0aec68088e59cd4042344dc6c2b08fd8

Sharing

Copy URL Twitter E-mail

General

Target

0aec68088e59cd4042344dc6c2b08fd8
Size

306KB
MD5

0aec68088e59cd4042344dc6c2b08fd8
SHA1

e6518a8b78f4631b56e697bbc054e7aaf7976a7c
SHA256

067cd4d343e53ea7dd4c6262f2eb3df1ccca616e875963025d2fe626fbae20fb
SHA512

71c96f9207f045222c1c4f0f65aec4a04fe439777a480105c1d7592cb66cfb767667d311ba1601ce52b9c4b543b4644e685c7830fdb610581a15bb46cb296804
SSDEEP

6144:K+nIUNwic9ZadaenJsdm1QCyrr0lHSH4NiE1LbKjaU:vnIQwic98QenJUGQlYlgCiE1maU

Score

1^/10

Malware Config

Signatures

Files

0aec68088e59cd4042344dc6c2b08fd8
.exe windows:4 windows x86 arch:x86

4f9d5f15cac85993b2f3d69086d31a4f

Code Sign

12:a7:a4:98:01:69:6d:40:66:b1:e8:e6:ca:2a:3e:89
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

07/11/2014, 00:00

Not After

07/11/2015, 23:59

Subject

CN=Consortium Group ltd.,O=Consortium Group ltd.,POSTALCODE=00152,STREET=CORNER OF GR.MARLBOROUGH UN GR.GEORGE STR. ROSEAU\,DOMINICA\, 00152+STREET=3RD FLOOR\, C&h TOWERS,L=ROSEAU,ST=ROSEAU,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2b:1b:3e:64:cf:71:db:fa:39:5f:ee:22:30:dc:b1:a0:6f:e7:e2:b5
Signer

Actual PE Digest

2b:1b:3e:64:cf:71:db:fa:39:5f:ee:22:30:dc:b1:a0:6f:e7:e2:b5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW

kernel32

CreateThread
SetErrorMode
QueryPerformanceCounter
GetLastError
GetVersionExA
GetProcAddress
GetTickCount
GetVersion
WriteFile
GetCommandLineA
ExitProcess
VirtualAlloc
ReadFile
CloseHandle
GetTempPathW
SetCurrentDirectoryW
GetCurrentProcess
InterlockedDecrement
DeleteFileW
CreateFileMappingA
CreateDirectoryW
GetUserDefaultLangID
CreateFileA
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapAlloc
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
LoadLibraryA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
TerminateProcess
HeapFree
GetStartupInfoA
GetModuleHandleA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
GetCPInfo
GetSystemTimeAsFileTime
TlsGetValue
SetFilePointer
GetCurrentThreadId
GetACP
GetOEMCP
LCMapStringW
SetEndOfFile

user32

ShowWindow
ShowScrollBar
ShowCursor
ShowOwnedPopups
TranslateMessage
ValidateRect
WaitMessage
GetCapture
GetClassNameA
GetSystemMenu
GetWindowLongA
MessageBoxA
CreateWindowExA
GetSystemMetrics
CharNextW
GetClassInfoA

gdi32

Rectangle

advapi32

AllocateAndInitializeSid
RegCreateKeyExA
RegCloseKey

ole32

CoTaskMemAlloc

Sections

.text
Size: 256KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f9d5f15cac85993b2f3d69086d31a4f

Code Sign

12:a7:a4:98:01:69:6d:40:66:b1:e8:e6:ca:2a:3e:89Certificate

Extended Key Usages

Key Usages

2b:1b:3e:64:cf:71:db:fa:39:5f:ee:22:30:dc:b1:a0:6f:e7:e2:b5Signer

Headers

File Characteristics

Imports

version

kernel32

user32

gdi32

advapi32

ole32

Sections

.text Size: 256KB - Virtual size: 252KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 23KB

.rsrc Size: 28KB - Virtual size: 24KB

12:a7:a4:98:01:69:6d:40:66:b1:e8:e6:ca:2a:3e:89
Certificate

2b:1b:3e:64:cf:71:db:fa:39:5f:ee:22:30:dc:b1:a0:6f:e7:e2:b5
Signer

.text
Size: 256KB - Virtual size: 252KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 23KB

.rsrc
Size: 28KB - Virtual size: 24KB