MediaCreationTool[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

MediaCreationTool.exe
Size

17.6MB
MD5

136189ae572af9b1cc7bab9ab25f52ce
SHA1

262088cf4b0f05d30db0fe86757e306f0aaa4e9b
SHA256

2f278f5ddf7a8013d66801b1f2cb4d42df3c385a5624c6bb3b0e575756e2db0f
SHA512

d94c55a0a9bcf564fbf63d45c6e10beeb3a548d58eee4322ba276fd3d00f83cd55d822279715eb0acece5dd7a3dce6c15be74d0dca9c5ac69a99c0d16b386d1e
SSDEEP

196608:oH54g9pADzivLJk4WvmfpLPZH+wSHqR2v8:oH549U+ufprZHPSc2E

Score

1^/10

Malware Config

Signatures

Files

MediaCreationTool.exe
.exe windows x86

dd55c784eae935e3c10dc128f6a1c825

Code Sign

33:00:00:00:8c:ff:f2:e5:18:1e:16:21:22:00:00:00:00:00:8c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07-10-2015 18:14

Not After

07-01-2017 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-06-2015 17:42

Not After

04-09-2016 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28-10-2015 20:31

Not After

28-01-2017 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:54:55:36:e9:73:23:50:73:94:c0:21:30:36:33:3e:a5:c2:b3:6f:54:0e:5f:fe:f7:12:f3:4e:f7:f6:61:2e
Signer

Actual PE Digest

4a:54:55:36:e9:73:23:50:73:94:c0:21:30:36:33:3e:a5:c2:b3:6f:54:0e:5f:fe:f7:12:f3:4e:f7:f6:61:2e

Digest Algorithm

sha256

PE Digest Matches

true

e0:20:1b:ab:11:bd:3c:e2:a9:11:a3:1c:d4:64:49:54:0c:2d:39:a4
Signer

Actual PE Digest

e0:20:1b:ab:11:bd:3c:e2:a9:11:a3:1c:d4:64:49:54:0c:2d:39:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

advapi32

OpenProcessToken
OpenThreadToken
GetTokenInformation
RegEnumKeyW
CopySid
RegCreateKeyExW
RegQueryValueExW
CreateProcessAsUserW
RegQueryInfoKeyW
InitializeSecurityDescriptor
SetTokenInformation
RegDeleteKeyW
SetSecurityDescriptorDacl
GetAce
DuplicateTokenEx
RegDeleteValueW
InitializeAcl
AllocateAndInitializeSid
AddAccessAllowedAce
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
FreeSid
RegSetKeySecurity
RegOpenKeyExW
GetLengthSid
CheckTokenMembership
RegCloseKey
RegSetValueExW
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceEnableFlags
QueryAllTracesW
StopTraceW
GetTraceLoggerHandle
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW

kernel32

CreateEventW
WaitForMultipleObjects
FindNextFileW
DeleteCriticalSection
CloseHandle
DeleteFileW
GetCurrentProcessId
LocalFree
GetSystemTime
SetFileAttributesW
ExpandEnvironmentStringsW
LockResource
CreateHardLinkW
IsWow64Process
IsValidCodePage
VerifyVersionInfoW
IsValidLocale
VerSetConditionMask
GetUserDefaultUILanguage
CreateFileMappingW
GetSystemDefaultUILanguage
UnmapViewOfFile
MapViewOfFile
SearchPathW
GetExitCodeProcess
LeaveCriticalSection
ResetEvent
FindClose
EnterCriticalSection
LockFileEx
GetLastError
GetFileSizeEx
FlushFileBuffers
CompareStringW
GetOverlappedResult
CreateFileW
GetTimeZoneInformation
GetModuleFileNameW
ReadFile
TerminateProcess
GetFileAttributesW
SetThreadPreferredUILanguages
GetLocaleInfoW
GetVersionExW
GetPrivateProfileIntW
CopyFileW
GlobalUnlock
GlobalLock
InitializeCriticalSection
LoadLibraryW
FindResourceW
LocalFileTimeToFileTime
SetFileTime
CreateFileA
DosDateTimeToFileTime
DuplicateHandle
GetShortPathNameW
SetEndOfFile
SetFilePointer
HeapSize
HeapReAlloc
WideCharToMultiByte
SetCurrentDirectoryW
GetFileInformationByHandle
DeviceIoControl
CopyFileExW
GetPrivateProfileSectionW
SetLastError
GetCurrentDirectoryW
LoadLibraryExW
FreeLibrary
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
Sleep
HeapAlloc
HeapFree
GetModuleHandleExW
GetProcessHeap
GetProcAddress
GetFullPathNameW
GetCommandLineW
CreateMutexW
FindFirstFileW
GetNativeSystemInfo
GetDriveTypeW
FindResourceExW
LoadResource
CreateProcessW
SystemTimeToTzSpecificLocalTime
MoveFileExW
GetCurrentProcess
SetFilePointerEx
GetLogicalDriveStringsW
GetSystemWindowsDirectoryW
CreateDirectoryW
WaitForSingleObject
SetEvent
GetModuleHandleW
GetCurrentThread
UnlockFileEx
WriteFile
GetSystemDirectoryW
MulDiv
InitializeCriticalSectionAndSpinCount

user32

GetFocus
GetSysColorBrush
GetSystemMetrics
IsWindowVisible
SystemParametersInfoW
ClientToScreen
GetClientRect
GetSystemMenu
PostMessageW
GetParent
GetKeyState
EnableMenuItem
SetWindowLongW
LoadStringW
IsChild
EnableWindow
SendMessageW
MessageBoxW
PostThreadMessageW
KillTimer
LoadImageW
GetNextDlgTabItem
GetSysColor
InvalidateRect
GetDC
FillRect
CopyRect
RedrawWindow
DrawFocusRect
DrawTextW
GetWindowLongW
SetTimer
ScreenToClient
GetWindowRect

mfc42u

ord3949
ord2854
ord2397
ord5871
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord4270
ord3076
ord2971
ord3825
ord3826
ord6279
ord6278
ord1143
ord324
ord3820
ord3074
ord2078
ord2161
ord3952
ord4229
ord1808
ord329
ord5978
ord3196
ord4131
ord643
ord543
ord803
ord3915
ord1787
ord2567
ord4390
ord1633
ord323
ord6153
ord640
ord5781
ord470
ord755
ord3871
ord2855
ord1571
ord6466
ord600
ord269
ord826
ord3133
ord567
ord5273
ord2116
ord2438
ord5257
ord1720
ord6195
ord6193
ord6211
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1768
ord4073
ord4621
ord6051
ord3397
ord4221
ord1560
ord3621
ord2406
ord1202
ord1106
ord6433
ord3614
ord1165
ord3716
ord795
ord4704
ord4992
ord4847
ord4419
ord1767
ord6048
ord5261
ord565
ord5711
ord5285
ord5303
ord4693
ord4074
ord5299
ord5296
ord3341
ord817
ord2388
ord3658
ord1131
ord268
ord2385
ord2294
ord1940
ord609
ord540
ord861
ord2820
ord800
ord4418
ord4616
ord4075
ord4282
ord3000
ord3084
ord3087
ord3870
ord4118
ord2634
ord5977
ord5047
ord2371
ord3579
ord3568
ord1634
ord641
ord5276
ord4470
ord521
ord4162
ord6303
ord3792
ord4294
ord1921
ord2859
ord4370
ord2637
ord2506
ord2858

msvcrt

_XcptFilter
__CxxFrameHandler3
__p__commode
_amsg_exit
_wcmdln
_initterm
__wgetmainargs
_exit
__set_app_type
exit
_wtoi
wcsstr
towlower
_wcsnicmp
_wcsicmp
wcsrchr
wcsncmp
bsearch
memmove
wcschr
__setusermatherr
__p__fmode
_cexit
_vsnwprintf
__RTDynamicCast
memcpy
_except_handler4_common
_controlfp
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
memset

ntdll

RtlAllocateHeap
RtlFreeHeap
RtlNtStatusToDosError
NtSetInformationFile
RtlGetVersion
RtlAdjustPrivilege
NtDuplicateToken

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

rpcrt4

UuidCreate
I_RpcMapWin32Status
UuidToStringW
RpcStringFreeW

wimgapi

WIMUnmountImage
WIMSetFileIOCallbackTemporaryPath
WIMInitFileIOCallbacks

comctl32

InitCommonControlsEx

shell32

CommandLineToArgvW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken

gdi32

GetStockObject
GetObjectW
CreateFontIndirectW
CreateCompatibleDC
CreateSolidBrush
StretchBlt
BitBlt
SetBkMode
SetTextColor
DeleteDC
GetDeviceCaps
SetBrushOrgEx
EnumFontFamiliesExW
CreateICW
CreateDCW
TranslateCharsetInfo

oleaut32

SysFreeString

version

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

bcrypt

BCryptCreateHash
BCryptFinishHash
BCryptHashData
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

cabinet

ord22
ord23
ord20

uxtheme

IsAppThemed

wdscore

CurrentIP
ConstructPartialMsgVW
WdsSetupLogMessageW

Sections

.text
Size: 193KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.boxload
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10.5MB - Virtual size: 10.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd55c784eae935e3c10dc128f6a1c825

Code Sign

33:00:00:00:8c:ff:f2:e5:18:1e:16:21:22:00:00:00:00:00:8cCertificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:efCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

4a:54:55:36:e9:73:23:50:73:94:c0:21:30:36:33:3e:a5:c2:b3:6f:54:0e:5f:fe:f7:12:f3:4e:f7:f6:61:2eSigner

e0:20:1b:ab:11:bd:3c:e2:a9:11:a3:1c:d4:64:49:54:0c:2d:39:a4Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

mfc42u

msvcrt

ntdll

ole32

rpcrt4

wimgapi

comctl32

shell32

userenv

wtsapi32

gdi32

oleaut32

version

bcrypt

cabinet

uxtheme

wdscore

Sections

.text Size: 193KB - Virtual size: 193KB

.data Size: 2KB - Virtual size: 11KB

.idata Size: 9KB - Virtual size: 8KB

.boxload Size: 512B - Virtual size: 64B

.rsrc Size: 10.5MB - Virtual size: 10.5MB

.reloc Size: 13KB - Virtual size: 12KB

33:00:00:00:8c:ff:f2:e5:18:1e:16:21:22:00:00:00:00:00:8c
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

4a:54:55:36:e9:73:23:50:73:94:c0:21:30:36:33:3e:a5:c2:b3:6f:54:0e:5f:fe:f7:12:f3:4e:f7:f6:61:2e
Signer

e0:20:1b:ab:11:bd:3c:e2:a9:11:a3:1c:d4:64:49:54:0c:2d:39:a4
Signer

.text
Size: 193KB - Virtual size: 193KB

.data
Size: 2KB - Virtual size: 11KB

.idata
Size: 9KB - Virtual size: 8KB

.boxload
Size: 512B - Virtual size: 64B

.rsrc
Size: 10.5MB - Virtual size: 10.5MB

.reloc
Size: 13KB - Virtual size: 12KB