chat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

chat
Size

21.5MB
MD5

f25e8693289a79905c3583f0cd744cd9
SHA1

72a8a1e00d61bc6581e79f5e194a9b2b295a1adc
SHA256

28eb7478cdf53820a76b8aac0d5f1755f5d4ee105b1a457f76f21312ae8d2389
SHA512

ed51e8d9327cb97f3f115e062648a23d94708cf0d52f853cf03c311e1b84d86b925a9838b6c79d6b1b16be25e589309afa57d5b3c803a7f3d3b5508a755c6348
SSDEEP

393216:reZ+reBmc7HKxNmuvvobdwGRY2KoYDnjoHk+fDzjo6FgHNtOr3JBfK7:4nmIuHSquK5DngkSowENCJB0

Score

1^/10

Malware Config

Signatures

Files

chat
.exe windows x86

91f4e0cc7a687a97a003ff6206e2edfb

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29/10/2015, 11:30

Not After

09/06/2027, 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

66:c5:dc:c1:4b:51:78:09:c1:72:b4:4b:7e:97:84:f7
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

10/08/2016, 20:47

Not After

10/08/2017, 07:43

Subject

CN=Open Source Developer\, Robin Krom,O=Open Source Developer,C=DE,1.2.840.113549.1.9.1=#0c16676574677265656e73686f7440676d61696c2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08/03/2016, 13:10

Not After

30/05/2027, 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29/10/2015, 11:30

Not After

09/06/2027, 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

66:c5:dc:c1:4b:51:78:09:c1:72:b4:4b:7e:97:84:f7
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

10/08/2016, 20:47

Not After

10/08/2017, 07:43

Subject

CN=Open Source Developer\, Robin Krom,O=Open Source Developer,C=DE,1.2.840.113549.1.9.1=#0c16676574677265656e73686f7440676d61696c2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08/03/2016, 13:10

Not After

30/05/2027, 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7e:62:af:ea:2e:f5:04:a3:09:be:89:4e:ca:3b:a7:b5:23:39:53:5b:8f:23:77:19:6a:b7:c0:8f:80:69:68:2f
Signer

Actual PE Digest

7e:62:af:ea:2e:f5:04:a3:09:be:89:4e:ca:3b:a7:b5:23:39:53:5b:8f:23:77:19:6a:b7:c0:8f:80:69:68:2f

Digest Algorithm

sha256

PE Digest Matches

false

35:96:6a:cd:e7:b3:ba:c4:c9:fe:98:f2:b7:0f:40:7c:13:e4:62:89
Signer

Actual PE Digest

35:96:6a:cd:e7:b3:ba:c4:c9:fe:98:f2:b7:0f:40:7c:13:e4:62:89

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxW

pdh

PdhCloseQuery

kernel32

LoadResource
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

iphlpapi

FreeMibTable

netapi32

NetUserEnum

secur32

DeleteSecurityContext

shell32

ShellExecuteExW

advapi32

AllocateAndInitializeSid

ole32

CoUninitialize

ws2_32

WSASocketW

ntdll

RtlNtStatusToDosError

bcrypt

BCryptGenRandom

crypt32

CertEnumCertificatesInStore

powrprof

CallNtPowerInformation

oleaut32

SysAllocString

psapi

GetPerformanceInfo

Sections

.text
Size: 842KB - Virtual size: 842KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 378KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data0
Size: 10.5MB - Virtual size: 10.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data1
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data2
Size: 9.7MB - Virtual size: 9.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91f4e0cc7a687a97a003ff6206e2edfb

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

66:c5:dc:c1:4b:51:78:09:c1:72:b4:4b:7e:97:84:f7Certificate

Extended Key Usages

Key Usages

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70Certificate

Extended Key Usages

Key Usages

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

66:c5:dc:c1:4b:51:78:09:c1:72:b4:4b:7e:97:84:f7Certificate

Extended Key Usages

Key Usages

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70Certificate

Extended Key Usages

Key Usages

7e:62:af:ea:2e:f5:04:a3:09:be:89:4e:ca:3b:a7:b5:23:39:53:5b:8f:23:77:19:6a:b7:c0:8f:80:69:68:2fSigner

35:96:6a:cd:e7:b3:ba:c4:c9:fe:98:f2:b7:0f:40:7c:13:e4:62:89Signer

Headers

DLL Characteristics

File Characteristics

Imports

user32

pdh

kernel32

iphlpapi

netapi32

secur32

shell32

advapi32

ole32

ws2_32

ntdll

bcrypt

crypt32

powrprof

oleaut32

psapi

Sections

.text Size: 842KB - Virtual size: 842KB

.rdata Size: 378KB - Virtual size: 377KB

.data Size: 2KB - Virtual size: 5KB

.data0 Size: 10.5MB - Virtual size: 10.5MB

.data1 Size: 2KB - Virtual size: 1KB

.data2 Size: 9.7MB - Virtual size: 9.7MB

.reloc Size: 35KB - Virtual size: 35KB

.rsrc Size: 66KB - Virtual size: 65KB

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

66:c5:dc:c1:4b:51:78:09:c1:72:b4:4b:7e:97:84:f7
Certificate

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

66:c5:dc:c1:4b:51:78:09:c1:72:b4:4b:7e:97:84:f7
Certificate

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

7e:62:af:ea:2e:f5:04:a3:09:be:89:4e:ca:3b:a7:b5:23:39:53:5b:8f:23:77:19:6a:b7:c0:8f:80:69:68:2f
Signer

35:96:6a:cd:e7:b3:ba:c4:c9:fe:98:f2:b7:0f:40:7c:13:e4:62:89
Signer

.text
Size: 842KB - Virtual size: 842KB

.rdata
Size: 378KB - Virtual size: 377KB

.data
Size: 2KB - Virtual size: 5KB

.data0
Size: 10.5MB - Virtual size: 10.5MB

.data1
Size: 2KB - Virtual size: 1KB

.data2
Size: 9.7MB - Virtual size: 9.7MB

.reloc
Size: 35KB - Virtual size: 35KB

.rsrc
Size: 66KB - Virtual size: 65KB