1775500260114aaf6b63ebe3a37f5d8a

Sharing

Copy URL Twitter E-mail

General

Target

1775500260114aaf6b63ebe3a37f5d8a
Size

23KB
MD5

1775500260114aaf6b63ebe3a37f5d8a
SHA1

a2f5ed0205d26b9bd35619f847ea72bd3dafa9d0
SHA256

8819f497235935db7e07a9fb5f544c10f47e41799447a15681308c83ea85c043
SHA512

d5b50621c5a8e5d351593d68871303f892a9cbaf179b80087b956dfaa41623a3a9052f40b9cddc83355e45fdeef87eed01c024df2f6f8786e5e7c4aacfd562e6
SSDEEP

384:COJWbh2bktu0qiXDOZz9lZMTgz882wFgschh4WWieZWv7hC:Cek2beu0wZ685FgschhdeAh

Score

1^/10

Malware Config

Signatures

Files

1775500260114aaf6b63ebe3a37f5d8a
.exe windows:5 windows x86 arch:x86

79b36616405c011a0a0e2f0125e62613

Code Sign

69:75:f2:4e:2a:ca:f4:7f:b6:45:60:ad:50:b3:14:2b
Certificate

Issuer

CN=eryf2w4v6y2w

Not Before

25/02/2012, 10:44

Not After

31/12/2039, 23:59

Subject

CN=eryf2w4v6y2w

Extended Key Usages

ExtKeyUsageCodeSigning

2e:3b:dd:83:26:55:5f:b6:6a:ef:fa:65:46:27:68:ea:ee:8b:13:23
Signer

Actual PE Digest

2e:3b:dd:83:26:55:5f:b6:6a:ef:fa:65:46:27:68:ea:ee:8b:13:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalMemoryStatus
Heap32ListNext
InitAtomTable
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LocalHandle
LocalShrink
LocalUnlock
Module32Next
OpenEventW
OpenSemaphoreA
OutputDebugStringA
PeekConsoleInputA
Process32FirstW
ReadConsoleInputA
ReadConsoleOutputAttribute
RemoveDirectoryW
RtlUnwind
GlobalCompact
SetCommState
SetComputerNameA
SetConsoleCursorInfo
SetConsoleMode
SetConsoleScreenBufferSize
SetConsoleTitleA
SetEnvironmentVariableW
SetFileAttributesW
SetFileTime
SetProcessWorkingSetSize
SetThreadExecutionState
TerminateJobObject
Thread32First
WaitForMultipleObjectsEx
WaitNamedPipeW
WriteConsoleOutputW
_llseek
lstrcpynW
lstrlenA
GetWindowsDirectoryW
GetVolumeInformationW
GetVolumeInformationA
GetTimeFormatA
GetThreadLocale
GetTempFileNameW
GetStringTypeExA
GetStartupInfoW
GetProcessWorkingSetSize
GetProcessPriorityBoost
GetProcessIoCounters
GetProcessHeap
GetModuleHandleW
GetLocalTime
GetHandleInformation
GetFileAttributesExA
GetEnvironmentVariableA
GetEnvironmentStrings
GetDefaultCommConfigW
GetCurrencyFormatW
GetConsoleOutputCP
GetConsoleAliasesLengthA
GetConsoleAliasesA
GetCommProperties
GetModuleHandleA
GetCalendarInfoA
GetACP
FreeUserPhysicalPages
FreeEnvironmentStringsW
FindVolumeMountPointClose
FindResourceA
FindNextVolumeW
FindNextChangeNotification
ExitThread
EraseTape
EnumUILanguagesA
EnumTimeFormatsA
EnumSystemLanguageGroupsW
EnumResourceLanguagesA
EnumDateFormatsA
EnumCalendarInfoA
CreateWaitableTimerA
CreateSemaphoreA
CreateMutexA
CreateMailslotW
CreateJobObjectW
CreateHardLinkW
CreateEventW
CreateDirectoryExA
CopyFileW
CopyFileExW
ConvertThreadToFiber
CancelDeviceWakeupRequest
CallNamedPipeW
BuildCommDCBW
BuildCommDCBAndTimeoutsW
BindIoCompletionCallback
BeginUpdateResourceW
GetProcAddress
SearchPathW

msvcrt

memset

advapi32

RegOpenKeyExA

oleaut32

VarI2FromDec
VarI4FromBool
VarI4FromDec
VarI4FromDisp
VarI4FromR4
VarI4FromR8
VarI4FromUI1
VarMonthName
VarNumFromParseNum
VarR4FromCy
VarR4FromDate
VarR4FromR8
VarR4FromUI4
VarR8FromI1
VarR8FromUI2
VarR8FromUI4
VarUI1FromBool
VarUI1FromCy
VarUI2FromBool
VarUI2FromDisp
VarUI2FromR4
VarUI2FromStr
VarUI4FromCy
VarUI4FromI1
VarUI4FromStr
VarWeekdayName
VarXor
VariantChangeType
VariantCopy
VariantInit
VectorFromBstr
VarI1FromUI4
VarFix
VarDecMul
VarDecFromUI2
VarDecFromStr
VarDecFromR8
VarDecFromI4
VarDecFromCy
VarDecFromBool
VarDecCmp
VarDecAdd
VarDateFromUI1
VarDateFromStr
VarDateFromR4
VarDateFromI2
VarDateFromDec
VarDateFromCy
VarCyRound
VarCyNeg
VarCyMulI4
VarCyFromR8
VarCyFromI2
VarBstrFromUI4
VarBstrFromUI2
VarBstrFromUI1
VarBstrFromI4
VarBstrFromI1
VarBstrFromCy
VarBoolFromR8
VarAnd
SysAllocStringLen
SysAllocString
SetErrorInfo
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayCreateVectorEx
SafeArrayCreateVector
SafeArrayCopyData
SafeArrayAllocData
QueryPathOfRegTypeLi
OleTranslateColor
OleIconToCursor
LoadRegTypeLi
LPSAFEARRAY_UserUnmarshal
LHashValOfNameSysA
LHashValOfNameSys
GetRecordInfoFromGuids
GetAltMonthNames
DosDateTimeToVariantTime
DispInvoke
DispGetIDsOfNames
CreateDispTypeInfo
BstrFromVector
BSTR_UserSize
BSTR_UserMarshal
SafeArrayGetElement

imm32

ImmDestroyContext
ImmDestroyIMCC
ImmDestroySoftKeyboard
ImmEnumInputContext
ImmEnumRegisterWordA
ImmEnumRegisterWordW
ImmEscapeW
ImmGetCandidateListA
ImmGetCandidateListCountA
ImmGetCandidateListCountW
ImmGetCandidateListW
ImmGetCompositionFontW
ImmGetCompositionStringA
ImmGetCompositionStringW
ImmGetContext
ImmGetConversionListA
ImmGetConversionListW
ImmGetConversionStatus
ImmGetDescriptionA
ImmGetDescriptionW
ImmGetGuideLineA
ImmGetGuideLineW
ImmGetHotKey
ImmGetIMCCLockCount
ImmGetIMCCSize
ImmGetIMEFileNameA
ImmCreateIMCC
ImmGetImeMenuItemsA
ImmGetProperty
ImmGetRegisterWordStyleA
ImmGetStatusWindowPos
ImmGetVirtualKey
ImmInstallIMEW
ImmIsIME
ImmIsUIMessageA
ImmIsUIMessageW
ImmLockIMC
ImmNotifyIME
ImmRegisterWordA
ImmRegisterWordW
ImmReleaseContext
ImmRequestMessageA
ImmSetCandidateWindow
ImmSetCompositionFontA
ImmSetCompositionFontW
ImmSetCompositionStringA
ImmSetCompositionStringW
ImmSetCompositionWindow
ImmSetConversionStatus
ImmSetHotKey
ImmSetOpenStatus
ImmShowSoftKeyboard
ImmSimulateHotKey
ImmGetIMEFileNameW
ImmUnlockIMCC
ImmUnregisterWordA
ImmConfigureIMEW

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text2
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text4
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text3
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79b36616405c011a0a0e2f0125e62613

Code Sign

69:75:f2:4e:2a:ca:f4:7f:b6:45:60:ad:50:b3:14:2bCertificate

Extended Key Usages

2e:3b:dd:83:26:55:5f:b6:6a:ef:fa:65:46:27:68:ea:ee:8b:13:23Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

oleaut32

imm32

Sections

.text Size: 7KB - Virtual size: 6KB

.text1 Size: 1KB - Virtual size: 1KB

.text2 Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 108B

.text4 Size: 1024B - Virtual size: 1000B

.text3 Size: 1024B - Virtual size: 1000B

.rsrc Size: 3KB - Virtual size: 2KB

69:75:f2:4e:2a:ca:f4:7f:b6:45:60:ad:50:b3:14:2b
Certificate

2e:3b:dd:83:26:55:5f:b6:6a:ef:fa:65:46:27:68:ea:ee:8b:13:23
Signer

.text
Size: 7KB - Virtual size: 6KB

.text1
Size: 1KB - Virtual size: 1KB

.text2
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 108B

.text4
Size: 1024B - Virtual size: 1000B

.text3
Size: 1024B - Virtual size: 1000B

.rsrc
Size: 3KB - Virtual size: 2KB