f07b4db73944f15bef34aa53799ee96fa7cecd61001ac1083f791df6ba352aaa

Sharing

Copy URL

Twitter E-mail

General

Target

f07b4db73944f15bef34aa53799ee96fa7cecd61001ac1083f791df6ba352aaa
Size

597KB
MD5

1cc4ebbfde6590866774e85804bcc6d6
SHA1

babf12b01472b10e797789049a12168e4359d830
SHA256

f07b4db73944f15bef34aa53799ee96fa7cecd61001ac1083f791df6ba352aaa
SHA512

64def51399fb1020d6b04dc97538b2a6d325c8422971f0a533fdd85e4d52728b93a84757f76f72cea186ef1ee40306f315c28837c8d17aaa85a295efc0ae6d56
SSDEEP

12288:wu4fVZHiP/VxPt8ea8QeWDvQ4+10fRaFkvg9grqoHUplEHkECuS:wFVZKVxOeceMQl10JaeguopYCuS

Score

N/A

Malware Config

Signatures

Files

f07b4db73944f15bef34aa53799ee96fa7cecd61001ac1083f791df6ba352aaa
.exe windows x86

b87b703d49e726b9af716d4f4c2dee93

Code Sign

5c:43:39:91:ed:81:87:ee:a0:a3:00:3a:1e:48:61:e8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19-12-2011 00:00

Not After

18-12-2013 23:59

Subject

CN=FirsTech Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=FirsTech Inc.,L=Decatur,ST=Illinois,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:f8:9c:fc:24:2a:89:1a:70:f7:96:75:49:be:bd:05:05:ec:1c:97
Signer

Actual PE Digest

1d:f8:9c:fc:24:2a:89:1a:70:f7:96:75:49:be:bd:05:05:ec:1c:97

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=FirsTech Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=FirsTech Inc.,L=Decatur,ST=Illinois,C=US

01-12-2022 14:34
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

opengl32

glRasterPos2fv
glTranslated
glColor3ub
glDepthFunc
glFeedbackBuffer
glEnable
glCallLists
glEvalMesh2
glVertex4s
glColor3us
glIsTexture
glTexCoord2dv

advapi32

ClearEventLogW
RegOverridePredefKey
OpenEventLogW
RegDeleteKeyA

urlmon

HlinkSimpleNavigateToString

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetLastError
SetFilePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapAlloc
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
SetStdHandle
GetCPInfo
GetACP
GetOEMCP
HeapReAlloc
LoadLibraryA
FlushFileBuffers
GetStringTypeA
GetStringTypeW
ReadFile
RaiseException
LCMapStringA
LCMapStringW
CloseHandle

uxtheme

GetThemeFilename
GetThemeSysSize
GetThemePropertyOrigin
IsThemeActive
GetThemePosition
GetCurrentThemeName
GetThemeIntList
DrawThemeText
GetThemeBackgroundExtent

activeds

ord5
ord22
ord7
ord17
ord9
ord6
ord19
ord8
ord4
ord12

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 322KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 524KB - Virtual size: 523KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b87b703d49e726b9af716d4f4c2dee93

Code Sign

5c:43:39:91:ed:81:87:ee:a0:a3:00:3a:1e:48:61:e8Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

1d:f8:9c:fc:24:2a:89:1a:70:f7:96:75:49:be:bd:05:05:ec:1c:97Signer

Signature Validations

Verification

01-12-2022 14:34 Valid: false

Headers

File Characteristics

Imports

opengl32

advapi32

urlmon

kernel32

uxtheme

activeds

Sections

.text Size: 35KB - Virtual size: 35KB

.rdata Size: 15KB - Virtual size: 14KB

.data Size: 18KB - Virtual size: 322KB

.rsrc Size: 524KB - Virtual size: 523KB

5c:43:39:91:ed:81:87:ee:a0:a3:00:3a:1e:48:61:e8
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

1d:f8:9c:fc:24:2a:89:1a:70:f7:96:75:49:be:bd:05:05:ec:1c:97
Signer

01-12-2022 14:34
Valid: false

.text
Size: 35KB - Virtual size: 35KB

.rdata
Size: 15KB - Virtual size: 14KB

.data
Size: 18KB - Virtual size: 322KB

.rsrc
Size: 524KB - Virtual size: 523KB