CompatTelRunner[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CompatTelRunner.exe
Size

22KB
MD5

3053a2a758bf83ae63fa8573f6f35f0c
SHA1

88e9e49e194b22673478bd3fea0041f1998cf818
SHA256

43c5411007e93e5754bf6c92b4a3b46d66dec8902404888a547ea80fe0610021
SHA512

9d99999ef6a2a9e8c911a81c46c92225837355d03f0ff41632443dee532ba96ad96af13ce1a806108a03fd362fcd602eb3f83f561db6e3d71b71ea805ec8eda4
SSDEEP

384:rNKYcFInIffiALKbyjX+agUipaWas0WrsEMuJXi6uT+quHpBjbOjBM1/5:9IffiSldipH00fxkMn

Score

1^/10

Malware Config

Signatures

Files

CompatTelRunner.exe
.exe windows x86

ff93f1d391d1dd5a96b743c39b480d9d

Code Sign

33:00:00:00:78:32:5d:60:ff:a5:91:38:1d:00:00:00:00:00:78
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:40

Not After

04/09/2016, 17:40

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:35:4c:94:ff:5b:25:be:52:77:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/05/2015, 17:48

Not After

14/03/2016, 17:48

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

09/05/2001, 23:19

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

f5:4e:69:98:a6:aa:b6:2f:43:1c:90:bf:e8:96:79:bd:43:cd:35:ba
Signer

Actual PE Digest

f5:4e:69:98:a6:aa:b6:2f:43:1c:90:bf:e8:96:79:bd:43:cd:35:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
CreateProcessW
CompareFileTime
VerSetConditionMask
VerifyVersionInfoW
HeapAlloc
GetProcessHeap
HeapFree
TerminateProcess
CloseHandle
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
lstrcmpA
FreeLibrary
GetProcAddress
LoadLibraryA
GetLastError
GetCurrentProcess

msvcrt

??1type_info@@UAE@XZ
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
sprintf_s
memcpy_s
_wcsicmp
rand_s
free
malloc
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
memset

ole32

CoUninitialize
CoCreateInstance
CoInitialize
CoCreateGuid

oleaut32

VariantInit
SysAllocString
SysFreeString

shlwapi

StrCmpNA

advapi32

RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegGetValueW
RegSetValueExW
RegOpenKeyExW

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff93f1d391d1dd5a96b743c39b480d9d

Code Sign

33:00:00:00:78:32:5d:60:ff:a5:91:38:1d:00:00:00:00:00:78Certificate

Extended Key Usages

33:00:00:00:35:4c:94:ff:5b:25:be:52:77:00:00:00:00:00:35Certificate

Extended Key Usages

79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

f5:4e:69:98:a6:aa:b6:2f:43:1c:90:bf:e8:96:79:bd:43:cd:35:baSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ole32

oleaut32

shlwapi

advapi32

Sections

.text Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 960B

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 648B

33:00:00:00:78:32:5d:60:ff:a5:91:38:1d:00:00:00:00:00:78
Certificate

33:00:00:00:35:4c:94:ff:5b:25:be:52:77:00:00:00:00:00:35
Certificate

79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

f5:4e:69:98:a6:aa:b6:2f:43:1c:90:bf:e8:96:79:bd:43:cd:35:ba
Signer

.text
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 960B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 648B