fc901c52572f08715bd690e7128e459a7270707d97351eb0da40ebc0539295f7

Sharing

Copy URL Twitter E-mail

General

Target

fc901c52572f08715bd690e7128e459a7270707d97351eb0da40ebc0539295f7
Size

583KB
MD5

f1384cf01c2fda1e34f9d733bcefdf2d
SHA1

ebeb2d5c3337ac36d73b9ac47547f4eb1b07f906
SHA256

fc901c52572f08715bd690e7128e459a7270707d97351eb0da40ebc0539295f7
SHA512

aaa5db34e07b33b4adffb160a8b69bf2337d259d714fa9b5c24e5971edf033d02c0083f68f6f7dda9d6c7a35c0d78c686a8fedf4cc348203ea3cb39d99214451
SSDEEP

12288:pI7M41R/r2/falByGsSyAJ61vguUsCkF/1oQhiakl/T:pI7MG/r2/fCye61vguUsWT

Score

N/A

Malware Config

Signatures

Files

fc901c52572f08715bd690e7128e459a7270707d97351eb0da40ebc0539295f7
.exe windows x86

4778ab07670c26074dde51d7faa848e2

Code Sign

5c:43:39:91:ed:81:87:ee:a0:a3:00:3a:1e:48:61:e8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19/12/2011, 00:00

Not After

18/12/2013, 23:59

Subject

CN=FirsTech Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=FirsTech Inc.,L=Decatur,ST=Illinois,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

66:fb:a4:06:e4:0e:62:73:69:6f:ef:ab:44:f0:1a:88:97:df:a7:e4
Signer

Actual PE Digest

66:fb:a4:06:e4:0e:62:73:69:6f:ef:ab:44:f0:1a:88:97:df:a7:e4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=FirsTech Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=FirsTech Inc.,L=Decatur,ST=Illinois,C=US

01/12/2022, 14:34
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
WinExec
SetLocalTime
GetTimeFormatA
GetDateFormatA
GetLastError
GetVolumeInformationA
GetLocalTime
GlobalMemoryStatus
WritePrivateProfileStringA
GetPrivateProfileIntA
lstrlenA
lstrcpynA
lstrcpyA
LoadLibraryA
GetProcAddress
ReadFile
GetACP
GetCPInfo
GetOEMCP
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
RtlUnwind
GetFileType
WriteFile
SetHandleCount
GetEnvironmentStringsW
GetStdHandle
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
TerminateProcess
GetCurrentProcess
VirtualAlloc
VirtualFree
HeapReAlloc
HeapDestroy
ExitProcess
HeapCreate
GetCommandLineA
GetStartupInfoA
GetVersion
HeapAlloc
HeapFree
GetPrivateProfileStringA
GetCurrentDirectoryA
GetModuleHandleA
LCMapStringA
LCMapStringW
SetFilePointer
SetStdHandle
FlushFileBuffers
CloseHandle

user32

LoadCursorA
RegisterClassExA
LoadIconA
GetClientRect
UpdateWindow
GetSystemMenu
ShowWindow
GetSystemMetrics
LoadImageA
ModifyMenuA
CreateWindowExA
MessageBoxA
wsprintfA
MessageBeep
SetWindowTextA
GetDesktopWindow
SetWindowPos
GetWindowRect
DispatchMessageA
GetDlgCtrlID
SetDlgItemInt
GetDlgItemInt
GetDlgItemTextA
InvalidateRect
SetFocus
SendDlgItemMessageA
EndDialog
LoadStringA
EnableWindow
SetDlgItemTextA
GetDlgItem
PostQuitMessage
LoadBitmapA
GetWindowTextA
ScreenToClient
GetWindowLongA
DefWindowProcA
BeginPaint
KillTimer
SendMessageA
AppendMenuA
EndPaint
DeleteMenu
TrackPopupMenu
SetTimer
PostMessageA
GetDC
GetCursorPos
SetForegroundWindow
CheckMenuItem
ReleaseDC
DialogBoxParamA
GetMessageA
TranslateMessage
SetMenuItemInfoA

gdi32

CreateFontIndirectA
DeleteObject
GetMapMode
SetMapMode
GetStockObject
LineTo
CreatePen
GetTextExtentPoint32A
TextOutA
SetTextColor
SetBkColor
MoveToEx
SetTextAlign
SelectObject
Rectangle
CreateSolidBrush
CreateCompatibleDC
SetBkMode
BitBlt
GetObjectA
DPtoLP
DeleteDC

comdlg32

GetOpenFileNameA
ChooseColorA
ChooseFontA

shell32

ShellExecuteA
Shell_NotifyIconA

winmm

sndPlaySoundA

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 520KB - Virtual size: 732KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 336.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4778ab07670c26074dde51d7faa848e2

Code Sign

5c:43:39:91:ed:81:87:ee:a0:a3:00:3a:1e:48:61:e8Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

66:fb:a4:06:e4:0e:62:73:69:6f:ef:ab:44:f0:1a:88:97:df:a7:e4Signer

Signature Validations

Verification

01/12/2022, 14:34 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

shell32

winmm

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 520KB - Virtual size: 732KB

.rsrc Size: 16KB - Virtual size: 336.0MB

5c:43:39:91:ed:81:87:ee:a0:a3:00:3a:1e:48:61:e8
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

66:fb:a4:06:e4:0e:62:73:69:6f:ef:ab:44:f0:1a:88:97:df:a7:e4
Signer

01/12/2022, 14:34
Valid: false

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 520KB - Virtual size: 732KB

.rsrc
Size: 16KB - Virtual size: 336.0MB