064d44ab4ec44f223cd37d1534c0154d

Sharing

Copy URL Twitter E-mail

General

Target

064d44ab4ec44f223cd37d1534c0154d
Size

1.1MB
MD5

064d44ab4ec44f223cd37d1534c0154d
SHA1

277b0715e5215f4261c7736f9628ec2d18d1656c
SHA256

116188e1a89c7c4216368471e5c80f30c9cfcbeb27552511590c585083b04191
SHA512

cece029db9853fd3eb84e97775011b1c4b1688e1135ad4b494ae328768f0579a0705b356647d12181e899ea209ff1c6529597ac487676c210886937ca1b4d87d
SSDEEP

24576:VEi8oM2kErGb1u7SYXj2OgOVwlMhlD9MPj0zTnd:v8oZrGb1uxjFwkDoA3d

Score

1^/10

Malware Config

Signatures

Files

064d44ab4ec44f223cd37d1534c0154d
.exe windows:5 windows x86 arch:x86

aeb161bf11a8cceabd1f40ac3d562ead

Code Sign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

26:40:16:b5:92:82:78:6c:80:76:a6:99:9c:03:28:5f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/03/2013, 00:00

Not After

28/03/2015, 23:59

Subject

CN=ArcadeFrontier,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ArcadeFrontier,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx

kernel32

GlobalUnlock
FreeResource
GlobalLock
GlobalAlloc
HeapAlloc
GetProcessHeap
GetTempPathW
CreateThread
InitializeCriticalSection
GetTickCount
ExitProcess
CreateMutexW
lstrcmpA
GetTempFileNameW
MoveFileExW
TerminateThread
SetEvent
OutputDebugStringW
CreateEventW
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
lstrcmpiW
FlushInstructionCache
lstrcmpW
MulDiv
GetModuleFileNameW
GetCurrentThreadId
SetLastError
LoadLibraryExW
InterlockedPopEntrySList
VirtualFree
InterlockedPushEntrySList
InterlockedCompareExchange
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
SetEnvironmentVariableW
CompareStringW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SetHandleCount
GetModuleFileNameA
HeapSize
HeapReAlloc
GetStringTypeW
GetStdHandle
HeapCreate
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
HeapSetInformation
GetCommandLineA
ExitThread
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapFree
RtlUnwind
CloseHandle
OpenProcess
GetLastError
FreeLibrary
LocalFree
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
Sleep
DeleteFileW
WriteFile
CreateFileW
GetCurrentDirectoryW
ReadFile
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
MultiByteToWideChar
GetFileAttributesW
SetFilePointer
GetFileType
DuplicateHandle
GetCurrentProcess
SystemTimeToFileTime
DosDateTimeToFileTime
CreateDirectoryW
SetFileTime
SizeofResource
GlobalFree
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
GetComputerNameW
GetVolumeInformationW
GetVersionExW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
lstrlenW
lstrlenA
GetModuleHandleW
FindResourceW
LoadResource
LockResource

user32

MapWindowPoints
GetClassInfoExW
PostThreadMessageW
MoveWindow
ClientToScreen
ScreenToClient
UnregisterClassA
GetWindowThreadProcessId
FindWindowW
wsprintfW
GetWindowTextW
GetClassNameW
SetActiveWindow
SetForegroundWindow
CreateWindowExW
RegisterClassExW
LoadIconW
ValidateRect
InvalidateRgn
SetCapture
IsChild
ReleaseCapture
CallWindowProcW
GetDesktopWindow
DestroyAcceleratorTable
GetWindow
GetFocus
CreateAcceleratorTableW
DestroyWindow
ShowWindow
BringWindowToTop
GetWindowRect
SetFocus
GetDlgItem
DefWindowProcW
GetWindowLongW
SetWindowLongW
LoadCursorW
EnableWindow
CheckDlgButton
SetTimer
KillTimer
PeekMessageW
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
RegisterClassW
GetDC
EndPaint
ReleaseDC
BeginPaint
SendMessageW
IsDlgButtonChecked
GetParent
MessageBoxW
SystemParametersInfoW
PostMessageW
CopyRect
IsWindowEnabled
GetDlgCtrlID
CloseWindow
SetDlgItemTextW
PostQuitMessage
SetCursor
GetWindowDC
IsDialogMessageW
MessageBoxExW
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowTextW
InvalidateRect
IsWindow
SetWindowPos
GetSysColor
GetClientRect
GetWindowTextLengthW
FillRect
IsWindowVisible
GetUpdateRect
RedrawWindow
RegisterWindowMessageW
CreateWindowExA
CharNextW

gdi32

GetDeviceCaps
CreateCompatibleBitmap
SetTextAlign
SetTextColor
TextOutW
GetTextExtentPoint32W
GetStockObject
CreateFontIndirectW
SetBkMode
BitBlt
SetBkColor
CreateSolidBrush
CreateDIBSection
StretchBlt
DeleteObject
GetDIBColorTable
GetObjectW
SetDIBColorTable
SelectObject
DeleteDC
CreateCompatibleDC

advapi32

RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyW
RegCreateKeyW
CheckTokenMembership
RegLoadKeyW
GetUserNameW
LookupAccountSidW
RegUnLoadKeyW
RegOpenKeyExW
GetLengthSid
CopySid
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
OpenProcessToken

shell32

SHGetFolderPathW
ShellExecuteW

ole32

OleUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VariantInit
VarUI4FromStr
SysAllocStringLen
SysStringLen
VariantClear
SysAllocString
SysFreeString

winhttp

WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpCrackUrl
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpQueryOption
WinHttpReadData

shlwapi

StrStrIW
SHDeleteKeyW
StrStrW
StrStrA
PathFileExistsW
wnsprintfW
ord176

gdiplus

GdipCreateFont
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteBrush
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipDeleteFont
GdipBitmapLockBits
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipCreateSolidFill
GdipCreateFromHDC
GdipDrawString
GdipMeasureString
GdipCloneBrush
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCreateFromHWND
GdipDrawImageRectI
GdipBitmapUnlockBits
GdipCreateBitmapFromScan0

msimg32

AlphaBlend
TransparentBlt

Sections

.text
Size: 211KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 796KB - Virtual size: 795KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aeb161bf11a8cceabd1f40ac3d562ead

Code Sign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4aCertificate

Key Usages

26:40:16:b5:92:82:78:6c:80:76:a6:99:9c:03:28:5fCertificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

winhttp

shlwapi

gdiplus

msimg32

Sections

.text Size: 211KB - Virtual size: 210KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 9KB - Virtual size: 19KB

.rsrc Size: 796KB - Virtual size: 795KB

.reloc Size: 23KB - Virtual size: 23KB

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

26:40:16:b5:92:82:78:6c:80:76:a6:99:9c:03:28:5f
Certificate

.text
Size: 211KB - Virtual size: 210KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 9KB - Virtual size: 19KB

.rsrc
Size: 796KB - Virtual size: 795KB

.reloc
Size: 23KB - Virtual size: 23KB