205692ed61f8303aa7eb677578ede3d1

Sharing

Copy URL Twitter E-mail

General

Target

205692ed61f8303aa7eb677578ede3d1
Size

322KB
MD5

205692ed61f8303aa7eb677578ede3d1
SHA1

71ef040ca25e68e412a47e41dd4ea716ea7991af
SHA256

12bbe797ee80a63c620aeb62ccf2b4d41077336a930f1c1dc8b6df52efe07b47
SHA512

576901ca1c3fdf64903a7f190f94a3ed436b9c09c73d89c3a9a1bdd8287e0019b4e3eb5f7f188df6ce633a3902a745bef42849ef5c95059e53d708c0b0c4e536
SSDEEP

6144:STwNL12lOU4McwJfcs1Ls2GpMCENA1aeszaebDP:SsL12lOUTJrPYMCEamj/P

Score

1^/10

Malware Config

Signatures

Files

205692ed61f8303aa7eb677578ede3d1
.exe windows:4 windows x86 arch:x86

14209c415322b1e56ec25d4c04cdb7b4

Code Sign

7b:b0:fb:11:c6:7d:01:06:4a:b7:f8:c7:8c:eb:83:b8
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

07/11/2014, 00:00

Not After

07/11/2015, 23:59

Subject

CN=Consortium Group ltd.,O=Consortium Group ltd.,POSTALCODE=00152,STREET=CORNER OF GR.MARLBOROUGH UN GR.GEORGE STR. ROSEAU\,DOMINICA\, 00152+STREET=3RD FLOOR\, C&h TOWERS,L=ROSEAU,ST=ROSEAU,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cb:32:7c:9d:80:b2:6d:cd:91:6e:79:96:ca:8b:05:ed:fc:3c:4c:82
Signer

Actual PE Digest

cb:32:7c:9d:80:b2:6d:cd:91:6e:79:96:ca:8b:05:ed:fc:3c:4c:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_EndDrag
ImageList_DragShowNolock
ImageList_GetDragImage
ImageList_Read

kernel32

GetVersion
GetCurrentThreadId
ExitProcess
VirtualAlloc
ReadFile
GetCommandLineW
LockResource
WriteFile
GetLastError
CreateThread
QueryPerformanceCounter
CloseHandle
GetCurrentProcess
GetSystemTimeAsFileTime
GetUserDefaultLangID
GetModuleHandleA
CreateFileMappingA
GetTickCount
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapAlloc
RtlUnwind
SetFilePointer
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
lstrcmpiA
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
GetCommandLineA
GetVersionExA
GetModuleHandleW
GetProcAddress
GetDefaultCommConfigA
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
HeapFree
TerminateProcess
UnhandledExceptionFilter
GetModuleFileNameA

user32

RegisterWindowMessageA
GetSystemMetrics
CreateDialogParamA
LoadStringA
GetKeyboardType
WindowFromPoint
ReleaseDC
GetClientRect
RegisterClassExA
DialogBoxParamA
CreateWindowExA
GetDC

gdi32

Rectangle
GetDeviceCaps

comdlg32

GetSaveFileNameA

advapi32

GetUserNameA
RegSetValueExW
RegCloseKey
RegCreateKeyExA

ole32

CoUninitialize
CoInitialize
CoTaskMemAlloc

Sections

.text
Size: 272KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14209c415322b1e56ec25d4c04cdb7b4

Code Sign

7b:b0:fb:11:c6:7d:01:06:4a:b7:f8:c7:8c:eb:83:b8Certificate

Extended Key Usages

Key Usages

cb:32:7c:9d:80:b2:6d:cd:91:6e:79:96:ca:8b:05:ed:fc:3c:4c:82Signer

Headers

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

ole32

Sections

.text Size: 272KB - Virtual size: 269KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 24KB

.rsrc Size: 28KB - Virtual size: 25KB

7b:b0:fb:11:c6:7d:01:06:4a:b7:f8:c7:8c:eb:83:b8
Certificate

cb:32:7c:9d:80:b2:6d:cd:91:6e:79:96:ca:8b:05:ed:fc:3c:4c:82
Signer

.text
Size: 272KB - Virtual size: 269KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 24KB

.rsrc
Size: 28KB - Virtual size: 25KB