1cb14fef59efc195ab77c32d268f408761087ead2764444412aeee51ce46ba1b

Sharing

Copy URL

Twitter E-mail

General

Target

1cb14fef59efc195ab77c32d268f408761087ead2764444412aeee51ce46ba1b
Size

1.3MB
MD5

c52dbdd2ca8b78f1f6eb05ba9f8b9b47
SHA1

0a9a3d3234b57733ac2cc87e6dd4e39ef9b3c341
SHA256

1cb14fef59efc195ab77c32d268f408761087ead2764444412aeee51ce46ba1b
SHA512

fb61e9536a5a9332aa05af44c5e79b1ab2a51c15363425fd90411fc1baa8d57dea81fb53a9f2ae7bca463e4fe8e8d657311cfb9260a5e73773c3baaffb774ca9
SSDEEP

24576:0lQ3G3eNNXUcWmt5WJd4myQ0lQHfQolLzQBpGyTHOga/zM3W:j0eNNXBsdJoolipvTHALM3W

Score

1^/10

Malware Config

Signatures

Files

1cb14fef59efc195ab77c32d268f408761087ead2764444412aeee51ce46ba1b
.exe windows x86

c06acc2a3a092a7fc8d4970114b7230e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9f:46:92:be:d6:3a:6b:2e:68:f8:c8:9a:e9:58:09:bb
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13-02-2020 00:00

Not After

12-02-2022 23:59

Subject

CN=Tanuj Malik,O=Tanuj Malik,POSTALCODE=110049,STREET=B-19 South Extension -1,L=New Delhi,ST=Delhi,C=IN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

01-02-2010 00:00

Not After

18-01-2038 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e2:4f:6c:26:f8:80:db:fc:c3:53:56:34:08:58:28:f7:25:98:a7:31:de:a8:7f:e2:9d:e9:30:52:9c:e1:56:44
Signer

Actual PE Digest

e2:4f:6c:26:f8:80:db:fc:c3:53:56:34:08:58:28:f7:25:98:a7:31:de:a8:7f:e2:9d:e9:30:52:9c:e1:56:44

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Thread32Next
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetLongPathNameW
IsWow64Process
Process32NextW
Process32FirstW
GetPrivateProfileIntW
InterlockedExchange
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
LocalAlloc
VirtualAlloc
lstrcmpA
LoadLibraryExW
InterlockedIncrement
InterlockedDecrement
GlobalUnlock
WriteFile
GetTempFileNameW
DeleteFileW
GetFileSize
WritePrivateProfileStringW
GlobalFree
HeapWalk
HeapLock
HeapUnlock
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
GetLocaleInfoW
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
GlobalAlloc
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemWindowsDirectoryW
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
FatalAppExitA
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleHandleA
GetCurrentThread
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoW
ExitProcess
VirtualQuery
VirtualProtect
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
lstrlenA
DeviceIoControl
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
GetSystemDirectoryW
HeapFree
GlobalReAlloc
FreeResource
MulDiv
LoadLibraryW
FlushInstructionCache
SetLastError
RaiseException
GlobalSize
GlobalLock
GetProcessHeap
GetDateFormatA
CreateEventW
GetTickCount
ResetEvent
CreateThread
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexW
lstrcmpiA
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
InterlockedCompareExchange
Sleep
SetFilePointer
ReadFile
GetSystemInfo
GetWindowsDirectoryW
GetCommandLineW
GetLogicalDriveStringsW
lstrcmpiW
QueryDosDeviceW
lstrcpyW
lstrcatW
LocalFree
GetLastError
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetShortPathNameW
OpenProcess
SetUnhandledExceptionFilter
TerminateProcess
GetProcAddress
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
OutputDebugStringW
CreateDirectoryW
CreateProcessW
CloseHandle
GetModuleFileNameW
GetPrivateProfileStringW
GetVersionExW
GetLocalTime
SystemTimeToFileTime
MultiByteToWideChar
FindResourceExW
LoadResource
LockResource
HeapAlloc
SizeofResource
FindResourceW
WideCharToMultiByte
lstrlenW
IsValidLocale
DebugBreak

user32

CreateWindowExW
GetShellWindow
GetWindowThreadProcessId
RegisterClassW
DefWindowProcW
PostQuitMessage
KillTimer
ShowWindow
SetTimer
IntersectRect
UnregisterClassA
GetWindowLongW
SetWindowPos
SetWindowRgn
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
GetParent
LoadImageW
GetSystemMetrics
SetWindowLongW
RedrawWindow
MoveWindow
InvalidateRect
DestroyIcon
EndDialog
SendMessageW
PtInRect
GetActiveWindow
DispatchMessageW
TranslateMessage
PeekMessageW
SetForegroundWindow
SystemParametersInfoW
PostMessageW
FindWindowW
IsWindow
SendMessageTimeoutW
AdjustWindowRectEx
CharNextW
GetMessageW
GetClassInfoW
MessageBoxW
EnumWindows
RegisterClassExW
GetClassInfoExW
GetDlgItem
CallWindowProcW
DrawTextW
DrawIconEx
WindowFromPoint
IsWindowVisible
FindWindowExW
ScreenToClient
GetDlgCtrlID
SetFocus
GetCursorPos
GetClassLongW
FillRect
UpdateLayeredWindow
EndPaint
BeginPaint
OffsetRect
UpdateWindow
ReleaseCapture
GetCapture
SetCapture
ReleaseDC
IsRectEmpty
CopyRect
SetRect
DestroyWindow
CreateDialogIndirectParamW
DialogBoxIndirectParamW
GetDesktopWindow
GetDC
LoadCursorW
SetCursor
IsDialogMessageW

gdi32

GetDIBits
CreateCompatibleBitmap
CreateRectRgnIndirect
IntersectClipRect
CreateDIBSection
SetViewportOrgEx
BitBlt
ExcludeClipRect
SetBkColor
ExtTextOutW
StretchBlt
CreateCompatibleDC
GetObjectW
DeleteDC
GetStockObject
CreateSolidBrush
DeleteObject
SelectObject
TextOutW
SetBkMode
GetTextColor
GetClipBox
SetTextColor
SetStretchBltMode
GetObjectA
CreateRoundRectRgn
GetTextExtentPoint32W
CreateRectRgn
CombineRgn
GetDeviceCaps
CreatePolygonRgn
CreateFontIndirectW
CreateDCW
OffsetViewportOrgEx

advapi32

RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertSidToStringSidW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetTokenInformation
DuplicateTokenEx

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHGetFileInfoW
CommandLineToArgvW

ole32

GetHGlobalFromStream
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CreateStreamOnHGlobal

oleaut32

SysAllocStringLen
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantInit
VariantClear

shlwapi

PathFileExistsW
PathAppendW
PathFindFileNameW
PathRemoveFileSpecW
StrStrIW
StrChrW
StrCmpNW
PathIsDirectoryW
PathCombineW
StrCmpNIA
StrRChrIW
PathFindExtensionW
StrCmpNIW
StrCmpW
StrChrIW
SHSetValueW
SHGetValueW
StrStrIA
StrCmpIW

comctl32

ImageList_Destroy
ImageList_Create
InitCommonControlsEx
_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdiplusStartup
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawString
GdipSetTextRenderingHint
GdipStringFormatGetGenericTypographic
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCloneStringFormat
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipAlloc
GdipFree
GdipDrawImageRectRectI
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
VerQueryValueA

psapi

EnumProcessModules
GetProcessImageFileNameW
GetModuleFileNameExW

iphlpapi

GetPerAdapterInfo
GetAdaptersInfo

crypt32

CertGetNameStringW
CertFreeCertificateContext
CryptDecodeObject
CryptQueryObject
CryptMsgGetParam
CertCloseStore
CryptMsgClose
CertFindCertificateInStore

imm32

ImmDisableIME

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

Sections

.text
Size: 1002KB - Virtual size: 1002KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c06acc2a3a092a7fc8d4970114b7230e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

9f:46:92:be:d6:3a:6b:2e:68:f8:c8:9a:e9:58:09:bbCertificate

Extended Key Usages

Key Usages

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2dCertificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

e2:4f:6c:26:f8:80:db:fc:c3:53:56:34:08:58:28:f7:25:98:a7:31:de:a8:7f:e2:9d:e9:30:52:9c:e1:56:44Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

psapi

iphlpapi

crypt32

imm32

wintrust

Sections

.text Size: 1002KB - Virtual size: 1002KB

.rdata Size: 144KB - Virtual size: 144KB

.data Size: 22KB - Virtual size: 57KB

.rsrc Size: 126KB - Virtual size: 125KB

.reloc Size: 33KB - Virtual size: 32KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

9f:46:92:be:d6:3a:6b:2e:68:f8:c8:9a:e9:58:09:bb
Certificate

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

e2:4f:6c:26:f8:80:db:fc:c3:53:56:34:08:58:28:f7:25:98:a7:31:de:a8:7f:e2:9d:e9:30:52:9c:e1:56:44
Signer

.text
Size: 1002KB - Virtual size: 1002KB

.rdata
Size: 144KB - Virtual size: 144KB

.data
Size: 22KB - Virtual size: 57KB

.rsrc
Size: 126KB - Virtual size: 125KB

.reloc
Size: 33KB - Virtual size: 32KB