0606d1978f09022d420e36fd3130df96

Sharing

Copy URL Twitter E-mail

General

Target

0606d1978f09022d420e36fd3130df96
Size

318KB
MD5

0606d1978f09022d420e36fd3130df96
SHA1

6001a77fb5d5872011b9a1e9fea455a84dc166a2
SHA256

ad09424e1b9181efad679d2349a78cda5fb20e60152e452fe1ffae057fbaf334
SHA512

fd31a41d4ae5cbf51a1431c66985a13e6e2f16175d28646070897844078c2aab49df41562fca20c106470834df496576368e65c40d16ba5840c0a719a1bca64a
SSDEEP

6144:LaBlOsREPnLtL6L6qivZcuJzWJYkg8xMxwTXe/fPnkjwfluVal:43E/LtxvrKJYkUxN3mtVal

Score

1^/10

Malware Config

Signatures

Files

0606d1978f09022d420e36fd3130df96
.exe windows:4 windows x86 arch:x86

581663c837bb67165d5e6b87212a5d0b

Code Sign

1f:f6:d9:ed:57:4e:c2:a0:99:38:9b:4b:de:6c:6d:c4
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/02/2015, 00:00

Not After

25/02/2016, 23:59

Subject

CN=Consortium Group ltd,O=Consortium Group ltd,POSTALCODE=00152,STREET=CORNER OF GR.MARLBOROUGH UN GR.GEORGE STR.+STREET=3RD FLOOR\, C&h TOWERS\,,L=ROSEAU,ST=ROSEAU,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a8:79:ed:d9:18:b0:c9:01:ea:0d:20:e4:52:09:0e:04:3b:87:e9:94
Signer

Actual PE Digest

a8:79:ed:d9:18:b0:c9:01:ea:0d:20:e4:52:09:0e:04:3b:87:e9:94

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

version

VerQueryValueW

wininet

HttpEndRequestA

kernel32

VirtualAlloc
CreateFileA
ReadFile
GetLastError
CreateFileMappingA
QueryPerformanceCounter
SetCurrentDirectoryW
GetCurrentProcess
CloseHandle
CreateThread
GetUserDefaultLangID
InterlockedDecrement
FreeLibrary
FindResourceA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
WriteFile
CompareStringA
DeleteFileW
GetCPInfo
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapAlloc
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
TerminateProcess
HeapFree
SetErrorMode
GetVersion
GetTickCount
ExitProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
TlsGetValue
GetStartupInfoA
GetModuleHandleA
GetVersionExA
GetProcAddress
GetCommandLineA
GetACP
GetStringTypeW
GetOEMCP
LoadLibraryA
SetFilePointer
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
CreateEventA

user32

IsDialogMessageA
IsChild
InvalidateRect
GetWindowLongA
GetSystemMetrics
PtInRect
IsRectEmpty
IsWindow
RemovePropA
SetMenu
SetMenuItemInfoA
SetPropA
GetSystemMenu
GetClassNameA
GetClassInfoA
CreateWindowExA
MessageBoxA
GetScrollPos
GetKeyboardType
LoadStringA
ShowWindow
CharNextA
IsIconic
SetRect
SetScrollInfo
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowThreadProcessId
IntersectRect
IsWindowEnabled
IsWindowVisible
IsZoomed
RegisterClassExA
GetCapture

gdi32

ExcludeClipRect
DeleteObject
CreatePen
GetLogColorSpaceW
GetClipBox
TextOutW
SetAbortProc
DeleteMetaFile
OffsetWindowOrgEx
CreateFontIndirectA
DeleteEnhMetaFile
Rectangle
CreatePenIndirect

comdlg32

GetOpenFileNameA
ChooseFontA
ReplaceTextW
FindTextW
GetSaveFileNameA

advapi32

RegCreateKeyExA
AllocateAndInitializeSid
RegCloseKey

shell32

ShellExecuteA
StrStrIA

ole32

CoTaskMemAlloc

oleaut32

VariantInit
VarRound
SafeArrayRedim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayPutElement
SysAllocStringLen
SysReAllocStringLen
SysFreeString

Sections

.text
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

581663c837bb67165d5e6b87212a5d0b

Code Sign

1f:f6:d9:ed:57:4e:c2:a0:99:38:9b:4b:de:6c:6d:c4Certificate

Extended Key Usages

Key Usages

a8:79:ed:d9:18:b0:c9:01:ea:0d:20:e4:52:09:0e:04:3b:87:e9:94Signer

Headers

File Characteristics

Imports

comctl32

version

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 264KB - Virtual size: 263KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 28KB - Virtual size: 26KB

1f:f6:d9:ed:57:4e:c2:a0:99:38:9b:4b:de:6c:6d:c4
Certificate

a8:79:ed:d9:18:b0:c9:01:ea:0d:20:e4:52:09:0e:04:3b:87:e9:94
Signer

.text
Size: 264KB - Virtual size: 263KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 28KB - Virtual size: 26KB