afe08faea5e552324aa4e367d6d9fd45ed5ccd4c88fab3dd7810d4ac4b01cc3e

Sharing

Copy URL Twitter E-mail

General

Target

afe08faea5e552324aa4e367d6d9fd45ed5ccd4c88fab3dd7810d4ac4b01cc3e
Size

779KB
MD5

2d1c1bee7c1cf295d68ac43bb95bce97
SHA1

b9551311c7278705bedcd8ee9611ae1b71105e28
SHA256

afe08faea5e552324aa4e367d6d9fd45ed5ccd4c88fab3dd7810d4ac4b01cc3e
SHA512

80657cc25558a04af4196ae64a2f80253e2eb8a3b471f6b9037fffc90115fb1aa4b8a2926cbb8d7b44f409d06775dda442f823685ce83366f2212d69d518396f
SSDEEP

12288:VWDklsSgiuslRw1aIEnPkOnPeCoBK4DVPmI2VI13k8dytVE4krXg:VWDkaSHIh+WK4ZPqYUiS0Xg

Score

N/A

Malware Config

Signatures

Files

afe08faea5e552324aa4e367d6d9fd45ed5ccd4c88fab3dd7810d4ac4b01cc3e
.exe windows x86

bed9a6a113579d4d3f2d896246221c10

Code Sign

bf:31:2c:e6:5c:ca:7a:79:53:36:ee:ee:a4:f3:92:93
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/04/2014, 00:00

Not After

08/04/2016, 23:59

Subject

CN=Consortium Group ltd.,O=Consortium Group ltd.,POSTALCODE=00152,STREET=CORNER OF GR.MARLBOROUGH UN GR.GEORGE STR. ROSEAU\,DOMINICA\, 00152+STREET=3RD FLOOR\, C&h TOWERS,L=ROSEAU,ST=ROSEAU,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

11:3c:cc:b8:44:d0:56:27:fc:8a:99:ab:65:8d:d6:43:5e:7b:5a:3d
Signer

Actual PE Digest

11:3c:cc:b8:44:d0:56:27:fc:8a:99:ab:65:8d:d6:43:5e:7b:5a:3d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Consortium Group ltd.,O=Consortium Group ltd.,POSTALCODE=00152,STREET=CORNER OF GR.MARLBOROUGH UN GR.GEORGE STR. ROSEAU\,DOMINICA\, 00152+STREET=3RD FLOOR\, C&h TOWERS,L=ROSEAU,ST=ROSEAU,C=DM

01/12/2022, 14:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCloseHandle
InternetConnectW
InternetOpenW
InternetCanonicalizeUrlW
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetReadFile

kernel32

GetProcAddress
GetSystemInfo
GetModuleHandleW
GetTempPathW
GetVersionExW
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
VirtualProtect
VirtualFree
VirtualAlloc
GetModuleHandleA
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
ReadConsoleW
WaitForMultipleObjects
GetACP
IsValidCodePage
SetFilePointerEx
GetFileType
GetStdHandle
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
GetProcessHeap
HeapSize
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryExW
ExitThread
CreateSemaphoreW
GetTickCount
CreateProcessW
GetModuleFileNameW
GetSystemTimeAsFileTime
CloseHandle
DeleteFileW
GetLastError
GetFileAttributesW
UnregisterWaitEx
SetStdHandle
GetTimeZoneInformation
WriteConsoleW
CreateFileW
LoadLibraryW
SetEndOfFile
GetOEMCP
GetCurrentThread
GetStartupInfoW
TerminateProcess
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
UnregisterWait
RegisterWaitForSingleObject
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
DuplicateHandle
GetCurrentProcess
SetEnvironmentVariableA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapFree
HeapReAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCPInfo
HeapAlloc
ReadFile
GetCommandLineW
CreateTimerQueue
SetEvent
WaitForSingleObjectEx
Sleep
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask

user32

MoveWindow
SetWindowLongW
GetDlgItem
LoadStringW
LoadIconW
EndPaint
BeginPaint
UpdateWindow
EndDialog
DialogBoxParamW
RegisterClassExW
PostQuitMessage
DefWindowProcW
SystemParametersInfoW
ReleaseDC
GetDC
EnableWindow
DestroyIcon
MessageBoxW
TranslateAcceleratorW
LoadAcceleratorsW
DispatchMessageW
TranslateMessage
GetMessageW
LoadCursorW
IsDlgButtonChecked
GetWindowLongW
GetSysColor
SetCursor
RemovePropW
GetPropW
SetPropW
InvalidateRect
CallWindowProcW
SetWindowTextW
SetWindowPos
ShowWindow
CreateWindowExW
PostMessageW
GetParent
GetWindowRect
GetClientRect
GetSystemMetrics
SendMessageW

gdi32

SelectObject
GetTextExtentPoint32W
GetObjectW
SetTextColor
GetStockObject
DeleteObject
CreateFontIndirectW
GetTextMetricsW

comdlg32

GetSaveFileNameW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegOpenCurrentUser
RegCloseKey

shell32

SHGetFolderPathW
ShellExecuteW
ShellExecuteExW
SHCreateDirectoryExW

ole32

CoUninitialize
CoInitialize

Sections

.text
Size: 616KB - Virtual size: 616KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bed9a6a113579d4d3f2d896246221c10

Code Sign

bf:31:2c:e6:5c:ca:7a:79:53:36:ee:ee:a4:f3:92:93Certificate

Extended Key Usages

Key Usages

11:3c:cc:b8:44:d0:56:27:fc:8a:99:ab:65:8d:d6:43:5e:7b:5a:3dSigner

Signature Validations

Verification

01/12/2022, 14:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 616KB - Virtual size: 616KB

.rdata Size: 108KB - Virtual size: 108KB

.data Size: 16KB - Virtual size: 34KB

.rsrc Size: 35KB - Virtual size: 34KB

bf:31:2c:e6:5c:ca:7a:79:53:36:ee:ee:a4:f3:92:93
Certificate

11:3c:cc:b8:44:d0:56:27:fc:8a:99:ab:65:8d:d6:43:5e:7b:5a:3d
Signer

01/12/2022, 14:34
Valid: false

.text
Size: 616KB - Virtual size: 616KB

.rdata
Size: 108KB - Virtual size: 108KB

.data
Size: 16KB - Virtual size: 34KB

.rsrc
Size: 35KB - Virtual size: 34KB