Patchup_RE[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Patchup_RE.exe
Size

445KB
MD5

457a322bd6b876df88766e1fd193052b
SHA1

3d2e569b01e5ce46ac29c14026cdcec9979f1fdf
SHA256

3280e8524386f3bf8e4f2cdf5500da32282ee7a8020183aba056c24edeab6463
SHA512

b98c5e7e3058043b77dc57df5816c97f2bf4320fceb5cdd7d95a01ce8efd12c62e01f2cc87c15704724794c5097d4286acfbef5eb7442c919ebcd7fda8886d3a
SSDEEP

6144:z8JLFYH2o2O1vncILkKTdfSM74F6wyB1eX/op2AL2qeAw5Coj:z8YdvncGfSk4zyBezeoV

Score

N/A

Malware Config

Signatures

Files

Patchup_RE.exe
.exe windows x86

ce251b974682de5ec7c92d6cf07d820f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:23:3c:75:56:34:06:18:49:72:af:ef:a7:53:51:86
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14-08-2017 00:00

Not After

13-11-2018 23:59

Subject

CN=GRAVITY Co.\, Ltd.,OU=General Affairs Department,O=GRAVITY Co.\, Ltd.,L=Mapo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:21:f9:01:db:42:ef:80:8e:5d:af:40:c9:e2:e8:df:12:79:21:3f
Signer

Actual PE Digest

90:21:f9:01:db:42:ef:80:8e:5d:af:40:c9:e2:e8:df:12:79:21:3f

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=GRAVITY Co.\, Ltd.,OU=General Affairs Department,O=GRAVITY Co.\, Ltd.,L=Mapo-gu,ST=Seoul,C=KR

10-10-2018 06:27
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpQueryInfoA
FtpSetCurrentDirectoryA
FtpOpenFileA
FtpFindFirstFileA
InternetFindNextFileA
InternetReadFile
InternetOpenUrlA
InternetConnectA
InternetCloseHandle
InternetOpenA

mfc110

ord12318
ord2430
ord5212
ord8130
ord4519
ord12638
ord12701
ord10228
ord12028
ord8191
ord1459
ord7470
ord8273
ord6699
ord12001
ord13502
ord12317
ord7471
ord994
ord13869
ord8151
ord1463
ord310
ord265
ord1517
ord1520
ord2466
ord6330
ord4804
ord2464
ord449
ord4579
ord4578
ord1099
ord12843
ord266
ord499
ord11745
ord5733
ord12128
ord2826
ord1133
ord14329
ord7734
ord14327
ord9203
ord4084
ord4023
ord12720
ord7753
ord1978
ord11766
ord11765
ord14201
ord12307
ord7811
ord14401
ord6192
ord14403
ord6194
ord14402
ord6193
ord987
ord6694
ord3786
ord5765
ord12020
ord8025
ord12032
ord12000
ord5617
ord10047
ord9016
ord7326
ord8638
ord3986
ord2495
ord8637
ord9333
ord1159
ord9494
ord10648
ord11442
ord10079
ord11388
ord10532
ord11462
ord11677
ord10972
ord9287
ord10777
ord10959
ord11461
ord9305
ord9304
ord9068
ord10956
ord11390
ord8812
ord10647
ord10109
ord11518
ord10046
ord10146
ord11517
ord11035
ord10073
ord9292
ord9838
ord11665
ord10200
ord11309
ord10121
ord10113
ord11267
ord11885
ord11960
ord3119
ord3242
ord6773
ord5383
ord6980
ord532
ord6065
ord13500
ord8721
ord8729
ord10298
ord11069
ord11066
ord7598
ord10910
ord2624
ord11869
ord9033
ord6709
ord9846
ord9845
ord10939
ord8819
ord10915
ord11530
ord9330
ord9789
ord9785
ord9318
ord9328
ord9313
ord8112
ord2291
ord2705
ord4892
ord4893
ord4896
ord4894
ord4895
ord7971
ord8633
ord2245
ord2159
ord7311
ord11912
ord6064
ord13498
ord2704
ord9017
ord11953
ord1102
ord8848
ord10808
ord11180
ord10266
ord4025
ord457
ord3340
ord3341
ord3104
ord6375
ord3243
ord3240
ord10052
ord8018
ord10082
ord10084
ord10083
ord10081
ord10085
ord5507
ord11509
ord11510
ord8947
ord11870
ord3772
ord3767
ord11719
ord14322
ord8773
ord6809
ord9272
ord10795
ord9063
ord3204
ord13619
ord12040
ord12038
ord1702
ord1711
ord1719
ord1715
ord1724
ord4842
ord4879
ord4850
ord4862
ord4858
ord4854
ord4885
ord4875
ord4846
ord4889
ord4867
ord4831
ord4837
ord4870
ord4432
ord5643
ord9495
ord4424
ord2995
ord2694
ord14330
ord7735
ord14328
ord6710
ord4407
ord11501
ord13970
ord8629
ord13449
ord5782
ord13875
ord2626
ord11905
ord3874
ord3308
ord3309
ord3203
ord11949
ord4809
ord5107
ord5404
ord5614
ord9155
ord5380
ord5110
ord5266
ord5091
ord7537
ord7538
ord7528
ord5264
ord8027
ord1380
ord884
ord13787
ord13054
ord12860
ord3540
ord6403
ord3816
ord6410
ord2189
ord4746
ord1038
ord316
ord1498
ord1500
ord6066
ord2353

msvcr110

ferror
getc
ungetc
strerror
getenv
strtoul
longjmp
exit
_setjmp3
remove
sscanf
fgets
feof
strchr
atol
atoi
vsprintf
rename
fwrite
strncpy_s
strstr
memset
sprintf
fprintf
__iob_func
_errno
isprint
isspace
fread
fputs
_unlink
_stricmp
_itoa
_strlwr
fopen
fclose
_mbsrchr
strrchr
strncpy
memchr
memcpy
__CxxFrameHandler3
_CxxThrowException
memmove
_mkdir
_setmbcp
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
?terminate@@YAXXZ
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_commode
_fmode
_acmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_ismbblead
_cexit
_exit
__set_app_type
__getmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
calloc
malloc
fputc
strcoll
strpbrk
tolower
toupper
ispunct
isxdigit
islower
isupper
strncat
strcspn
strtod
realloc
free
floor
_libm_sse2_tan_precise
_libm_sse2_sqrt_precise
_libm_sse2_sin_precise
_libm_sse2_pow_precise
_libm_sse2_log_precise
_libm_sse2_log10_precise
_libm_sse2_exp_precise
_libm_sse2_cos_precise
_libm_sse2_atan_precise
_libm_sse2_asin_precise
_libm_sse2_acos_precise
_CIfmod
_CIatan2
ldexp
frexp
ceil
srand
rand
iscntrl
isalnum
isdigit
isalpha
_mktime32
_time32
strftime
_localtime32
_gmtime32
_difftime32
clock
system
tmpnam
tmpfile
ftell
fseek
fscanf
fflush
setlocale
_purecall

kernel32

CreateFileA
CloseHandle
SetFilePointerEx
ReadFile
GetFileSizeEx
GetFileAttributesA
SetFileAttributesA
CopyFileA
FindFirstFileA
GetModuleFileNameA
FindClose
CreateThread
GlobalFree
GlobalUnlock
GlobalLock
GlobalReAlloc
WriteFile
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GlobalAlloc
GetCurrentThreadId
GetSystemTimeAsFileTime

user32

ReleaseCapture
EnableWindow
GetSystemMetrics
DrawIcon
SetWindowRgn
InvalidateRect
GetWindowRect
SetRect
LoadIconW
LoadImageA
GetParent
SetCapture
GetWindowRgn
GetClientRect
SetCursor
SetClassLongA
LoadCursorA
MessageBoxA
LoadStringA
GetDC
ReleaseDC
CloseWindow
BringWindowToTop
GetCapture
IsIconic
SendMessageA

gdi32

ExtCreateRegion
SelectObject
CreateDIBSection
GetObjectA
DeleteObject
CreateRectRgn
PtInRegion
StretchBlt
DeleteDC
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
TextOutA
BitBlt
CombineRgn

advapi32

RegSetValueExA
RegCreateKeyExA

shell32

ShellExecuteA

comctl32

_TrackMouseEvent

msvcp110

?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

Sections

.text
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce251b974682de5ec7c92d6cf07d820f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

09:23:3c:75:56:34:06:18:49:72:af:ef:a7:53:51:86Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

90:21:f9:01:db:42:ef:80:8e:5d:af:40:c9:e2:e8:df:12:79:21:3fSigner

Signature Validations

Verification

10-10-2018 06:27 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

wininet

mfc110

msvcr110

kernel32

user32

gdi32

advapi32

shell32

comctl32

msvcp110

Sections

.text Size: 184KB - Virtual size: 183KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 219KB - Virtual size: 218KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

09:23:3c:75:56:34:06:18:49:72:af:ef:a7:53:51:86
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

90:21:f9:01:db:42:ef:80:8e:5d:af:40:c9:e2:e8:df:12:79:21:3f
Signer

10-10-2018 06:27
Valid: false

.text
Size: 184KB - Virtual size: 183KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 219KB - Virtual size: 218KB