tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

87.8MB
MD5

24a7317f42e993a8cd5e2fcc9de818ae
SHA1

456da31a28259264f6351ec07389daa9bfd6b6eb
SHA256

5f8c35c42664b2d5f972d4809b04179ef04db2af2153bb0407f946b82f15d8cc
SHA512

0b2854446cdc84dc41d6c24d93b69d361dc32f0feab2bd4a8fc0ce7de36c9abf2390f3267245e97bfb32a8d9cdaf49800c3285df533bfc69a9b4b3d1d2475b4b
SSDEEP

1572864:qNpdK2q3O3T03NmA8/zJLvmc7gj/pTxq1N3YOeNmA8/zJLvmc7g04v4JLT8wZ:Cu2q3CTuNmf/1L+c7g99q1NovNmf/1Lj

Score

1^/10

Malware Config

Signatures

Files

tmp
.exe windows x86

20a569897aad54d9b7713ff6a1e627e8

Code Sign

52:a4:e1:16:72:4a:21:78:6c:e5:e5:c0:9e:66:20:9a
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

27/07/2016, 00:00

Not After

27/07/2017, 23:59

Subject

CN=FSD International\, Inc,O=FSD International\, Inc,POSTALCODE=66061,STREET=1121 N Annie,L=Olathe,ST=Kansas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fa:c1:1f:10:ad:26:f8:f0:78:84:85:4b:0c:b9:44:1c:34:f6:e4:1e
Signer

Actual PE Digest

fa:c1:1f:10:ad:26:f8:f0:78:84:85:4b:0c:b9:44:1c:34:f6:e4:1e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidCreate

shlwapi

PathIsUNCW
PathRemoveFileSpecW
PathFindExtensionW
PathStripToRootW
PathFindFileNameW

kernel32

CopyFileW
DeleteFileW
GetThreadLocale
LoadLibraryW
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
InterlockedDecrement
GetCurrentProcessId
FindNextFileW
FileTimeToLocalFileTime
lstrcmpW
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
InterlockedExchange
CompareStringA
LoadLibraryExW
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
SetThreadPriority
SuspendThread
InterlockedIncrement
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GlobalGetAtomNameW
SetErrorMode
GetFileAttributesW
GetFileSizeEx
GlobalFlags
GetPrivateProfileIntW
WritePrivateProfileStringW
GetCurrentDirectoryW
lstrcpyW
GetTempFileNameW
GetTempPathW
SearchPathW
GetTickCount
GetProfileIntW
VirtualProtect
FindResourceExW
GetStartupInfoW
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MoveFileA
ExitThread
RtlUnwind
RaiseException
SetStdHandle
ExitProcess
HeapSize
VirtualAlloc
VirtualQuery
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
GetConsoleCP
GlobalSize
LCMapStringA
LCMapStringW
InitializeCriticalSectionAndSpinCount
GetStringTypeA
FormatMessageA
CreateThread
TerminateThread
GetExitCodeThread
GetStdHandle
SetEnvironmentVariableA
GetFileType
GetCurrentThreadId
GetSystemInfo
SetLastError
lstrlenA
GetComputerNameA
SystemTimeToFileTime
SetFileTime
GetFileTime
FileTimeToSystemTime
SetFileAttributesA
CreateEventA
GetOverlappedResult
CreateProcessA
Sleep
GetModuleFileNameA
GetVolumeInformationA
GetWindowsDirectoryA
GetFileInformationByHandle
GlobalReAlloc
GetSystemDirectoryA
GetCurrentDirectoryA
GetModuleHandleA
WriteFile
ReadFile
GetDiskFreeSpaceA
SetFilePointer
GetFileAttributesA
GetSystemTime
GetLocalTime
DeleteFileA
FlushFileBuffers
GetVersionExA
LoadLibraryA
FreeLibrary
LocalFree
LocalAlloc
GetCurrentProcess
GetCurrentThread
CreateFileW
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetVersion
FindClose
GetProcAddress
GetModuleHandleW
ResetEvent
SetEvent
WaitForSingleObject
FreeResource
GlobalAlloc
ResumeThread
GlobalFree
MulDiv
GlobalUnlock
GlobalLock
CreateEventW
RemoveDirectoryW
GetComputerNameW
GlobalMemoryStatusEx
GetDriveTypeW
GetSystemDirectoryW
GetWindowsDirectoryW
GetVersionExW
CloseHandle
DeviceIoControl
CreateFileA
WideCharToMultiByte
lstrlenW
GlobalMemoryStatus
FindFirstFileW
FormatMessageW
GetLastError
MultiByteToWideChar
CreateDirectoryW
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleFileNameW
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetDriveTypeA
GetConsoleMode

wininet

InternetCheckConnectionW

user32

WaitMessage
ReleaseCapture
WindowFromPoint
SetCapture
UnregisterClassW
LoadCursorW
GetSysColorBrush
DestroyMenu
GetMenuItemInfoW
InflateRect
ShowOwnedPopups
GetMessageW
ValidateRect
MapVirtualKeyW
GetKeyNameTextW
SetWindowContextHelpId
MapDialogRect
SystemParametersInfoW
MessageBeep
RedrawWindow
IsZoomed
PostQuitMessage
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
MoveWindow
SetWindowTextW
IsDialogMessageW
CheckDlgButton
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
DeleteMenu
SetRectEmpty
PostThreadMessageW
CopyAcceleratorTableW
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
GetAsyncKeyState
DestroyAcceleratorTable
LoadAcceleratorsW
CreateAcceleratorTableW
SetWindowRgn
NotifyWinEvent
CreatePopupMenu
SetParent
RegisterClipboardFormatW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
BeginDeferWindowPos
EnumChildWindows
DrawStateW
OpenClipboard
CopyImage
DestroyIcon
MessageBoxW
EnableWindow
GetClientRect
LoadImageW
SendMessageW
LoadIconW
GetSystemMenu
AppendMenuW
SetTimer
IsIconic
GetSystemMetrics
DrawIcon
PeekMessageW
TranslateMessage
DispatchMessageW
SetRect
GetDC
ReleaseDC
InvalidateRect
FillRect
GetSysColor
CopyRect
GetWindowRect
GetCursorPos
ScreenToClient
LockWindowUpdate
SetCursor
PeekMessageA
DispatchMessageA
wsprintfA
DefWindowProcA
FindWindowA
GetWindowTextA
SendMessageA
UnregisterClassA
DestroyWindow
WaitForInputIdle
EnumThreadWindows
CreateWindowExA
RegisterClassA
MessageBoxA
GetDesktopWindow
EndDialog
EndPaint
BeginPaint
ShowWindow
SetWindowPos
RegisterClassExA
LoadCursorA
UpdateWindow
RemoveMenu
GetSubMenu
GetMenuItemCount
InsertMenuW
GetMenuItemID
GetMenuStringW
GetMenuState
CharUpperW
UnhookWindowsHookEx
IsWindowEnabled
GetLastActivePopup
GetWindowLongW
GetParent
GetWindowThreadProcessId
GetNextDlgTabItem
GetDlgItem
IsWindow
CreateDialogIndirectParamW
SetActiveWindow
GetActiveWindow
LoadMenuW
GetWindow
GetWindowPlacement
SetClipboardData
CloseClipboard
EmptyClipboard
CharNextW
InvalidateRgn
GetNextDlgGroupItem
TranslateAcceleratorW
InsertMenuItemW
ReuseDDElParam
UnpackDDElParam
DrawIconEx
DrawEdge
DrawFrameControl
DrawFocusRect
SetCursorPos
UnionRect
EnableScrollBar
UpdateLayeredWindow
SetMenuDefaultItem
GetMenuDefaultItem
IsCharLowerW
MapVirtualKeyExW
IsClipboardFormatAvailable
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
FrameRect
GetUpdateRect
CharUpperBuffW
CopyIcon
SubtractRect
GetIconInfo
GetDoubleClickTime
CreateMenu
GetWindowRgn
DestroyCursor
SystemParametersInfoA
IntersectRect
OffsetRect
SetWindowLongW
GetMenu
CallWindowProcW
DefWindowProcW
GetDlgCtrlID
SetWindowPlacement
SetScrollInfo
GetScrollInfo
DeferWindowPos
EqualRect
AdjustWindowRectEx
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
PostMessageW
IsWindowVisible
ShowScrollBar
SetForegroundWindow
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
SetMenu
GetKeyState
TrackPopupMenu
ScrollWindow
MapWindowPoints
BringWindowToTop
SetClassLongW
IsMenu
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
IsRectEmpty
PtInRect
KillTimer

gdi32

DeleteDC
SelectObject
GetDeviceCaps
CreateSolidBrush
GetRgnBox
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
CreateRoundRectRgn
GetTextColor
SetDIBColorTable
GetDIBits
StretchBlt
SetPixel
CreateDIBSection
GetBkColor
CreateEllipticRgn
CreatePolygonRgn
Polyline
Ellipse
Polygon
Rectangle
RoundRect
CreatePalette
GetPaletteEntries
DeleteObject
CreateCompatibleDC
FillRgn
FrameRgn
GetBoundsRect
GetViewportOrgEx
LPtoDP
ExtFloodFill
SetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExW
GetTextFaceW
SetPixelV
GetWindowOrgEx
BitBlt
CreateCompatibleBitmap
TextOutA
SetBkMode
CopyMetaFileW
GetDCOrgEx
GetClipBox
SetTextColor
SetBkColor
GetObjectW
CreateBitmap
SaveDC
RestoreDC
SetPolyFillMode
SetROP2
SetMapMode
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
CreateRectRgnIndirect
PatBlt
CreateFontIndirectW
GetTextExtentPoint32W
GetTextMetricsW
SetRectRgn
CombineRgn
RealizePalette
GetMapMode
DPtoLP
PtInRegion
OffsetRgn

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegEnumValueA
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
GetFileSecurityW
GetSecurityDescriptorOwner
RegEnumKeyExW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyW
GetTokenInformation
LookupAccountNameA
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenSCManagerA
CloseServiceHandle
CreateServiceA
OpenServiceA
StartServiceA
QueryServiceStatus
ControlService
DeleteService
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegCreateKeyExW
RegSetValueA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
FreeSid
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
DuplicateToken
OpenProcessToken
OpenThreadToken
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
GetUserNameW
LookupAccountNameW
ConvertSidToStringSidW

shell32

SHAppBarMessage
ShellExecuteW
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteExW
FindExecutableA
DragQueryFileW
DragFinish
SHGetSpecialFolderPathW
SHGetFileInfoW

comctl32

InitCommonControlsEx
ImageList_GetIconSize

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter
CoRevokeClassObject
RevokeDragDrop
CoLockObjectExternal
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoFreeUnusedLibraries
OleUninitialize
OleGetClipboard
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
OleLockRunning
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
StringFromGUID2
OleInitialize
RegisterDragDrop

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
OleCreateFontIndirect
VariantInit
VariantChangeType
SysAllocStringLen
VariantClear
OleLoadPicture
SysStringLen
SysAllocString
SysFreeString
VariantCopy

gdiplus

GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits

ws2_32

connect
socket
shutdown
closesocket
recv
send
WSACleanup
gethostbyname
htons
inet_addr
WSAStartup
setsockopt

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundW

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 415KB - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 476KB - Virtual size: 476KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20a569897aad54d9b7713ff6a1e627e8

Code Sign

52:a4:e1:16:72:4a:21:78:6c:e5:e5:c0:9e:66:20:9aCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

fa:c1:1f:10:ad:26:f8:f0:78:84:85:4b:0c:b9:44:1c:34:f6:e4:1eSigner

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

shlwapi

kernel32

wininet

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

oleaut32

gdiplus

ws2_32

imm32

winmm

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 415KB - Virtual size: 415KB

.data Size: 37KB - Virtual size: 70KB

.rsrc Size: 476KB - Virtual size: 476KB

.reloc Size: 155KB - Virtual size: 155KB

52:a4:e1:16:72:4a:21:78:6c:e5:e5:c0:9e:66:20:9a
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

fa:c1:1f:10:ad:26:f8:f0:78:84:85:4b:0c:b9:44:1c:34:f6:e4:1e
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 415KB - Virtual size: 415KB

.data
Size: 37KB - Virtual size: 70KB

.rsrc
Size: 476KB - Virtual size: 476KB

.reloc
Size: 155KB - Virtual size: 155KB