c4686f3e157ad262d54864764ffb6db0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

c4686f3e157ad262d54864764ffb6db0.exe
Size

77KB
MD5

c4686f3e157ad262d54864764ffb6db0
SHA1

6d4e7ac268d1d44aa8a740c485cc75be47e058ed
SHA256

d0f7267bcf1e7326a9765cdf4a9cf066dc25b0bb60677b87f434030d21703237
SHA512

f178b7314b0ee98932002297a98522a78ec083353e3a0e5668d41b559c7822ccf3ed003b5c07f74a5068c0adc1d096d9d24de1da5672122b0bb6c128ca8a71d1
SSDEEP

768:Q4GxRCaLKjgWxeJFQ2i6pyjf9rbEmW/2pk/443wF5G+G9tpAFQLGaKY/1:QLlK09Vi64JbE8pk/4rDG7tIdalt

Score

1^/10

Malware Config

Signatures

Files

c4686f3e157ad262d54864764ffb6db0.exe
.exe windows:4 windows x86 arch:x86

b134cfbf69db7774654d8f914c9d7cb6

Code Sign

04:7a:55
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:58

Not After

03/03/2024, 12:58

Subject

CN=Certum Time-Stamping Authority,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

01:00:00:00:00:01:22:a5:33:f5:d3
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

23/07/2009, 00:40

Not After

24/07/2011, 00:40

Subject

CN=Newtone Corporation,O=Newtone Corporation,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:23:9e:0f:ac:b3
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 13:00

Not After

27/01/2017, 12:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:23:9e:0f:af:24
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 10:00

Not After

27/01/2017, 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b2:92:f5:0e:f3:5f:28:cc:c0:c8:d2:7c:3b:60:e9:a0:f2:09:44:53
Signer

Actual PE Digest

b2:92:f5:0e:f3:5f:28:cc:c0:c8:d2:7c:3b:60:e9:a0:f2:09:44:53

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathA
SizeofResource
LockResource
LoadResource
FindResourceA
GetWindowsDirectoryA
GetVersionExA
lstrcpyA
lstrlenA
WriteFile
CopyFileA
GetSystemDirectoryA
lstrcatA
DeleteFileA
GetLastError
CreateFileA
GetFileTime
SetFileTime
CloseHandle
GetLocaleInfoA
LoadLibraryA
lstrcmpiA
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapSize
FlushFileBuffers

user32

MessageBoxA

advapi32

ControlService
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
StartServiceA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenServiceA

Sections

.text
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b134cfbf69db7774654d8f914c9d7cb6

Code Sign

04:7a:55Certificate

Extended Key Usages

01:00:00:00:00:01:22:a5:33:f5:d3Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:23:9e:0f:ac:b3Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:23:9e:0f:af:24Certificate

Extended Key Usages

Key Usages

b2:92:f5:0e:f3:5f:28:cc:c0:c8:d2:7c:3b:60:e9:a0:f2:09:44:53Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 40KB - Virtual size: 36KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 12KB - Virtual size: 9KB

04:7a:55
Certificate

01:00:00:00:00:01:22:a5:33:f5:d3
Certificate

04:00:00:00:00:01:23:9e:0f:ac:b3
Certificate

04:00:00:00:00:01:23:9e:0f:af:24
Certificate

b2:92:f5:0e:f3:5f:28:cc:c0:c8:d2:7c:3b:60:e9:a0:f2:09:44:53
Signer

.text
Size: 40KB - Virtual size: 36KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 12KB - Virtual size: 9KB