2b04f931e477f9a901ca648957b250d58f286001c26c9da82b93483e21f49a5d

Sharing

Copy URL Twitter E-mail

General

Target

2b04f931e477f9a901ca648957b250d58f286001c26c9da82b93483e21f49a5d
Size

824KB
MD5

9a4844a449f546de9e2240e8a94c6dab
SHA1

8604a274e3889e0f8c65a00171c8495d46128cd1
SHA256

2b04f931e477f9a901ca648957b250d58f286001c26c9da82b93483e21f49a5d
SHA512

144809a857a1ace8ec27801ee28c333c354891c4f14eb74d2d48076a302604fcc492c6141b7c1eecd87294e658d2ac409b1d7db0b4f1d51a86f6bb7daf43e65f
SSDEEP

12288:cq6siKGh/4MK7yffYYZangnIPJ8SDP/o1uZZFudIq48oJ0G9Q6ciJkxWkkf:cRHgMK7yffagIrHyufYuNJPQ6qWl

Score

1^/10

Malware Config

Signatures

Files

2b04f931e477f9a901ca648957b250d58f286001c26c9da82b93483e21f49a5d
.exe windows:5 windows x86

29dfbc8eb759c474787a085d6fba1967

Code Sign

be:1c:e2:d6:d3:e8:e6:1d:b9:50:e4:bb:2e:ed:76:5c
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16/08/2017, 00:00

Not After

14/06/2018, 23:59

Subject

CN=OOO\,RULON,O=OOO\,RULON,POSTALCODE=191104,STREET=Mayakovskogo 50,L=St. Petersburg,ST=RU,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19/01/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

imagehlp

MapFileAndCheckSumW
MapFileAndCheckSumA

comctl32

ord17

version

VerQueryValueW

setupapi

SetupDecompressOrCopyFileW
SetupGetBinaryField
SetupGetFileCompressionInfoA
SetupGetFileCompressionInfoW

wininet

InternetReadFile
InternetOpenW
InternetWriteFile
InternetCloseHandle
HttpQueryInfoW
HttpSendRequestExA
InternetErrorDlg

kernel32

FindFirstFileA
GetProcAddress
GetLastError
GetModuleHandleA
LoadLibraryA
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetFilePointer
GetOEMCP
GetCPInfo
SetStdHandle
HeapReAlloc
VirtualAlloc
HeapAlloc
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapFree
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
IsProcessorFeaturePresent
lstrcmpiA
FindNextFileA
LockFile
ExpandEnvironmentStringsA
GetVolumeInformationW
SearchPathA
SetFileAttributesA
FindClose
RemoveDirectoryA
GetExitCodeProcess
GetConsoleCP
GetDiskFreeSpaceA
SetCurrentDirectoryA
GlobalUnlock
IsValidCodePage
SetEndOfFile
CreateDirectoryA
RaiseException
DuplicateHandle
GlobalLock
GetDateFormatA
GetTempPathA
GlobalFlags
FlushFileBuffers
GetTimeFormatA
GetACP
QueryPerformanceCounter
FreeLibrary
CloseHandle
GetTickCount
GetCurrentThreadId
CreateFileMappingA
GetVersionExA
WriteFile
GetStringTypeW

user32

SetScrollRange
ScreenToClient
GetWindowRect
GetSysColor
GetSystemMetrics
InvalidateRect
SetWindowTextW
CreateWindowExW
GetDlgItem
SetWindowPos
CloseClipboard
SetCursor
CheckDlgButton
BeginPaint
CreatePopupMenu
EnableMenuItem
CallWindowProcA
GetMessagePos
EndPaint
DrawTextA
MessageBoxIndirectA
SendMessageTimeoutA
LoadBitmapA
AppendMenuW
GetSystemMenu
IsWindowVisible
LoadCursorA
EndDialog
DefWindowProcA
GetWindowLongA

gdi32

OffsetViewportOrgEx
SaveDC
CreateRectRgnIndirect
GetClipBox
GetDeviceCaps
DeleteObject
SetTextColor
SetBkMode
GetStockObject
GetDIBits
ExtTextOutW
GetMapMode
RectVisible
Escape
SetMapMode
SetViewportExtEx
CreateBitmap
SetViewportOrgEx
PtVisible
ScaleWindowExtEx
TextOutW
SetWindowExtEx
GetViewportExtEx
GetWindowExtEx
GetTextColor
DeleteDC
ExtSelectClipRgn
GetObjectW
GetBkColor
GetRgnBox
CreateFontIndirectW
SelectObject
CreateFontIndirectA
RestoreDC
SetBkColor

rpcrt4

NdrClientInitializeNew
NdrClientCall2
NdrComplexArrayBufferSize
NdrClientInitialize
NdrComplexArrayFree

advapi32

RegDeleteKeyW
FreeSid
AllocateAndInitializeSid
RegEnumValueW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegQueryValueW
RegEnumKeyW
RegOpenKeyW
RegOpenKeyExW

shell32

ShellExecuteA
SHGetFileInfoA
Shell_NotifyIconA

oleaut32

VarAdd
VarDecRound
SafeArrayPutElement

shlwapi

PathAddBackslashA
PathAddBackslashW

ws2_32

WSASend
WSAAddressToStringA

Sections

.text
Size: 612KB - Virtual size: 611KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 188KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29dfbc8eb759c474787a085d6fba1967

Code Sign

be:1c:e2:d6:d3:e8:e6:1d:b9:50:e4:bb:2e:ed:76:5cCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9dCertificate

Key Usages

Signer

Headers

File Characteristics

Imports

imagehlp

comctl32

version

setupapi

wininet

kernel32

user32

gdi32

rpcrt4

advapi32

shell32

oleaut32

shlwapi

ws2_32

Sections

.text Size: 612KB - Virtual size: 611KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 201KB

.tls Size: 4KB - Virtual size: 8B

.rsrc Size: 188KB - Virtual size: 186KB

be:1c:e2:d6:d3:e8:e6:1d:b9:50:e4:bb:2e:ed:76:5c
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

.text
Size: 612KB - Virtual size: 611KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 201KB

.tls
Size: 4KB - Virtual size: 8B

.rsrc
Size: 188KB - Virtual size: 186KB