01ab83b7464c84b0fd18adf372de4898

Sharing

Copy URL

Twitter E-mail

General

Target

01ab83b7464c84b0fd18adf372de4898
Size

587KB
MD5

01ab83b7464c84b0fd18adf372de4898
SHA1

26c7367fc083733862b4b223d970a653c587c417
SHA256

11a69e89d77b6ef22aa0b86a1f18574b0c1a5772b0ee6877599ab3ef8c61d38d
SHA512

d48e644849fbdb0a20f6eb2503e05a3a8cfaf001dc2ac3ddb341122da866de348b6cab3056e95fb47a68ca12e66411d947c102aaa563e31ab0223010f6d726f2
SSDEEP

12288:8ZWzPqnoVOiFb5yl9UXSNRigspipMKM0pfGdzl5ybIDl3fE44p66fvX:iWzPqnmOiFUrUgspipMAp6zl5ybIDl3K

Score

1^/10

Malware Config

Signatures

Files

01ab83b7464c84b0fd18adf372de4898
.exe windows:4 windows x86 arch:x86

f0ee1334b2cf8dce7cef9660f00edf55

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:01:f1:f3:cc:d2:f6:a9:5b:2a:2d:5c:53:06:f3:ea
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13-04-2015 00:00

Not After

12-04-2016 23:59

Subject

CN=FLAGMAN-SOFT,O=FLAGMAN-SOFT,POSTALCODE=646822,STREET=4\, kv.1\, ul.Vodoprovod,L=S. PRISTANSKOE,ST=Omsk region,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c6:69:de:60:10:96:48:4c:1e:e8:81:79:26:91:c7:c6:7b:a0:c1:ef
Signer

Actual PE Digest

c6:69:de:60:10:96:48:4c:1e:e8:81:79:26:91:c7:c6:7b:a0:c1:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

IsCharLowerA
MapVirtualKeyExW
GetShellWindow
CascadeChildWindows
GetDlgItemInt
LoadMenuIndirectW
EnumDisplayMonitors
GetParent
MessageBoxExW
CharUpperA
TabbedTextOutW
IsCharUpperA
EndTask
GetUserObjectSecurity
MonitorFromRect
OemKeyScan
FindWindowA
OpenWindowStationA
GetClassInfoA
SetClipboardViewer
GetIconInfo
SystemParametersInfoA
UnionRect
EqualRect
LockWorkStation
TranslateAcceleratorA
EnableScrollBar
TileChildWindows
ActivateKeyboardLayout
RegisterWindowMessageA
MapDialogRect
GetDesktopWindow
BroadcastSystemMessageExW
FrameRect
IsWindow
LoadStringW
ShowStartGlass
GetCursorInfo
CallNextHookEx
SetMenu
GetUserObjectInformationW
CopyIcon
CreateDialogIndirectParamW
EnumDesktopsW
SetDlgItemInt
SetLayeredWindowAttributes
GetScrollRange
CreateAcceleratorTableW
EndPaint
GetMenuBarInfo
DestroyCaret
EnumClipboardFormats
SetParent
MessageBeep
DragObject
IsMenu
SetUserObjectInformationW
SetCaretBlinkTime
DragDetect
SetWindowTextW
RegisterHotKey
LoadKeyboardLayoutA
IsHungAppWindow
CharToOemBuffW
TileWindows
ChangeDisplaySettingsW
DrawCaptionTempW
IsCharLowerW
SendMessageTimeoutW
UnhookWindowsHook
LoadCursorW
DlgDirSelectExA
LoadStringA
LoadBitmapA
GetClipboardFormatNameA
SetLastErrorEx
LoadBitmapW
GetAsyncKeyState
MessageBoxW
GetMenuItemCount
GetAltTabInfoA
GetClipboardViewer
GetListBoxInfo
GetKeyState
IsChild
SetActiveWindow
PrintWindow
UnregisterDeviceNotification
AttachThreadInput
InvalidateRgn
OpenDesktopA
ModifyMenuW
DrawMenuBar
CreateIconFromResourceEx
CloseWindowStation
SetClassLongW
CopyImage
CharPrevExA
GetMenuItemID
LoadAcceleratorsA
AdjustWindowRectEx
SwapMouseButton
RegisterDeviceNotificationW
WinHelpW
SetScrollPos
MonitorFromPoint
GetComboBoxInfo
LoadImageA
OemToCharBuffW
DispatchMessageA
GetPropA
GetScrollInfo
CreatePopupMenu
GetMonitorInfoA
AnyPopup
DialogBoxIndirectParamW
GetSystemMenu
GetMenu
GetInputState
GetSysColorBrush
GetSysColor
DrawMenuBarTemp
GetMessageW
DrawCaptionTempA
MessageBoxA
SetWindowWord
SetMenuContextHelpId
IsHungAppWindow
GetShellWindow

kernel32

CancelWaitableTimer
FlushInstructionCache
QueryPerformanceCounter
GetFileSizeEx
SetUserGeoID
ReleaseMutex
DnsHostnameToComputerNameA
GetConsoleFontInfo
RtlZeroMemory
GetNamedPipeHandleStateA
GetExpandedNameA
RtlFillMemory
GlobalFix
HeapReAlloc
SetFileTime
UnmapViewOfFile
GetShortPathNameW
GetNamedPipeHandleStateW
OpenFileMappingA
GetCommModemStatus
GetComputerNameExA
GetCurrentThread
WriteConsoleOutputCharacterW
CreateNamedPipeW
GetCPInfoExA
OpenFileMappingW
SetVolumeMountPointW
InitializeCriticalSection
LCMapStringW
SearchPathA
DeleteTimerQueueTimer
QueryPerformanceFrequency
FindFirstFileW
ReadConsoleInputA
EnumCalendarInfoA
FindFirstVolumeW
TryEnterCriticalSection
SetDefaultCommConfigW
FatalAppExitW
CreatePipe
OutputDebugStringA
LZRead
lstrcpyA
GetProcessVersion
GetCPInfo
LoadResource
GetTickCount
HeapAlloc
GetCommandLineW
SetVolumeLabelA
ReplaceFileA
FreeEnvironmentStringsW
TlsGetValue
WriteProfileSectionW
MoveFileExA
SetVolumeLabelW
RegisterWaitForInputIdle
LockFile
GetCommMask
ReadConsoleInputExW
GetSystemTime
GetThreadTimes
SetFileApisToOEM
EnumCalendarInfoExW
EnumResourceTypesA
UnlockFile
GetOEMCP
IsBadHugeWritePtr
GlobalLock
GetVolumePathNamesForVolumeNameW
WaitForSingleObject
GetExpandedNameW
GetSystemDefaultLangID
GetCurrentThreadId
lstrcpy
TransactNamedPipe
ReadConsoleW
GetStringTypeW
FlushViewOfFile
GetGeoInfoW
CreateEventW
GetFileAttributesExA
GlobalWire
CancelDeviceWakeupRequest
ReadConsoleOutputW
WaitForMultipleObjectsEx
FindNextVolumeMountPointA
GetConsoleKeyboardLayoutNameW
RaiseException
InterlockedIncrement
ReadFileEx
GlobalAlloc
FindFirstVolumeMountPointW
GetNumberOfConsoleMouseButtons
FreeConsole
GetConsoleKeyboardLayoutNameA
VerLanguageNameA
GlobalGetAtomNameA
DosPathToSessionPathW
RequestDeviceWakeup
RemoveDirectoryA
QueryDosDeviceW
CompareStringA
CreateHardLinkA
TransmitCommChar
VerifyVersionInfoW
ExitThread
DeleteFileW
EnumTimeFormatsW
OpenSemaphoreW
GetCurrentProcess
GetProcessHeap
LoadLibraryA
LocalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

oleaut32

VarAnd
CreateErrorInfo

gdi32

TextOutW

wtsapi32

WTSDisconnectSession

comctl32

CreatePropertySheetPageW
FlatSB_ShowScrollBar
GetEffectiveClientRect
LBItemFromPt
ImageList_DragLeave

Exports

Exports

�u�Ȑv��)��W�)�[@�S�SiKH�8�A��_�� <��4�5�g�Z4�I��g��驑U��]R��2:�U7#�ϧ�oH��Q�%��w�U5�OP�,�r��1�T�;�v �EI,D��%W�:{��-@��p6��d�ſ�X��%��C��3[�K�)��fR�F�>��Zi��3��SZ��)zE��IדRuL��-lFC=X�{C ��IF�ȣ��^F��m[3R��yA>1��l��\! z CXd��IP��~�̀��1�4��Ⱦ�|^j�n Z�`��t8��e:;��̿X�P�B|^�<V�gU�tJ��P��L��]�hh�tD^<��(Ɩ�h��q��Q�� G'�q�J3��,��6��<5~��>1a�:��í��qUo�h�Bv�-�L?y;��fz�[q�i#x��te��h��)��Y*,?V��rJ3��{e8�I��8 ��G��3�/Ȁ��n��qq��#�c��3X��r]-�:]Ӈ�Õ�Ǔ ��]��n��^&��]C!��]9�:�/�>P�V�*&��+�3{��b6�A��r��TrjFC��*j.��-dT��3�w�G"q�f(�U�U��AB�Un�1JNdzz�uVy�;��W��In�e\;�1/|g˸(=7��*I ��|=��:�0�s2~hj��z?�G��MAwVt ��0��immTd͕:��nC��V��GU�� f�@��g�ƪ�X��ʞ��v��\�(6ك�6{��B��VQ�wt��3Hv�aR�a�6.��G�%�/7�1W:��q(U �S\�+�"=��¼G)CGdFcV �kG�*��`�\.�3v:3��]�&��[��J��%4�]�zgF�E�k0��uݣ�@Y��hJ�O��h?�dLo��i1�WPxPM��b�݆�5C'��Рb�%��A? �D�~�1��*{��DP�d�r&Ӂ�X��-@Y��,p V�@��`��Lq^s�J#3��a%x=��(|��z��K�))�m~�P��G��ģ�^bXP��≻(��6��s �a8�G�V��h��I�ߵ��=Lk��&�� .� $A��HO��b�L�� $�S^|糏d��#��Y��:j�IE5��R��H��`��w׋��i�9#|¾�aյ��>��K�I>��y �&�#�L��y��]��^�0 o��w��|gsW�x��a��U:k�4��*��O�p-�/Y��rW�2�]��o|��*��.��í\�-N'l�:ln��u(��<_ˈ4>�R�� L>�= <E&�:R�p�m �ԚAu�qC��Mݴ�?KV!?#Eҿ��1<b/�T�o�?Lu�c��Ke��J�xg�/�e��g�#mg��t��y�"$X��T��!nU�-��/io�"��Cy �Rb�ࡏt�}��Z2(�UuM��T��L�Z�U ��TR?�LiI��e�x{�6�i��C|��=�*�[ ��v��9��İVK��4��R��z-�D��r�0+�Z��v�o�EМQ�3�tg��T({��D��z��͇c��ۆ<�Z�J�=��k�&a��zxkGdo\hL�#F?�3|��ԧg+�%�\�3�$�!YM��o�H2"�-3Rw��nR_h��4� q2�ho|��eU��TG��_QP|c�_��w3�&ko�^ ^��hx�ƴ�тJDN��,�Zj��H�qXs3l��dAת�B��'?B��g��2Kk̘��1��7~�H|A׹u�qPu.1��4+�A��D� �wPn?��"��6�}'`��7�G3z�A��*��&��*h{�#�|l_�l<�P��`R��O)� ��-7�K��2�ވ� �w�qP�QM�5�B��gӠ?ȥ!�l��P��B^�׆��1� �/��J Xh3��C�Nn��'w�A��#��Ļ�%��%��b�,��M�N4U��Pb=JJ�o�~��So��%�tj��8��D��,Ȱmp�1Y�AC��`ʮ�>9��N-�5U�2�v��B��p!�m�>�|s_z�tA%��4�4�~H[�+��d!e�G�/�o0��BX6|3�f��40Kj�X8B@H`DaOM� t�O��^��zs�f5�uEH�`�Ҕ:}��J�� H\��r��P}��G�D$">~�֏�*iդ%�M(㒮��7A��`��nd{}R��Q�S�}�]��M.ew15��R�5pй/�J��Q��B|��y�n0�h��w ��7�Lӫ5��Y=\~�Aث,L �8__��i9"��n��$��HQ��蹓 �k��#a^bތ�qr��6�+�� 4V�� U�\E�\�� [`��L��%5B8�?m ��Rt��=�$(nv��vwS�g�m�,�_�>��>@�Tb.#z��FJu8?�h[Ϡ�D�~Q�~H��G]Wý��9H�}��yc� c̕f9p�W�6��s�H�(�ݸ=*MӮ��ƕ��C��jd�L|��ZH�um<>0��=J��j�g�`�LU��x�찻��D�8��a_'m��\�w�7�}��~�$8g�{%��L�<��͠kr|u�� a��4�}<��F��(Xo;��r�sJ��Mu�$hC��³D�NP��P&ʣ�W�A��X�j��/��̎Ě+�Z��c�?�Ϛ�)��f+�R��6�p�D�Q�H�,#��-OS�y�q,li��!=�"�E�^��`Z��vQx*�u��ļ2|5�9�ֈ(�Z�C�.0fsΧa��+��x�.��E�}�;��M�PG�v�

Sections

code
Size: 437KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

data
Size: 14KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0ee1334b2cf8dce7cef9660f00edf55

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

70:01:f1:f3:cc:d2:f6:a9:5b:2a:2d:5c:53:06:f3:eaCertificate

Extended Key Usages

Key Usages

c6:69:de:60:10:96:48:4c:1e:e8:81:79:26:91:c7:c6:7b:a0:c1:efSigner

Headers

File Characteristics

Imports

user32

kernel32

oleaut32

gdi32

wtsapi32

comctl32

Exports

Exports

Sections

code Size: 437KB - Virtual size: 440KB

data Size: 14KB - Virtual size: 20KB

.idata Size: 6KB - Virtual size: 8KB

.rdata Size: 17KB - Virtual size: 20KB

.tls Size: 512B - Virtual size: 4KB

.pdata Size: 64KB - Virtual size: 68KB

.reloc Size: 5KB - Virtual size: 8KB

.rsrc Size: 35KB - Virtual size: 34KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

70:01:f1:f3:cc:d2:f6:a9:5b:2a:2d:5c:53:06:f3:ea
Certificate

c6:69:de:60:10:96:48:4c:1e:e8:81:79:26:91:c7:c6:7b:a0:c1:ef
Signer

code
Size: 437KB - Virtual size: 440KB

data
Size: 14KB - Virtual size: 20KB

.idata
Size: 6KB - Virtual size: 8KB

.rdata
Size: 17KB - Virtual size: 20KB

.tls
Size: 512B - Virtual size: 4KB

.pdata
Size: 64KB - Virtual size: 68KB

.reloc
Size: 5KB - Virtual size: 8KB

.rsrc
Size: 35KB - Virtual size: 34KB