b051f63c8f60971f271a9ad6f97a3dbd2887402e20bc80addee73e1002b6bfab

Sharing

Copy URL Twitter E-mail

General

Target

b051f63c8f60971f271a9ad6f97a3dbd2887402e20bc80addee73e1002b6bfab
Size

678KB
MD5

51d425410acec7be5bfa6b3580f99b1d
SHA1

b689351b461749c8fe5f8c3512ea03758b8f2295
SHA256

b051f63c8f60971f271a9ad6f97a3dbd2887402e20bc80addee73e1002b6bfab
SHA512

e506185b0604c93c4864576706b64ac42fb982933c091405dae0051789b9f79c1d848c5915893ad188942cc79c7980544016ac1efca0f73c820bc7195980a2e2
SSDEEP

12288:O8QeETJckr98E1OME3gykkvCcakORDeOV9TYFD2mWtUOQ6Xvm9vqlEZTgeR:O8dETJc298zME3SkvCcakORKOvK/WGO8

Score

N/A

Malware Config

Signatures

Files

b051f63c8f60971f271a9ad6f97a3dbd2887402e20bc80addee73e1002b6bfab
.exe windows x64

30d4ad491a70e79674f82559b2439386

Code Sign

5c:ed:a3:96:d8:ca:15:4b:0e:23:f0:c8:8d:ec:f9:0f
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16/06/2019, 00:00

Not After

15/06/2021, 23:59

Subject

CN=Nenad Hrg,O=Nenad Hrg,POSTALCODE=82024,STREET=Edelweißstr. 104,L=Taufkirchen,ST=Bayern,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

01/08/2030, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:f0:28:b6:7a:54:78:8a:6b:09:6c:34:c1:f0:c5:df:6e:76:eb:f8:aa:96:51:e7:a5:55:d6:ed:46:64:ca:f0
Signer

Actual PE Digest

bc:f0:28:b6:7a:54:78:8a:6b:09:6c:34:c1:f0:c5:df:6e:76:eb:f8:aa:96:51:e7:a5:55:d6:ed:46:64:ca:f0

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Nenad Hrg,O=Nenad Hrg,POSTALCODE=82024,STREET=Edelweißstr. 104,L=Taufkirchen,ST=Bayern,C=DE

01/12/2022, 14:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SetFileAttributesW
RemoveDirectoryW
GetDriveTypeW
GetLogicalDriveStringsW
GlobalSize
GetCurrentDirectoryW
LocalFree
FormatMessageW
FindFirstFileW
VirtualAlloc
VirtualFree
VirtualAllocEx
VirtualFreeEx
WriteProcessMemory
ReadProcessMemory
GetExitCodeProcess
GetFileAttributesW
lstrcpynW
ExitProcess
WaitForSingleObject
MulDiv
GlobalMemoryStatus
GetComputerNameW
CreateDirectoryW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetWindowsDirectoryW
lstrcmpiW
OpenProcess
GetUserDefaultLangID
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStartupInfoW
InterlockedPushEntrySList
GetUserDefaultLCID
EnumDateFormatsW
EnumTimeFormatsW
GetTimeFormatW
GetDateFormatW
GetLocaleInfoW
SystemTimeToFileTime
FileTimeToSystemTime
DeleteFileW
GetFileSize
ReadFile
CreateFileW
WriteFile
CopyFileW
lstrcatW
WideCharToMultiByte
GetModuleFileNameW
GetModuleHandleW
InterlockedPopEntrySList
SizeofResource
FreeLibrary
GlobalReAlloc
OutputDebugStringW
CreateMutexW
GetLastError
CloseHandle
GetLocalTime
LoadLibraryW
GetProcAddress
HeapDestroy
CreateThread
Sleep
TerminateThread
lstrcpyW
GetCurrentProcessId
GetVersionExW
FindResourceW
LoadResource
LockResource
GlobalHandle
GlobalFree
FreeResource
GlobalLock
GlobalUnlock
SetLastError
lstrcmpW
DeleteCriticalSection
InitializeCriticalSection
__C_specific_handler
GlobalAlloc
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetCurrentProcess
FlushInstructionCache
GetTempPathW
GetTimeZoneInformation
lstrlenA
lstrlenW
CreateProcessW
MultiByteToWideChar

user32

GetClassLongW
SetWindowPlacement
GetWindowPlacement
IsZoomed
GetForegroundWindow
LoadIconW
MoveWindow
DrawIconEx
CreatePopupMenu
LoadMenuW
EnumDisplaySettingsW
TrackPopupMenu
AppendMenuW
InsertMenuW
DeleteMenu
EnableMenuItem
DialogBoxParamW
TileWindows
CascadeWindows
EmptyClipboard
RegisterClipboardFormatW
SetDlgItemInt
IsRectEmpty
CreateDesktopW
SwitchDesktop
OpenDesktopW
GetUserObjectInformationW
GetThreadDesktop
SetCursorPos
CopyIcon
keybd_event
GetKeyboardState
DrawAnimatedRects
GetDlgItemTextW
GetSysColorBrush
GetKeyState
CharNextW
CharLowerW
UnhookWindowsHookEx
GetSystemMetrics
CallNextHookEx
GetClassLongPtrW
WindowFromPoint
GetActiveWindow
GetWindowThreadProcessId
MessageBeep
DrawEdge
FrameRect
FindWindowExW
TrackPopupMenuEx
MonitorFromPoint
GetMonitorInfoW
DrawTextW
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemCount
IsWindowVisible
UpdateWindow
ScreenToClient
PostMessageW
DestroyMenu
LoadImageW
CreateDialogIndirectParamW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
CreateAcceleratorTableW
CreateWindowExW
GetClassInfoExW
LoadCursorW
wsprintfW
EnumChildWindows
CreateDialogParamW
MessageBoxW
SetRect
RegisterClassExW
IsWindow
ReleaseCapture
GetDesktopWindow
BeginPaint
FillRect
EndPaint
SetFocus
CallWindowProcW
GetClassNameW
SetCapture
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
GetWindowLongPtrW
DestroyWindow
GetSysColor
SetWindowLongPtrW
GetFocus
DefWindowProcW
SetWindowLongW
SetForegroundWindow
GetCursor
GetCursorPos
GetAsyncKeyState
SetActiveWindow
EnableWindow
ClientToScreen
GetSystemMenu
SetCursor
CheckMenuItem
FindWindowW
SetDlgItemTextW
SendDlgItemMessageW
EnumDisplayMonitors
CopyRect
OpenClipboard
GetClipboardData
CloseClipboard
GetMessagePos
SetClipboardData
IsDialogMessageW
SendMessageW
SetParent
IsChild
KillTimer
SetTimer
RedrawWindow
ShowWindow
SetWindowTextW
PostQuitMessage
GetWindow
GetWindowRect
SystemParametersInfoW
GetClientRect
MapWindowPoints
SetWindowPos
GetDlgItem
OffsetRect
TranslateMessage
DispatchMessageW
EnumWindows
SendMessageTimeoutW
LoadStringW
GetSubMenu
PeekMessageW
PtInRect
ModifyMenuW
SetWindowsHookExW
GetParent
GetWindowLongW
EndDialog
GetMessageW

gdi32

MoveToEx
SetROP2
CreatePen
SaveDC
RestoreDC
LineTo
Rectangle
StretchBlt
SetStretchBltMode
GetTextExtentPointW
Ellipse
ExtTextOutW
OffsetWindowOrgEx
CreateDCW
CreateEnhMetaFileW
CloseEnhMetaFile
SelectPalette
RealizePalette
GetDIBits
SetPixel
CreateDIBSection
CreateBitmap
PatBlt
SetBkColor
CreateFontIndirectW
SetTextColor
SetBkMode
GetStockObject
GetObjectW
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetPixel
GetDeviceCaps

comdlg32

ChooseFontW
GetOpenFileNameW
GetSaveFileNameW
ChooseColorW

advapi32

RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
CryptDestroyHash
CryptReleaseContext
CryptCreateHash
RegOpenKeyW
GetTokenInformation
GetUserNameW
RegEnumKeyExW
OpenProcessToken
RegCloseKey
RegDeleteKeyW
CryptGetHashParam
CryptHashData
CryptAcquireContextW

shell32

SHGetMalloc
SHGetFileInfoW
ord25
SHFileOperationW
SHGetDesktopFolder
SHGetSpecialFolderLocation
ord155
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHGetSettings
ShellExecuteExW
Shell_NotifyIconW
ShellExecuteW
SHAppBarMessage

ole32

CreateStreamOnHGlobal
OleLockRunning
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
StringFromCLSID
CoTaskMemFree
OleUninitialize
CoSetProxyBlanket
CoUninitialize
CoInitialize
ReleaseStgMedium
CoInitializeSecurity
CoInitializeEx
OleInitialize

oleaut32

DispCallFunc
SafeArrayDestroy
VariantInit
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
VariantClear
SysStringLen
SysAllocStringLen
SysFreeString
SysAllocString
VarRound

msvcrt

wcschr
sprintf
time
wcscat
__CxxFrameHandler
mktime
fmod
_wsetlocale
wcscpy
wcsftime
localtime
clock
_wcsicoll
abs
fclose
fread
fwrite
_wfopen
rand
strlen
_XcptFilter
_c_exit
_exit
_cexit
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
__dllonexit
_onexit
memcpy
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
wcsstr
??1type_info@@UEAA@XZ
_CxxThrowException
swprintf
wcslen
vswprintf
_wtoi
wcscmp
iswspace
iswdigit
wcsrchr
wcsncpy
_wcsicmp
realloc
memcmp
_purecall
malloc
free
memset
_vsnwprintf
memmove
?terminate@@YAXXZ

comctl32

ImageList_GetIcon
ImageList_LoadImageW
ImageList_Create
ImageList_ReplaceIcon
ord17
ImageList_Draw
InitCommonControlsEx

winmm

PlaySoundW
mixerGetNumDevs
waveOutOpen
mixerGetID
waveOutClose
mixerClose
mixerSetControlDetails
timeGetTime
mixerOpen
mixerGetLineInfoW
mixerGetLineControlsW
mixerGetControlDetailsW

Sections

.text
Size: 398KB - Virtual size: 398KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

30d4ad491a70e79674f82559b2439386

Code Sign

5c:ed:a3:96:d8:ca:15:4b:0e:23:f0:c8:8d:ec:f9:0fCertificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

bc:f0:28:b6:7a:54:78:8a:6b:09:6c:34:c1:f0:c5:df:6e:76:eb:f8:aa:96:51:e7:a5:55:d6:ed:46:64:ca:f0Signer

Signature Validations

Verification

01/12/2022, 14:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

msvcrt

comctl32

winmm

Sections

.text Size: 398KB - Virtual size: 398KB

.rdata Size: 57KB - Virtual size: 56KB

.data Size: 3KB - Virtual size: 182KB

.pdata Size: 13KB - Virtual size: 13KB

.rsrc Size: 197KB - Virtual size: 196KB

5c:ed:a3:96:d8:ca:15:4b:0e:23:f0:c8:8d:ec:f9:0f
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

bc:f0:28:b6:7a:54:78:8a:6b:09:6c:34:c1:f0:c5:df:6e:76:eb:f8:aa:96:51:e7:a5:55:d6:ed:46:64:ca:f0
Signer

01/12/2022, 14:34
Valid: false

.text
Size: 398KB - Virtual size: 398KB

.rdata
Size: 57KB - Virtual size: 56KB

.data
Size: 3KB - Virtual size: 182KB

.pdata
Size: 13KB - Virtual size: 13KB

.rsrc
Size: 197KB - Virtual size: 196KB