4520AzxcLYtzUlbdTdyBrgjKnBKk[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4520AzxcLYtzUlbdTdyBrgjKnBKk.exe
Size

595KB
MD5

b39dc1c6b33ca3c822f3337a5c9251f6
SHA1

5504f402f06fc3868d4191a81028e20c96308156
SHA256

6bcaa23b0ba7230f9007c8e3a26a60d8f89e612d708945fafeb183dce6e0b887
SHA512

249f103e4e53b0b9050c97121e8bf1d1ab9125a35479e28a4b7451e350eac2958f33e4446c1333c1aad606ab33e18445ae1bc6b7b43a49090ed301ed422a9925
SSDEEP

12288:4N1CIf4t2ZgP+pcvPq4c5FtAjXsOaDCc0m7xYnqNPe2+gHE:4N1Cdt2ZU+pcHq4c5FtAbsO2xYnMPe2S

Score

1^/10

Malware Config

Signatures

Files

4520AzxcLYtzUlbdTdyBrgjKnBKk.exe
.exe windows x86

5bdeef5c000c0b43b0fe9486378c6347

Code Sign

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19/01/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/11/2018, 00:00

Not After

08/11/2021, 23:59

Subject

CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19/01/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/11/2018, 00:00

Not After

08/11/2021, 23:59

Subject

CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9a:9e:0e:58:24:a9:5c:c8:f3:1f:83:f6:20:a5:a9:71:1b:a1:ea:da:fe:e4:a6:0b:dd:08:3d:08:64:b1:35:b3
Signer

Actual PE Digest

9a:9e:0e:58:24:a9:5c:c8:f3:1f:83:f6:20:a5:a9:71:1b:a1:ea:da:fe:e4:a6:0b:dd:08:3d:08:64:b1:35:b3

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

21/06/2020, 17:48
Valid: true

Chain 1

CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

cc:72:a7:f6:cc:73:fb:7f:b0:41:e1:d8:b1:47:92:8a:2c:90:06:23
Signer

Actual PE Digest

cc:72:a7:f6:cc:73:fb:7f:b0:41:e1:d8:b1:47:92:8a:2c:90:06:23

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

21/06/2020, 17:48
Valid: true

Chain 1

CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareStringA
CompareStringW
CopyFileW
CreateMutexW
CreateThread
EnumSystemLocalesA
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCPInfo
GetCommandLineA
GetCommandLineW
GetCurrentProcessId
GetDateFormatW
GetEnvironmentStringsA
GetEnvironmentStringsW
GetFileAttributesExW
GetFileSizeEx
GetFileTime
GetFileType
GetLocaleInfoW
GetModuleFileNameA
GetModuleHandleA
GetNumberFormatW
GetOEMCP
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GetWindowsDirectoryW
HeapCreate
HeapDestroy
HeapReAlloc
HeapSize
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
IsValidCodePage
IsValidLocale
LCMapStringA
LCMapStringW
LoadLibraryA
OpenFileMappingW
OpenMutexW
QueryPerformanceCounter
ReadFile
ResumeThread
RtlUnwind
SetEndOfFile
SetEnvironmentVariableA
SetFilePointer
SetHandleCount
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WriteFile
lstrlenA

user32

AppendMenuW
CallWindowProcW
CharLowerBuffW
CheckRadioButton
ClientToScreen
CopyAcceleratorTableW
CopyRect
CreateDialogIndirectParamW
CreateDialogParamW
CreateMenu
CreateWindowExW
DestroyCursor
DestroyIcon
DialogBoxIndirectParamW
DialogBoxParamW
DragDetect
DrawMenuBar
DrawStateW
EnableWindow
EndDialog
FillRect
GetActiveWindow
GetAsyncKeyState
GetCapture
GetClassLongW
GetCursorPos
GetDCEx
GetDoubleClickTime
GetKeyState
GetMenu
GetMessagePos
GetMonitorInfoW
GetScrollPos
GetSubMenu
GetSysColor
GetSystemMenu
GetSystemMetrics
GetWindowDC
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextW
GetWindowTextLengthW
HiliteMenuItem
IsDialogMessageW
KillTimer
LoadAcceleratorsW
LoadIconW
LoadStringW
MapWindowPoints
MessageBoxA
MessageBoxW
MonitorFromPoint
MoveWindow
PostQuitMessage
RegisterClipboardFormatW
ReleaseDC
ScreenToClient
SendMessageW
SetLayeredWindowAttributes
SetMenuDefaultItem
SetScrollInfo
SetScrollPos
SetTimer
SetWindowLongW
SetWindowPos
SetWindowTextW
TrackPopupMenu
TranslateAcceleratorW
UnregisterClassW
wvsprintfW

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5bdeef5c000c0b43b0fe9486378c6347

Code Sign

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9dCertificate

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38Certificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9dCertificate

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38Certificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

9a:9e:0e:58:24:a9:5c:c8:f3:1f:83:f6:20:a5:a9:71:1b:a1:ea:da:fe:e4:a6:0b:dd:08:3d:08:64:b1:35:b3Signer

Signature Validations

Verification

21/06/2020, 17:48 Valid: true

Chain 1

cc:72:a7:f6:cc:73:fb:7f:b0:41:e1:d8:b1:47:92:8a:2c:90:06:23Signer

Signature Validations

Verification

21/06/2020, 17:48 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 28KB - Virtual size: 28KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 364KB - Virtual size: 363KB

.rsrc Size: 183KB - Virtual size: 182KB

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

9a:9e:0e:58:24:a9:5c:c8:f3:1f:83:f6:20:a5:a9:71:1b:a1:ea:da:fe:e4:a6:0b:dd:08:3d:08:64:b1:35:b3
Signer

21/06/2020, 17:48
Valid: true

cc:72:a7:f6:cc:73:fb:7f:b0:41:e1:d8:b1:47:92:8a:2c:90:06:23
Signer

21/06/2020, 17:48
Valid: true

.text
Size: 28KB - Virtual size: 28KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 364KB - Virtual size: 363KB

.rsrc
Size: 183KB - Virtual size: 182KB