MagicMouseTrails 3[.]93 portable[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

MagicMouseTrails 3.93 portable.rar
Size

1.8MB
MD5

5937bc30fb77d2dc82aa6dd4bb16cc01
SHA1

e9258f6f191b0caa6113208a38b864994279d6fe
SHA256

8dd3c0bf945d83d85bcfdd11d2cac0a7fe4e7a486cb3a4e4936c95d6cd22fc6e
SHA512

75f931a4d79fcb27e484fa2e11d653b39b5dd9dd284636d0c52536908e0c5e3f5cf8215499720c35b79a64e393056867ca25db3d0bd5205f45f55456bb63f5de
SSDEEP

49152:N+DRaS1oFZADaEG6ajzJFGhEFTNYlRebnegb6uql4lBc:2cfx16OG0TNYabnegb6uql44

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MagicMouseTrails 3.93 portable/x32/Languages/info (2)

Files

MagicMouseTrails 3.93 portable.rar
.rar
MagicMouseTrails 3.93 portable/x32/Languages/Bahasa.lng
MagicMouseTrails 3.93 portable/x32/Languages/Chinese (Simplified).lng
MagicMouseTrails 3.93 portable/x32/Languages/Chinese (Traditional).lng
MagicMouseTrails 3.93 portable/x32/Languages/Danish.lng
MagicMouseTrails 3.93 portable/x32/Languages/English.lng
MagicMouseTrails 3.93 portable/x32/Languages/FransèOrAl.lng
MagicMouseTrails 3.93 portable/x32/Languages/French.lng
MagicMouseTrails 3.93 portable/x32/Languages/German.lng
MagicMouseTrails 3.93 portable/x32/Languages/Greek.lng
MagicMouseTrails 3.93 portable/x32/Languages/Italiano.lng
MagicMouseTrails 3.93 portable/x32/Languages/Korean.lng
MagicMouseTrails 3.93 portable/x32/Languages/Nederlands.lng
MagicMouseTrails 3.93 portable/x32/Languages/Polish.lng
MagicMouseTrails 3.93 portable/x32/Languages/Portuguese.lng
MagicMouseTrails 3.93 portable/x32/Languages/Romanian.lng
MagicMouseTrails 3.93 portable/x32/Languages/Russian.lng
MagicMouseTrails 3.93 portable/x32/Languages/Slovak.lng
MagicMouseTrails 3.93 portable/x32/Languages/Suomi.lng
MagicMouseTrails 3.93 portable/x32/Languages/Svenska.lng
MagicMouseTrails 3.93 portable/x32/Languages/Turkish.lng
MagicMouseTrails 3.93 portable/x32/Languages/info (2)
.dll windows:5 windows x86

8e12938908a888342d151e0117c2be16

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

FreeSid
RegCloseKey
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCreateKeyExA
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA

kernel32

CreateSemaphoreA
SetEndOfFile
WaitForMultipleObjectsEx
MapViewOfFile
SetEvent
CreateMutexW
CreateFileW
GetWindowsDirectoryW
GetOverlappedResult
ReadFile
FlushViewOfFile
HeapCreate
HeapAlloc
HeapDestroy
HeapFree
FindNextFileA
FindClose
FindFirstFileA
GetFileAttributesA
GetFileInformationByHandle
CopyFileA
MoveFileA
FlushFileBuffers
MoveFileExA
DeleteFileA
RemoveDirectoryA
CreateDirectoryA
GetDiskFreeSpaceA
WideCharToMultiByte
MultiByteToWideChar
lstrcpyA
lstrlenW
lstrlenA
OutputDebugStringA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualAlloc
VirtualFree
LeaveCriticalSection
TlsFree
EnterCriticalSection
TlsSetValue
GetProcAddress
GetModuleHandleA
Sleep
QueryPerformanceFrequency
CloseHandle
CreateMutexA
SetHandleInformation
CreateFileA
ReleaseMutex
WriteFile
SetFilePointer
WaitForSingleObject
LocalFree
LocalAlloc
DuplicateHandle
FreeLibrary
GetModuleFileNameA
VirtualQueryEx
LoadLibraryA
SetThreadAffinityMask
GetProcessAffinityMask
SetThreadIdealProcessor
GetCurrentThread
TlsGetValue
GetSystemDefaultLCID
WaitForSingleObjectEx
ReleaseSemaphore
DeleteCriticalSection
GetVersionExA
GetSystemInfo
InitializeCriticalSection
GetExitCodeThread
TlsAlloc
GlobalMemoryStatus
VirtualQuery
VirtualUnlock
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingA
GetLastError
SleepEx
ResumeThread
SetThreadPriority
CreateThread
FormatMessageA
CreateEventA
GetSystemPowerStatus
SetConsoleCtrlHandler
GetLocalTime
SetLastError
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
GetLocaleInfoA
LCMapStringW
IsValidLocale
GetUserDefaultLCID
GetFileSize

msvcrt

_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
wcsrchr
strcspn
_fullpath
_mbsnbicmp
wcscat
time
_mbsicmp
_mbspbrk
_mbsrchr
_mbstok
strpbrk
strtok
_strupr
srand
rand
strtoul
_snprintf
sscanf
_splitpath
_makepath
_mbscspn
_vsnprintf
strncpy
_itow
_except_handler3
_strnicmp
swprintf
vsprintf
vprintf
_iob
_itoa
printf
isprint
wcscpy
memmove
fopen
fprintf
fflush
fclose
_ultoa
strchr
_stricmp
wcslen
sprintf
atol
modf
_ftol
_purecall

user32

MessageBoxA

Exports

Exports

JetAddColumn
JetAttachDatabase
JetAttachDatabase2
JetAttachDatabase@12
JetAttachDatabaseWithStreaming
JetBackup
JetBackup@12
JetBackupInstance
JetBeginExternalBackup
JetBeginExternalBackupInstance
JetBeginSession
JetBeginSession@16
JetBeginTransaction
JetBeginTransaction2
JetBeginTransaction@4
JetCloseDatabase
JetCloseDatabase@12
JetCloseFile
JetCloseFileInstance
JetCloseTable
JetCloseTable@8
JetCommitTransaction
JetCommitTransaction@8
JetCompact
JetComputeStats
JetConvertDDL
JetCreateDatabase
JetCreateDatabase2
JetCreateDatabase@20
JetCreateDatabaseWithStreaming
JetCreateIndex
JetCreateIndex2
JetCreateInstance
JetCreateInstance2
JetCreateTable
JetCreateTableColumnIndex
JetCreateTableColumnIndex2
JetCreateTableColumnIndex@12
JetDBUtilities
JetDefragment
JetDefragment2
JetDelete
JetDelete@8
JetDeleteColumn
JetDeleteColumn2
JetDeleteIndex
JetDeleteTable
JetDetachDatabase
JetDetachDatabase2
JetDetachDatabase@8
JetDupCursor
JetDupSession
JetEnableMultiInstance
JetEndExternalBackup
JetEndExternalBackupInstance
JetEndExternalBackupInstance2
JetEndSession
JetEndSession@8
JetEnumerateColumns
JetEscrowUpdate
JetExternalRestore
JetExternalRestore2
JetFreeBuffer
JetGetAttachInfo
JetGetAttachInfoInstance
JetGetBookmark
JetGetColumnInfo
JetGetColumnInfo@28
JetGetCounter
JetGetCurrentIndex
JetGetCursorInfo
JetGetDatabaseFileInfo
JetGetDatabaseInfo
JetGetIndexInfo
JetGetInstanceInfo
JetGetLS
JetGetLock
JetGetLogInfo
JetGetLogInfoInstance
JetGetLogInfoInstance2
JetGetObjectInfo
JetGetRecordPosition
JetGetSecondaryIndexBookmark
JetGetSystemParameter
JetGetTableColumnInfo
JetGetTableIndexInfo
JetGetTableInfo
JetGetTruncateLogInfoInstance
JetGetVersion
JetGotoBookmark
JetGotoPosition
JetGotoSecondaryIndexBookmark
JetGrowDatabase
JetIdle
JetIndexRecordCount
JetInit
JetInit2
JetInit3
JetInit@4
JetIntersectIndexes
JetMakeKey
JetMakeKey@20
JetMove
JetMove@16
JetOSSnapshotFreeze
JetOSSnapshotPrepare
JetOSSnapshotThaw
JetOpenDatabase
JetOpenDatabase@20
JetOpenFile
JetOpenFileInstance
JetOpenFileSectionInstance
JetOpenTable
JetOpenTable@28
JetOpenTempTable
JetOpenTempTable2
JetOpenTempTable3
JetPrepareToCommitTransaction
JetPrepareUpdate
JetPrepareUpdate@12
JetReadFile
JetReadFileInstance
JetRegisterCallback
JetRenameColumn
JetRenameTable
JetResetCounter
JetResetSessionContext
JetResetTableSequential
JetRestore
JetRestore2
JetRestore2@12
JetRestoreInstance
JetRetrieveColumn
JetRetrieveColumn@32
JetRetrieveColumns
JetRetrieveKey
JetRetrieveTaggedColumnList
JetRollback
JetRollback@8
JetSeek
JetSeek@12
JetSetColumn
JetSetColumn@28
JetSetColumnDefaultValue
JetSetColumns
JetSetCurrentIndex
JetSetCurrentIndex2
JetSetCurrentIndex3
JetSetCurrentIndex4
JetSetCurrentIndex@12
JetSetDatabaseSize
JetSetIndexRange
JetSetLS
JetSetSessionContext
JetSetSystemParameter
JetSetSystemParameter@20
JetSetTableSequential
JetSnapshotStart
JetSnapshotStop
JetStopBackup
JetStopBackupInstance
JetStopService
JetStopServiceInstance
JetTerm
JetTerm2
JetTerm@4
JetTruncateLog
JetTruncateLogInstance
JetUnregisterCallback
JetUpdate
JetUpdate@20
JetUpgradeDatabase
ese

Sections

.text
Size: 945KB - Virtual size: 944KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

cachelin
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MagicMouseTrails 3.93 portable/x32/Languages/ree/rarreg.key
MagicMouseTrails 3.93 portable/x32/MagicMouseTrails_p.exe
.exe windows:4 windows x86

b06c85982de1ae0fdc8a0010c39d43ab

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:28:cf:12:7e:b4:52:6b:3f:c8:df:87
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

27/07/2023, 09:33

Not After

27/07/2024, 09:33

Subject

SERIALNUMBER=15.06.2017,CN=Nenad Hrg,O=Nenad Hrg,STREET=Edelweissstrasse 104,L=Taufkirchen,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c16737570706f727440736f6674776172656f6b2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130b546175666b69726368656e,1.3.6.1.4.1.311.60.2.1.2=#130642617965726e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e7:d9:55:7a:b6:9c:d8:eb:98:ad:97:67:fc:e1:6b:f4:53:ae:b5:78:ba:19:45:25:7d:ff:7a:59:a0:24:e8:2b
Signer

Actual PE Digest

e7:d9:55:7a:b6:9c:d8:eb:98:ad:97:67:fc:e1:6b:f4:53:ae:b5:78:ba:19:45:25:7d:ff:7a:59:a0:24:e8:2b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RemoveDirectoryW
GetDriveTypeW
GetLogicalDriveStringsW
GetFullPathNameW
SetFileAttributesW
MapViewOfFile
CreateFileMappingW
GetStartupInfoW
CompareStringW
lstrcmpiW
CreateMutexW
GetUserDefaultLangID
GetPrivateProfileStringW
WritePrivateProfileStringW
CreateDirectoryW
GetFileAttributesW
GlobalHandle
FreeResource
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
DeleteFileW
GetFileSize
ReadFile
lstrcmpW
lstrcatW
CopyFileW
GetTempPathW
CreateFileW
WriteFile
CloseHandle
WideCharToMultiByte
GetTimeZoneInformation
GetModuleHandleW
GetLastError
FormatMessageW
LocalFree
GetLocalTime
TerminateThread
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
FindResourceW
LoadResource
LockResource
SizeofResource
lstrcpynW
lstrcpyW
FreeLibrary
FlushInstructionCache
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
GetVersionExW
Sleep
GetModuleFileNameW
CreateThread
OutputDebugStringW
ExitProcess
OutputDebugStringA
LoadLibraryW
GetProcAddress
GetCurrentProcess
DebugBreak
MultiByteToWideChar
lstrlenA
InterlockedDecrement
InterlockedIncrement
lstrlenW
UnmapViewOfFile

user32

DispatchMessageW
SetCapture
GetCapture
ReleaseCapture
PostQuitMessage
DestroyWindow
GetActiveWindow
CopyRect
LoadIconW
GetIconInfo
CreateIconIndirect
OffsetRect
DrawFocusRect
GetSystemMetrics
GetSubMenu
GetMessageW
DefWindowProcW
GetSysColor
CharLowerW
MessageBoxA
SetWindowLongW
LoadStringW
CharNextW
wvsprintfW
ScreenToClient
RedrawWindow
GetWindowLongW
PeekMessageW
ShowWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
GetDC
DrawTextW
BeginPaint
CallWindowProcW
GetDlgCtrlID
PtInRect
EndPaint
ReleaseDC
RegisterWindowMessageW
MessageBoxW
GetMenuItemCount
DrawAnimatedRects
EndDialog
SetDlgItemTextW
GetParent
SendMessageW
GetDlgItem
SetWindowPos
IsWindowVisible
wsprintfW
GetClassInfoExW
SetRect
EqualRect
GetCursorPos
SetTimer
KillTimer
GetSysColorBrush
TrackPopupMenuEx
GetMessagePos
InvalidateRect
DestroyIcon
GetKeyboardState
SetForegroundWindow
DestroyMenu
CheckMenuItem
InsertMenuW
AppendMenuW
SetMenuItemInfoW
SetMenu
SetClassLongW
CreatePopupMenu
IsWindowEnabled
SetCursor
UpdateWindow
SetRectEmpty
EnumWindows
SendMessageTimeoutW
EnableWindow
PostMessageW
GetMenuItemInfoW
SetPropW
GetClassNameW
InvalidateRgn
CreateAcceleratorTableW
GetDesktopWindow
IsWindow
FillRect
GetWindowTextLengthW
CreateDialogIndirectParamW
CreateDialogParamW
TranslateMessage
SetParent
IsChild
IsDialogMessageW
FindWindowExW
EnumChildWindows
LoadImageW
GetWindowTextW
GetFocus
UnhookWindowsHookEx
SetWindowsHookExW
GetKeyState
CallNextHookEx
SetFocus
DialogBoxParamW
SetWindowTextW
MapVirtualKeyW
keybd_event
GetWindow
GetWindowRect
SystemParametersInfoW
GetClientRect
MapWindowPoints

gdi32

CreateCompatibleBitmap
EnumFontsW
GetObjectW
GetPixel
CreateBitmap
GetCurrentObject
BitBlt
CreateCompatibleDC
CreateDIBSection
GetClipBox
GetDeviceCaps
SetTextColor
SetBkMode
CreateFontIndirectW
CreateSolidBrush
SelectObject
SetBkColor
ExtTextOutW
GetStockObject
DeleteDC
SetPixel
DeleteObject

comdlg32

ChooseFontW
GetOpenFileNameW

advapi32

CryptCreateHash
CryptAcquireContextW
CryptDestroyHash
CryptReleaseContext
CryptHashData
CryptGetHashParam
RegDeleteValueW
RegSetValueExW
RegOpenKeyW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

shell32

ord17
ord16
ord155
SHAppBarMessage
Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ord190
SHGetDesktopFolder
SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW
ord18

ole32

CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
OleLockRunning
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

OleCreateFontIndirect
SysAllocStringLen
DispCallFunc
SysStringLen
LoadRegTypeLi
SafeArrayDestroy
VariantInit
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
SysFreeString
SysAllocString

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
_XcptFilter
_exit
_onexit
__dllonexit
wcsncpy
_wfopen
localtime
wcsftime
mktime
fclose
fread
fwrite
getc
putc
exit
iswspace
wcscat
time
sprintf
wcsrchr
clock
memmove
_purecall
_wcsicmp
realloc
_ftol
wcschr
malloc
free
wcsstr
rand
iswdigit
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
_wtoi
wcscmp
_controlfp

comctl32

ImageList_Add
ImageList_Create
ImageList_Replace
_TrackMouseEvent
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_LoadImageW
ImageList_Draw

gdiplus

GdipDisposeImage
GdipDeleteGraphics
GdipCreateHICONFromBitmap
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDrawImageRect
GdipCreateHBITMAPFromBitmap
GdipDisposeImageAttributes
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipCreateImageAttributes
GdipAlloc
GdipCloneImage
GdipFree
GdipGetImageWidth
GdipGetImageHeight
GdiplusStartup
GdipDeleteStringFormat
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipCreateFromHDC
GdipCreateStringFormat
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipPrivateAddMemoryFont
GdipNewPrivateFontCollection
GdipDeletePrivateFontCollection
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipResetWorldTransform

Sections

.text
Size: 120KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
MagicMouseTrails 3.93 portable/x32/liesmich portable und install.txt
MagicMouseTrails 3.93 portable/x32/lisez-moi portable et installer-1.txt
MagicMouseTrails 3.93 portable/x32/lisez-moi portable et installer.txt
MagicMouseTrails 3.93 portable/x32/readme portable and install.txt
MagicMouseTrails 3.93 portable/x64/MagicMouseTrails_p.exe
.exe windows:4 windows x64

5e4d0d76565791492bca8a4f137e8379

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:28:cf:12:7e:b4:52:6b:3f:c8:df:87
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

27/07/2023, 09:33

Not After

27/07/2024, 09:33

Subject

SERIALNUMBER=15.06.2017,CN=Nenad Hrg,O=Nenad Hrg,STREET=Edelweissstrasse 104,L=Taufkirchen,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c16737570706f727440736f6674776172656f6b2e636f6d,1.3.6.1.4.1.311.60.2.1.1=#130b546175666b69726368656e,1.3.6.1.4.1.311.60.2.1.2=#130642617965726e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9c:ec:57:c4:5d:30:12:40:d9:4c:aa:62:bc:06:39:ce:0d:dd:66:65:a3:ef:21:f8:4b:13:6d:e5:fb:8b:9f:f7
Signer

Actual PE Digest

9c:ec:57:c4:5d:30:12:40:d9:4c:aa:62:bc:06:39:ce:0d:dd:66:65:a3:ef:21:f8:4b:13:6d:e5:fb:8b:9f:f7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SetFileAttributesW
RemoveDirectoryW
GetDriveTypeW
GetLogicalDriveStringsW
GetFullPathNameW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
InterlockedPopEntrySList
VirtualAlloc
GetCurrentProcessId
InterlockedPushEntrySList
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
CreateMutexW
CompareStringW
lstrcmpiW
GetUserDefaultLangID
CreateDirectoryW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetFileAttributesW
GlobalHandle
FreeResource
DeleteFileW
GetTempPathW
GetTimeZoneInformation
GetFileSize
ReadFile
CreateFileW
WriteFile
CloseHandle
CopyFileW
lstrcmpW
lstrcatW
HeapDestroy
InitializeCriticalSection
DeleteCriticalSection
WideCharToMultiByte
GetModuleHandleW
GetLastError
FormatMessageW
LocalFree
TerminateThread
GetLocalTime
lstrcpynW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
FindResourceW
LoadResource
LockResource
SizeofResource
lstrcpyW
FreeLibrary
SetLastError
__C_specific_handler
GetVersionExW
GetModuleHandleA
MultiByteToWideChar
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
RaiseException
FlushInstructionCache
GetModuleFileNameW
CreateThread
ExitProcess
LoadLibraryW
GetProcAddress
GetCurrentProcess
Sleep
OutputDebugStringA
OutputDebugStringW
DebugBreak
lstrlenA
lstrlenW
VirtualFree

user32

SetMenuItemInfoW
AppendMenuW
CreatePopupMenu
DestroyMenu
CheckMenuItem
InsertMenuW
SetClassLongW
SetForegroundWindow
GetKeyboardState
DestroyIcon
DrawAnimatedRects
GetSubMenu
CreateIconIndirect
GetIconInfo
LoadIconW
GetMessagePos
GetMenuItemCount
TrackPopupMenuEx
GetSysColorBrush
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetKeyState
MapVirtualKeyW
keybd_event
GetCursorPos
EqualRect
SetRect
KillTimer
SetTimer
GetClassInfoExW
wsprintfW
MessageBoxW
GetDesktopWindow
LoadCursorW
RegisterClassExW
GetMessageW
DispatchMessageW
PeekMessageW
GetCapture
PostQuitMessage
GetActiveWindow
GetSystemMetrics
ReleaseDC
GetDC
EndPaint
BeginPaint
GetSysColor
FillRect
GetClassNameW
InvalidateRgn
CreateDialogParamW
GetWindowLongPtrW
DrawTextW
CallWindowProcW
RegisterWindowMessageW
DefWindowProcW
OffsetRect
PtInRect
CopyRect
SetWindowLongW
GetDlgCtrlID
SetCapture
ShowWindow
InvalidateRect
DestroyWindow
CreateWindowExW
SetMenu
SetCursor
IsWindowEnabled
UpdateWindow
SetRectEmpty
EnumWindows
SendMessageTimeoutW
EnableWindow
GetMenuItemInfoW
PostMessageW
SetPropW
CreateDialogIndirectParamW
GetWindowTextLengthW
CreateAcceleratorTableW
IsWindow
GetWindowLongW
SendMessageW
GetWindowRect
ScreenToClient
RedrawWindow
SetDlgItemTextW
GetParent
GetDlgItem
SetWindowPos
MapWindowPoints
GetClientRect
SystemParametersInfoW
GetWindow
TranslateMessage
SetParent
IsChild
LoadImageW
GetFocus
SetWindowTextW
IsDialogMessageW
GetWindowTextW
FindWindowExW
EnumChildWindows
SetFocus
DialogBoxParamW
IsWindowVisible
LoadStringW
wvsprintfW
CharNextW
EndDialog
SetWindowLongPtrW
CharLowerW
MessageBoxA
ReleaseCapture
DrawFocusRect

gdi32

CreateCompatibleBitmap
EnumFontsW
GetObjectW
GetPixel
CreateBitmap
GetCurrentObject
BitBlt
CreateCompatibleDC
CreateDIBSection
GetClipBox
DeleteDC
SetTextColor
SetBkColor
GetDeviceCaps
CreateFontIndirectW
DeleteObject
CreateSolidBrush
ExtTextOutW
SetBkMode
SetPixel
GetStockObject
SelectObject

comdlg32

GetOpenFileNameW
ChooseFontW

advapi32

RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
CryptDestroyHash
CryptReleaseContext
CryptCreateHash
RegOpenKeyW
RegDeleteKeyW
RegCloseKey
CryptGetHashParam
CryptHashData
CryptAcquireContextW

shell32

ord17
ord16
ord155
SHAppBarMessage
Shell_NotifyIconW
SHGetFileInfoW
ord190
SHGetDesktopFolder
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW
ord18

ole32

StringFromCLSID
CoTaskMemFree
CreateStreamOnHGlobal
CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
OleLockRunning
OleInitialize
OleUninitialize
CoUninitialize
CoInitialize
CLSIDFromProgID

oleaut32

SafeArrayCreateVector
SysAllocStringLen
LoadRegTypeLi
SysStringLen
DispCallFunc
SafeArrayDestroy
VariantInit
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
SysFreeString
SysAllocString

msvcrt

wcscmp
_wtoi
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memcpy
wcslen
rand
wcsstr
free
malloc
__set_app_type
_fmode
_commode
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
_cexit
_exit
_c_exit
_XcptFilter
_onexit
__dllonexit
wcsncpy
localtime
wcsftime
_wfopen
mktime
abs
fclose
fread
fwrite
getc
putc
exit
time
sprintf
wcscat
iswspace
wcsrchr
memcmp
strlen
clock
memmove
_purecall
_wcsicmp
memset
??1type_info@@UEAA@XZ
_CxxThrowException
realloc
wcschr
iswdigit
?terminate@@YAXXZ

comctl32

ImageList_Replace
ImageList_Add
ImageList_Create
_TrackMouseEvent
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_LoadImageW
ImageList_Draw

gdiplus

GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipCreateFromHDC
GdiplusStartup
GdipCreateBitmapFromStream
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipPrivateAddMemoryFont
GdipDeletePrivateFontCollection
GdipNewPrivateFontCollection
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCloneImage
GdipDrawImageRectRect
GdipDrawImageRect
GdipGetImageGraphicsContext
GdipSetImageAttributesColorMatrix
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipFree
GdipAlloc
GdipCreateHICONFromBitmap

Sections

.text
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
MagicMouseTrails 3.93 portable/x64/liesmich portable und install.txt
MagicMouseTrails 3.93 portable/x64/lisez-moi portable et installer-1.txt
MagicMouseTrails 3.93 portable/x64/lisez-moi portable et installer.txt
MagicMouseTrails 3.93 portable/x64/readme portable and install.txt

Sharing

General

Malware Config

Signatures

Files

8e12938908a888342d151e0117c2be16

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

Exports

Exports

Sections

.text Size: 945KB - Virtual size: 944KB

.data Size: 24KB - Virtual size: 29KB

cachelin Size: 512B - Virtual size: 1KB

.rsrc Size: 54KB - Virtual size: 54KB

.reloc Size: 32KB - Virtual size: 31KB

b06c85982de1ae0fdc8a0010c39d43ab

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

07:28:cf:12:7e:b4:52:6b:3f:c8:df:87Certificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

e7:d9:55:7a:b6:9c:d8:eb:98:ad:97:67:fc:e1:6b:f4:53:ae:b5:78:ba:19:45:25:7d:ff:7a:59:a0:24:e8:2bSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

msvcrt

comctl32

gdiplus

Sections

.text Size: 120KB - Virtual size: 116KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 76KB - Virtual size: 183KB

.rsrc Size: 120KB - Virtual size: 117KB

5e4d0d76565791492bca8a4f137e8379

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

07:28:cf:12:7e:b4:52:6b:3f:c8:df:87Certificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

9c:ec:57:c4:5d:30:12:40:d9:4c:aa:62:bc:06:39:ce:0d:dd:66:65:a3:ef:21:f8:4b:13:6d:e5:fb:8b:9f:f7Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

.text
Size: 945KB - Virtual size: 944KB

.data
Size: 24KB - Virtual size: 29KB

cachelin
Size: 512B - Virtual size: 1KB

.rsrc
Size: 54KB - Virtual size: 54KB

.reloc
Size: 32KB - Virtual size: 31KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

07:28:cf:12:7e:b4:52:6b:3f:c8:df:87
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

e7:d9:55:7a:b6:9c:d8:eb:98:ad:97:67:fc:e1:6b:f4:53:ae:b5:78:ba:19:45:25:7d:ff:7a:59:a0:24:e8:2b
Signer

.text
Size: 120KB - Virtual size: 116KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 76KB - Virtual size: 183KB

.rsrc
Size: 120KB - Virtual size: 117KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

07:28:cf:12:7e:b4:52:6b:3f:c8:df:87
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

9c:ec:57:c4:5d:30:12:40:d9:4c:aa:62:bc:06:39:ce:0d:dd:66:65:a3:ef:21:f8:4b:13:6d:e5:fb:8b:9f:f7
Signer

.text
Size: 190KB - Virtual size: 189KB

.rdata
Size: 37KB - Virtual size: 36KB

.data
Size: 65KB - Virtual size: 261KB

.pdata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 118KB - Virtual size: 117KB