2b0b3e56865789c8ec0d84f5c9f4847aebe8bed0f3ba696a5743a5c81e62d8bd

Sharing

Copy URL Twitter E-mail

General

Target

2b0b3e56865789c8ec0d84f5c9f4847aebe8bed0f3ba696a5743a5c81e62d8bd
Size

1.3MB
MD5

0b31f9f9a015bf3a5493a67ec93cb1fc
SHA1

3d2f96d7ec17a910ed7c05e9cd34b71c9ce34b14
SHA256

2b0b3e56865789c8ec0d84f5c9f4847aebe8bed0f3ba696a5743a5c81e62d8bd
SHA512

35c397396420bb05ca9323e9b9a87196b52f3fcc3d069bbe05d789c30b32c7208c5afb9cfa4d0fe9dde1c2753cac44f98bf193b274494d90b5fa3560baa0b8da
SSDEEP

24576:BnwKnd44W++km2yBGslCKssJrIaa69EeSke3fsNSwFyO8SZh20bQ:Rw6W++kmypK1Ha4EeSr2SCycZh2R

Score

1^/10

Malware Config

Signatures

Files

2b0b3e56865789c8ec0d84f5c9f4847aebe8bed0f3ba696a5743a5c81e62d8bd
.exe windows:4 windows x86

c2e03f78792d28276fbf9ed10d23b641

Code Sign

59:bc:fa:5b:8f:bb:32:be:06:b1:ac:01:af:5b:42:65
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

14/02/2017, 00:00

Not After

21/07/2017, 23:59

Subject

CN=RTK-TERMINAL\, LLC,O=RTK-TERMINAL\, LLC,POSTALCODE=308017,STREET=Rabochaja\, 8,L=Belgorod,ST=RU,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19/01/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:09:1e:c5:a9:cd:d6:02:9f:70:8c:46:15:7d:8c:8e:77:36:2b:dc:fa:0d:28:d6:52:d1:5a:73:b8:14:e6:75
Signer

Actual PE Digest

53:09:1e:c5:a9:cd:d6:02:9f:70:8c:46:15:7d:8c:8e:77:36:2b:dc:fa:0d:28:d6:52:d1:5a:73:b8:14:e6:75

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

comctl32

ImageList_Remove

wininet

InternetOpenA

kernel32

DeleteFileA
GetCurrentThreadId
GetModuleHandleA
SizeofResource
TlsSetValue
HeapDestroy
LockResource
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
IsBadReadPtr
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
CreateFileMappingA
GetCurrentProcessId
FreeLibrary
GetLastError
WriteFile
CloseHandle
GetProcAddress
VirtualAlloc
ExitProcess
GetFileType
HeapReAlloc
GetStringTypeW
HeapAlloc
GetOEMCP
GetACP
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
GetVersionExA
HeapCreate
VirtualFree
HeapFree
RtlUnwind
GetCPInfo

user32

IsWindow
SetPropA
CreateWindowExA

gdi32

GetLogColorSpaceW
SelectPalette
SetAbortProc
DeleteEnhMetaFile
UnrealizeObject
Rectangle
ExcludeClipRect

advapi32

AllocateLocallyUniqueId
RegOpenKeyExW
RegCloseKey

oleaut32

VarNumFromParseNum
SafeArrayRedim

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c2e03f78792d28276fbf9ed10d23b641

Code Sign

59:bc:fa:5b:8f:bb:32:be:06:b1:ac:01:af:5b:42:65Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9dCertificate

Key Usages

53:09:1e:c5:a9:cd:d6:02:9f:70:8c:46:15:7d:8c:8e:77:36:2b:dc:fa:0d:28:d6:52:d1:5a:73:b8:14:e6:75Signer

Headers

File Characteristics

Imports

comctl32

wininet

kernel32

user32

gdi32

advapi32

oleaut32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 13KB

.rsrc Size: 76KB - Virtual size: 75KB

59:bc:fa:5b:8f:bb:32:be:06:b1:ac:01:af:5b:42:65
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

53:09:1e:c5:a9:cd:d6:02:9f:70:8c:46:15:7d:8c:8e:77:36:2b:dc:fa:0d:28:d6:52:d1:5a:73:b8:14:e6:75
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 76KB - Virtual size: 75KB