b060430c6b47a98701f2641c33949ea6a43536f01358be072a8fc0ba96bda188

Sharing

Copy URL Twitter E-mail

General

Target

b060430c6b47a98701f2641c33949ea6a43536f01358be072a8fc0ba96bda188
Size

375KB
MD5

46b33a9f037c03394fa2be74c8898f00
SHA1

61c229f3117094fca957e713e3d535db98b70b92
SHA256

b060430c6b47a98701f2641c33949ea6a43536f01358be072a8fc0ba96bda188
SHA512

bcf8be7eef1506bee3ba2059074d37b3e050c22005e42a6b32630def38d97ca5db8435845550ac14a63da6a195d7fdfc07d9552855bff74a33e438c94a883983
SSDEEP

6144:Rv9TYp6W3WrnOI/nJXfH2r8QdSFydhJNKsLWjC9+b46euBde9x5h9pcYE8:Rv9TYp6WYd/JvHOZguLNKmyC9C3tW9xv

Score

N/A

Malware Config

Signatures

Files

b060430c6b47a98701f2641c33949ea6a43536f01358be072a8fc0ba96bda188
.exe windows x86

ccca1c821d5d7a26158a54ee7251b4ba

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

c2:d0:60:08:f8:20:40:a9:be:d3:58:d6:ce:b5:54:2d
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

18/07/2014, 00:00

Not After

18/07/2015, 23:59

Subject

CN=Synteris OOO,O=Synteris OOO,POSTALCODE=121596,STREET=12 A ul.Gorbunova,L=Moscow,ST=Moscow province,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7c:f3:0e:55:79:0c:32:19:71:58:f8:c4:f4:60:4d:97:58:dc:a7:b1
Signer

Actual PE Digest

7c:f3:0e:55:79:0c:32:19:71:58:f8:c4:f4:60:4d:97:58:dc:a7:b1

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Synteris OOO,O=Synteris OOO,POSTALCODE=121596,STREET=12 A ul.Gorbunova,L=Moscow,ST=Moscow province,C=RU

01/12/2022, 14:34
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExW
InterlockedDecrement
TlsFree
GetModuleFileNameA
ReadFile
EnterCriticalSection
QueryPerformanceCounter
UnmapViewOfFile
InterlockedExchange
TerminateProcess
GetCurrentThreadId
ResetEvent
ReleaseMutex
LCMapStringW
CompareStringW
GetACP
GetStartupInfoA
GetLastError
CreateFileA
LCMapStringA
CloseHandle
LoadResource
GlobalAlloc
SetUnhandledExceptionFilter
HeapSize
SetCurrentDirectoryA
CreateNamedPipeW
GetStdHandle
InterlockedCompareExchange
GetCurrentProcess
RtlUnwind
DeleteCriticalSection
GetVersionExA
DeleteFileW
IsValidLocale
HeapFree
ExitProcess
lstrcmpiW
Sleep

user32

MessageBoxW
GetClientRect
CheckDlgButton
SubtractRect
FindWindowExA
IsWindowVisible
InvalidateRect
MsgWaitForMultipleObjects
EqualRect
GetWindowLongA
ShowWindow
CheckMenuItem
PostQuitMessage
DialogBoxParamW
GetForegroundWindow
MapWindowPoints

advapi32

SetServiceStatus
RegDeleteKeyW
RegEnumValueA
RegEnumKeyExW
ImpersonateLoggedOnUser
CryptEncrypt
RegCreateKeyExW
RegisterEventSourceW

ole32

CLSIDFromString
CoFreeUnusedLibraries
ReleaseStgMedium
CoReleaseMarshalData
DoDragDrop
CoImpersonateClient
CoCreateGuid
WriteClassStg

rpcrt4

RpcBindingFree
NdrOleFree
RpcStringBindingComposeW
UuidToStringW
RpcServerUnregisterIf
CStdStubBuffer_QueryInterface
RpcRevertToSelf
CStdStubBuffer_Disconnect
NdrClientCall2
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Connect
NdrCStdStubBuffer2_Release

Sections

.text
Size: 327KB - Virtual size: 351KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bss
Size: 7KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ccca1c821d5d7a26158a54ee7251b4ba

Code Sign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

c2:d0:60:08:f8:20:40:a9:be:d3:58:d6:ce:b5:54:2dCertificate

Extended Key Usages

Key Usages

7c:f3:0e:55:79:0c:32:19:71:58:f8:c4:f4:60:4d:97:58:dc:a7:b1Signer

Signature Validations

Verification

01/12/2022, 14:34 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

rpcrt4

Sections

.text Size: 327KB - Virtual size: 351KB

.rdata Size: 13KB - Virtual size: 12KB

.idata Size: 7KB - Virtual size: 8KB

bss Size: 7KB - Virtual size: 4KB

.rsrc Size: 16KB - Virtual size: 15KB

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

c2:d0:60:08:f8:20:40:a9:be:d3:58:d6:ce:b5:54:2d
Certificate

7c:f3:0e:55:79:0c:32:19:71:58:f8:c4:f4:60:4d:97:58:dc:a7:b1
Signer

01/12/2022, 14:34
Valid: false

.text
Size: 327KB - Virtual size: 351KB

.rdata
Size: 13KB - Virtual size: 12KB

.idata
Size: 7KB - Virtual size: 8KB

bss
Size: 7KB - Virtual size: 4KB

.rsrc
Size: 16KB - Virtual size: 15KB