kfa18[.]0[.]0[.]405aben_12579[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

kfa18.0.0.405aben_12579.exe
Size

2.3MB
MD5

c63d512b165d365f3ffdce130c5b1253
SHA1

6c8d8f55ebc97a691b0341dd7c55d90ad53c1e60
SHA256

f54a7fc122b9420be8aedffee5dc8236a1260a07fcd1be027efcf375d5d027e2
SHA512

bc848d374d3cda3f9dc21907a852f8ac6994ad2ba31a3a8d048213bdf62fc7bbda3918163910213c8861d0ade58e5cd360afcaf1b07f563479c49839a5142a3d
SSDEEP

49152:lW6+U69HnIpb2GStDQ5XdUwHmbl7BcLlt4nr33/xDpegrORzdZjPntoAEED:B+9HnIJTSaXGHx7Bfnrj1rORzd5tP

Score

1^/10

Malware Config

Signatures

Files

kfa18.0.0.405aben_12579.exe
.exe windows:5 windows x86

1c333af01a5aa984c162ce72ffccd51a

Code Sign

07:27:cf:61
Certificate

Issuer

CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US

Not Before

19/08/2015, 17:38

Not After

10/08/2018, 17:37

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:66:8f:b0:f0:f0:02:b7:74:c7:dd:bd:76:9e:e5:b1
Certificate

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

08/10/2015, 00:00

Not After

24/10/2018, 12:00

Subject

CN=Kaspersky Lab,O=Kaspersky Lab,L=Moscow,ST=Moscow City,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:27:cf:61
Certificate

Issuer

CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US

Not Before

19/08/2015, 17:38

Not After

10/08/2018, 17:37

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:18:fb:0a:3f:df:62:66:4a:f8:6c:2c:f0:fb:fe:84
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

27/10/2014, 00:00

Not After

03/11/2017, 12:00

Subject

SERIALNUMBER=1027739867473,CN=Kaspersky Lab,O=Kaspersky Lab,POSTALCODE=125212,STREET=39A/3 Leningradskoe shosse,L=Moscow,ST=Moscow City,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ca:6b:33:22:94:27:4c:49:06:54:85:d8:76:b2:0e:60:65:23:de:44:cc:a5:38:e0:ed:1e:ea:19:af:0a:3d:dc
Signer

Actual PE Digest

ca:6b:33:22:94:27:4c:49:06:54:85:d8:76:b2:0e:60:65:23:de:44:cc:a5:38:e0:ed:1e:ea:19:af:0a:3d:dc

Digest Algorithm

sha256

PE Digest Matches

true

1b:79:3e:09:07:44:76:b0:90:d2:af:42:00:71:2d:31:1f:39:4b:9d
Signer

Actual PE Digest

1b:79:3e:09:07:44:76:b0:90:d2:af:42:00:71:2d:31:1f:39:4b:9d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
CloseHandle
ResetEvent
DeleteCriticalSection
GetModuleFileNameW
CreateFileW
GetCurrentThreadId
GetSystemDirectoryW
OpenProcess
GetLastError
GetLocalTime
GetProcAddress
GetCurrentProcessId
CreateProcessW
LoadLibraryExW
SetUnhandledExceptionFilter
CreateDirectoryW
ReadFile
HeapFree
SetLastError
GetCurrentProcess
ExpandEnvironmentStringsW
TerminateProcess
RemoveDirectoryW
GetTempPathW
LocalAlloc
GetFileAttributesW
GetModuleHandleA
MultiByteToWideChar
GetSystemWow64DirectoryW
FormatMessageW
LoadLibraryA
GetVersionExA
DeleteFileW
LoadLibraryW
HeapAlloc
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcessHeap
GetModuleHandleW
FreeLibrary
MoveFileW
TlsSetValue
VirtualProtect
VirtualAlloc
TlsAlloc
GetSystemInfo
FlushInstructionCache
TlsGetValue
TlsFree
GetTickCount
VirtualQuery
RaiseException
LoadLibraryExA
FindResourceExW
LoadResource
LockResource
SizeofResource
WriteFile
SetFilePointer
FindNextFileW
FindClose
MoveFileExW
GetTempFileNameW
WideCharToMultiByte
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
LocalFree
FormatMessageA
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
HeapReAlloc
GetStdHandle
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
WriteConsoleW

Sections

.text
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c333af01a5aa984c162ce72ffccd51a

Code Sign

07:27:cf:61Certificate

Key Usages

0f:66:8f:b0:f0:f0:02:b7:74:c7:dd:bd:76:9e:e5:b1Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5fCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

07:27:cf:61Certificate

Key Usages

0d:18:fb:0a:3f:df:62:66:4a:f8:6c:2c:f0:fb:fe:84Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

ca:6b:33:22:94:27:4c:49:06:54:85:d8:76:b2:0e:60:65:23:de:44:cc:a5:38:e0:ed:1e:ea:19:af:0a:3d:dcSigner

1b:79:3e:09:07:44:76:b0:90:d2:af:42:00:71:2d:31:1f:39:4b:9dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 174KB - Virtual size: 174KB

.rdata Size: 66KB - Virtual size: 65KB

.data Size: 4KB - Virtual size: 16KB

.gfids Size: 1024B - Virtual size: 532B

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 10KB - Virtual size: 10KB

07:27:cf:61
Certificate

0f:66:8f:b0:f0:f0:02:b7:74:c7:dd:bd:76:9e:e5:b1
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

07:27:cf:61
Certificate

0d:18:fb:0a:3f:df:62:66:4a:f8:6c:2c:f0:fb:fe:84
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

ca:6b:33:22:94:27:4c:49:06:54:85:d8:76:b2:0e:60:65:23:de:44:cc:a5:38:e0:ed:1e:ea:19:af:0a:3d:dc
Signer

1b:79:3e:09:07:44:76:b0:90:d2:af:42:00:71:2d:31:1f:39:4b:9d
Signer

.text
Size: 174KB - Virtual size: 174KB

.rdata
Size: 66KB - Virtual size: 65KB

.data
Size: 4KB - Virtual size: 16KB

.gfids
Size: 1024B - Virtual size: 532B

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 10KB - Virtual size: 10KB