
EnumCalendarInfoW
GetWindowsDirectoryW
EnumDateFormatsW
FreeLibrary
LoadLibraryA
SearchPathW
OpenEventW
GetFileAttributesW
SetLocaleInfoA
LoadLibraryW
CreateNamedPipeA
FatalAppExitW
GlobalFindAtomW
OpenWaitableTimerA
lstrcmpiW
GetLongPathNameW
GetSystemDirectoryW
GlobalFindAtomA
GetLogicalDrives
SetLocaleInfoW
WinExec
GetLogicalDriveStringsA
GetEnvironmentStringsA
GetMailslotInfo
LocalAlloc
QueryPerformanceFrequency
GetEnvironmentVariableW
GetSystemInfo
GetLogicalDriveStringsW
GetOEMCP

user32

GetClassInfoA
mouse_event
wvsprintfW
GetDCEx
EnableWindow
CreateDesktopW
EnableMenuItem
LoadBitmapA
WaitMessage
GetMenuStringA
GetCapture
LoadIconW
keybd_event
wvsprintfA
LoadIconA
CreateDialogParamA
RegisterClassA
SetDlgItemTextA
GetIconInfo
GetMenuStringW
InsertMenuItemW
CharPrevA
RegisterWindowMessageW
SetWindowTextW
TrackPopupMenuEx
GetMenuItemInfoA
ShowCaret
SendDlgItemMessageA
LoadCursorW
GetMenuItemID
OpenClipboard
GetSysColorBrush
DestroyCursor
RemoveMenu
wsprintfW
TrackPopupMenu
LoadBitmapW
UnregisterClassW
OffsetRect
SetCursor
FindWindowA
EndMenu
wsprintfA
DialogBoxIndirectParamA
RegisterClassExA
GetKeyState
CharNextA
LoadMenuW
SetParent
RegisterClassExW
AdjustWindowRect
SendDlgItemMessageW
GetMessageW
ActivateKeyboardLayout
GetClassInfoExA
CheckMenuItem
DialogBoxParamA
PeekMessageW
MoveWindow
IsMenu
GetMenuItemRect
IsIconic
CopyRect
InvalidateRect
GetMessageA
GetActiveWindow
SetFocus
LoadMenuIndirectA
SetDlgItemTextW
LoadMenuA
WinHelpW
FindWindowW
GetDlgItemTextW
GetMenuInfo
WaitForInputIdle
SetCapture
DefWindowProcA
LoadMenuIndirectW
SetTimer
LoadCursorA
IsWindow
DialogBoxIndirectParamW
MessageBoxIndirectW
GetMenuState
AppendMenuA
CreateDialogParamW
CharPrevW
CreateAcceleratorTableA
PeekMessageA
GetCaretPos

gdi32

CreateICA
RemoveFontResourceA
CreateFontIndirectW
AddFontResourceW
CreatePen
GetEnhMetaFilePixelFormat
CreateMetaFileA
CreateBitmap
RemoveFontResourceExA
RemoveFontResourceExW
SetEnhMetaFileBits
SetMetaFileBitsEx
GetStockObject
CreateColorSpaceA
GetTextExtentPointA
GdiGetBatchLimit
CreateFontIndirectA
CreateICW
CreateDIBSection
CreateCompatibleDC
CreateHatchBrush
GetRasterizerCaps
RemoveFontResourceW
CreatePolygonRgn
GetEnhMetaFileW
AddFontResourceA
CreatePolyPolygonRgn
CreateScalableFontResourceW
CreateFontW
GetEnhMetaFileA
SetWinMetaFileBits
CreateFontIndirectExW
CreateFontIndirectExA
UpdateICMRegKeyA
CreateRectRgn
GetTextExtentPointW
CreateMetaFileW
StretchDIBits
ExtCreateRegion

advapi32

ChangeServiceConfig2A
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction041
LsaOpenAccount

setupapi

SetupQueryFileLogW
CM_Get_Device_ID_List_ExW
SetupDiGetClassDevsExW
SetupInstallFileW
CM_Get_Class_Key_Name_ExW
CM_Query_Arbitrator_Free_Data

ws2_32

send
WSASendTo
WSACloseEvent
getprotobynumber
getsockname
WSASend
htons
WSADuplicateSocketA
getpeername
WSARecvDisconnect
WSAEnumProtocolsW
WSACleanup

winmm

auxGetDevCapsA
DefDriverProc
midiInAddBuffer
midiInClose
midiInOpen
OpenDriver
midiInGetDevCapsW
wod32Message
timeSetEvent

cryptui

CryptUIDlgViewContext
CryptUIDlgSelectCA

oledlg

OleUIAddVerbMenuA
OleUIAddVerbMenuW
OleUIEditLinksA

Sections

.text
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.eRHnl
Size: 112KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.boNAmD
Size: 111KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29fd5ddf7bd9ccdca7440eb944aebe93

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

01:d1:51:d4:6a:31:f4:d1:ff:4e:3a:0a:8a:ec:82:0fCertificate

Extended Key Usages

46:6f:96:c1:5e:0b:0b:96:a6:e9:f7:65:bd:19:d4:7f:c5:dd:51:25Signer

Signature Validations

Verification

01/12/2022, 14:34 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

setupapi

ws2_32

winmm

cryptui

oledlg

Sections

.text Size: 13KB - Virtual size: 16KB

.eRHnl Size: 112KB - Virtual size: 126KB

.rdata Size: 7KB - Virtual size: 17KB

.boNAmD Size: 111KB - Virtual size: 180KB

.data Size: 5KB - Virtual size: 311KB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 1024B - Virtual size: 4KB

01
Certificate

0a
Certificate

01:d1:51:d4:6a:31:f4:d1:ff:4e:3a:0a:8a:ec:82:0f
Certificate

46:6f:96:c1:5e:0b:0b:96:a6:e9:f7:65:bd:19:d4:7f:c5:dd:51:25
Signer

01/12/2022, 14:34
Valid: false

.text
Size: 13KB - Virtual size: 16KB

.eRHnl
Size: 112KB - Virtual size: 126KB

.rdata
Size: 7KB - Virtual size: 17KB

.boNAmD
Size: 111KB - Virtual size: 180KB

.data
Size: 5KB - Virtual size: 311KB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 1024B - Virtual size: 4KB