b2cf438e8f0998a5f0f72708d2310bb9a849156d67f2c98d601b1f82404326f7

Sharing

Copy URL Twitter E-mail

General

Target

b2cf438e8f0998a5f0f72708d2310bb9a849156d67f2c98d601b1f82404326f7
Size

824KB
MD5

b95a2fcb532812131a21cbd1ebef4c61
SHA1

a6f948077b2da7f169e40f0561d056577e50ebe7
SHA256

b2cf438e8f0998a5f0f72708d2310bb9a849156d67f2c98d601b1f82404326f7
SHA512

f123a543ab586262935a16ecb4385fcede6c32570b69714ae2d77aa451fa53ebfe425c4e9dd7951cf0bc2b33d1889f7064a5e606ee208534a54cc0f0c23fde59
SSDEEP

12288:njAbmWmKvlVw3ZQBg37TYkkX393O0PteuBbg18GURYTW95m1+YmwGl:njA6bKtyogYnXB3Y2bg14RYTW953r

Score

1^/10

Malware Config

Signatures

Files

b2cf438e8f0998a5f0f72708d2310bb9a849156d67f2c98d601b1f82404326f7
.exe windows:5 windows x86

c2313b50d87f537ac2d658f53bd41ad2

Code Sign

be:1c:e2:d6:d3:e8:e6:1d:b9:50:e4:bb:2e:ed:76:5c
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16/08/2017, 00:00

Not After

14/06/2018, 23:59

Subject

CN=OOO\,RULON,O=OOO\,RULON,POSTALCODE=191104,STREET=Mayakovskogo 50,L=St. Petersburg,ST=RU,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19/01/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

imagehlp

MapFileAndCheckSumW
MapFileAndCheckSumA

comctl32

ord17

version

VerQueryValueW

setupapi

SetupDecompressOrCopyFileW
SetupGetBinaryField
SetupGetFileCompressionInfoA
SetupGetFileCompressionInfoW

wininet

InternetReadFile
InternetCloseHandle
InternetWriteFile
HttpSendRequestExA
InternetOpenW
HttpQueryInfoW
InternetErrorDlg

kernel32

FindFirstFileA
GetProcAddress
GetLastError
GetModuleHandleA
LoadLibraryA
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetFilePointer
GetOEMCP
GetCPInfo
SetStdHandle
HeapReAlloc
VirtualAlloc
HeapAlloc
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapFree
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
IsProcessorFeaturePresent
lstrcmpiA
FindNextFileA
LockFile
ExpandEnvironmentStringsA
GetVolumeInformationW
SearchPathA
SetFileAttributesA
FindClose
RemoveDirectoryA
GetExitCodeProcess
GetConsoleCP
GetDiskFreeSpaceA
SetCurrentDirectoryA
GlobalUnlock
IsValidCodePage
SetEndOfFile
CreateDirectoryA
RaiseException
DuplicateHandle
GlobalLock
GetDateFormatA
GetTempPathA
GlobalFlags
FlushFileBuffers
GetTimeFormatA
GetACP
QueryPerformanceCounter
GetCurrentThreadId
CloseHandle
GetTickCount
CreateFileMappingA
FreeLibrary
GetVersionExA
WriteFile
GetStringTypeW

user32

CreateWindowExW
ScreenToClient
GetWindowRect
GetSysColor
GetSystemMetrics
InvalidateRect
SetScrollRange
GetDlgItem
SetWindowTextW
SetWindowPos
CloseClipboard
SetCursor
CheckDlgButton
BeginPaint
CreatePopupMenu
EnableMenuItem
CallWindowProcA
GetMessagePos
EndPaint
DrawTextA
MessageBoxIndirectA
SendMessageTimeoutA
LoadBitmapA
AppendMenuW
GetSystemMenu
IsWindowVisible
LoadCursorA
EndDialog
DefWindowProcA
GetWindowLongA

gdi32

OffsetViewportOrgEx
SaveDC
CreateRectRgnIndirect
GetClipBox
GetDeviceCaps
DeleteObject
SetTextColor
SetBkMode
GetStockObject
GetDIBits
ExtTextOutW
GetMapMode
RectVisible
Escape
SetMapMode
SetViewportExtEx
CreateBitmap
SetViewportOrgEx
PtVisible
ScaleWindowExtEx
TextOutW
SetWindowExtEx
GetViewportExtEx
GetWindowExtEx
GetTextColor
DeleteDC
ExtSelectClipRgn
GetObjectW
GetBkColor
GetRgnBox
CreateFontIndirectW
SelectObject
CreateFontIndirectA
RestoreDC
SetBkColor

rpcrt4

NdrComplexArrayFree
NdrClientCall2
NdrComplexArrayBufferSize
NdrClientInitializeNew
NdrClientInitialize

advapi32

RegQueryValueExW
FreeSid
AllocateAndInitializeSid
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueW
RegEnumKeyW
RegOpenKeyW

shell32

ShellExecuteA
SHGetFileInfoA
Shell_NotifyIconA

oleaut32

VarAdd
VarDecRound
SafeArrayPutElement

shlwapi

PathAddBackslashA
PathAddBackslashW

ws2_32

WSASend
WSAAddressToStringA

Sections

.text
Size: 612KB - Virtual size: 611KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 188KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c2313b50d87f537ac2d658f53bd41ad2

Code Sign

be:1c:e2:d6:d3:e8:e6:1d:b9:50:e4:bb:2e:ed:76:5cCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9dCertificate

Key Usages

Signer

Headers

File Characteristics

Imports

imagehlp

comctl32

version

setupapi

wininet

kernel32

user32

gdi32

rpcrt4

advapi32

shell32

oleaut32

shlwapi

ws2_32

Sections

.text Size: 612KB - Virtual size: 611KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 201KB

.tls Size: 4KB - Virtual size: 8B

.rsrc Size: 188KB - Virtual size: 186KB

be:1c:e2:d6:d3:e8:e6:1d:b9:50:e4:bb:2e:ed:76:5c
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

.text
Size: 612KB - Virtual size: 611KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 201KB

.tls
Size: 4KB - Virtual size: 8B

.rsrc
Size: 188KB - Virtual size: 186KB