cp029814[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

cp029814.exe
Size

3.1MB
MD5

a9448f9f27377d55c49d1e85990795b3
SHA1

386a76b8d722fb8d14ea3836d8c5f283b138727e
SHA256

981350ae78e538be0229290a8c95c892c4a58d6dfa97dca935061ff5992ffa35
SHA512

885651fa1d72b9b40c98278160f73931af723ce10f5ed5a11e01e7d2207bcc1fb74ca3d4d26ce4d24fc43fbd787bf1286a24f308dcb45d41180bc78f8a3c9690
SSDEEP

49152:8DvmqfHIFtJAPwOPSU+t4NFN/E0x4lB2iQt4SRKNvExdYLiPbxGPWSsW6zWoY/wA:cwAPwO44F9uB24rNcxdVaWxW6zWoYIA

Score

1^/10

Malware Config

Signatures

Files

cp029814.exe
.exe windows x64

c273ddbe07d29b159e05c271c66e7c01

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:ff:c7:97:d1:37:54:52:2e:2c:27:ca:d6:92:f1:40
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/11/2016, 00:00

Not After

28/11/2017, 23:59

Subject

CN=Hewlett Packard Enterprise Company,OU=HP Cyber Security,O=Hewlett Packard Enterprise Company,POSTALCODE=94304,STREET=3000 Hanover Street,L=Palo Alto,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:28

Not After

15/08/2023, 20:38

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:26

Not After

15/08/2023, 20:36

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:b0:79:4a:36:e1:d6:4f:4f:df:5b:99:47:4f:e8:3d
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/06/2016, 00:00

Not After

08/06/2017, 23:59

Subject

CN=Hewlett Packard Enterprise Company,OU=HP Cyber Security,O=Hewlett Packard Enterprise Company,POSTALCODE=94304,STREET=3000 Hanover Street,L=Palo Alto,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:c2:77:c3:4c:22:5a:51:6d:de:ae:22:a3:c4:f4:58:89:45:e7:c6:c9:ee:17:3e:32:5c:df:4c:d4:3a:87:5a
Signer

Actual PE Digest

15:c2:77:c3:4c:22:5a:51:6d:de:ae:22:a3:c4:f4:58:89:45:e7:c6:c9:ee:17:3e:32:5c:df:4c:d4:3a:87:5a

Digest Algorithm

sha256

PE Digest Matches

true

5e:66:a0:84:bd:ce:6c:5f:b7:19:f1:57:ef:67:8f:9a:24:de:66:7a
Signer

Actual PE Digest

5e:66:a0:84:bd:ce:6c:5f:b7:19:f1:57:ef:67:8f:9a:24:de:66:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
GetDriveTypeW
RemoveDirectoryW
SetFileAttributesW
WriteFile
GetTempPathW
CloseHandle
DuplicateHandle
GetLastError
SetErrorMode
CreatePipe
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
CreateProcessW
SetProcessShutdownParameters
GetLocalTime
FreeLibrary
GetModuleFileNameW
GlobalFree
LocalAlloc
LocalSize
LocalFree
FormatMessageW
lstrcmpiA
lstrcmpiW
LoadLibraryW
CopyFileW
MoveFileExW
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetFileSize
GetFileTime
LocalFileTimeToFileTime
ReadFile
SetFilePointer
SetFileTime
HeapAlloc
HeapFree
GetProcessHeap
lstrcmpA
lstrcpynA
lstrlenA
MultiByteToWideChar
HeapReAlloc
GetTempFileNameW
ExpandEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
GetCurrentDirectoryW
DeleteCriticalSection
EncodePointer
DecodePointer
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
GetACP
GetFileAttributesExW
GetSystemTimeAsFileTime
SetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
ExitProcess
GetModuleHandleExW
GetProcAddress
HeapSize
SetLastError
GetCurrentThreadId
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
TerminateProcess
GetStartupInfoW
GetModuleHandleW
GetConsoleMode
SetCurrentDirectoryW
InitOnceExecuteOnce
GetConsoleCP
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetUserDefaultLocaleName
LCMapStringEx
IsValidLocaleName
EnumSystemLocalesEx
QueryPerformanceCounter
GetTickCount64
OutputDebugStringW
LoadLibraryExW
FlushFileBuffers
WriteConsoleW
SetEnvironmentVariableW
GetCommandLineW
GetStdHandle
WideCharToMultiByte
lstrlenW
lstrcatW
lstrcpyW
lstrcmpW
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
DosDateTimeToFileTime
InitializeCriticalSectionEx
SetFilePointerEx

user32

SetWindowTextW
AppendMenuW
GetSystemMenu
GetSystemMetrics
EnableWindow
SetFocus
SendDlgItemMessageW
SetDlgItemTextW
DialogBoxParamW
MessageBoxW
MoveWindow
CloseWindow
CharNextW
DestroyWindow
CallWindowProcW
PeekMessageW
EndDialog
SetDlgItemTextA
wsprintfW
CreateDialogParamW
ShowWindow
LoadStringW
SendMessageW
SetWindowPos
GetDlgItem
GetClientRect
LoadImageW
DestroyIcon
GetDesktopWindow
SetWindowLongW
OpenIcon
ScreenToClient
DispatchMessageW
GetParent
GetWindowRect

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
InitiateSystemShutdownW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW

ole32

CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateGuid
StringFromCLSID
CoCreateInstance

shell32

SHGetPathFromIDListW
SHGetMalloc
Shell_NotifyIconW
CommandLineToArgvW
SHBrowseForFolderW

oleaut32

SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
VariantInit
SafeArrayGetElement
SysFreeString
SafeArrayCreate

shlwapi

PathStripPathW

Sections

.text
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c273ddbe07d29b159e05c271c66e7c01

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

42:ff:c7:97:d1:37:54:52:2e:2c:27:ca:d6:92:f1:40Certificate

Extended Key Usages

Key Usages

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36Certificate

Extended Key Usages

Key Usages

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35Certificate

Extended Key Usages

Key Usages

14:b0:79:4a:36:e1:d6:4f:4f:df:5b:99:47:4f:e8:3dCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

15:c2:77:c3:4c:22:5a:51:6d:de:ae:22:a3:c4:f4:58:89:45:e7:c6:c9:ee:17:3e:32:5c:df:4c:d4:3a:87:5aSigner

5e:66:a0:84:bd:ce:6c:5f:b7:19:f1:57:ef:67:8f:9a:24:de:66:7aSigner

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

Sections

.text Size: 196KB - Virtual size: 195KB

.rdata Size: 69KB - Virtual size: 69KB

.data Size: 15KB - Virtual size: 29KB

.pdata Size: 8KB - Virtual size: 8KB

.rsrc Size: 24KB - Virtual size: 24KB

.reloc Size: 5KB - Virtual size: 5KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

42:ff:c7:97:d1:37:54:52:2e:2c:27:ca:d6:92:f1:40
Certificate

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

14:b0:79:4a:36:e1:d6:4f:4f:df:5b:99:47:4f:e8:3d
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

15:c2:77:c3:4c:22:5a:51:6d:de:ae:22:a3:c4:f4:58:89:45:e7:c6:c9:ee:17:3e:32:5c:df:4c:d4:3a:87:5a
Signer

5e:66:a0:84:bd:ce:6c:5f:b7:19:f1:57:ef:67:8f:9a:24:de:66:7a
Signer

.text
Size: 196KB - Virtual size: 195KB

.rdata
Size: 69KB - Virtual size: 69KB

.data
Size: 15KB - Virtual size: 29KB

.pdata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 24KB - Virtual size: 24KB

.reloc
Size: 5KB - Virtual size: 5KB