4a0752ee19529f5ceb27c3e74c3a00bf

Sharing

Copy URL Twitter E-mail

General

Target

4a0752ee19529f5ceb27c3e74c3a00bf
Size

334KB
MD5

4a0752ee19529f5ceb27c3e74c3a00bf
SHA1

b560306d5202e78d799a4288a2f3b3bb344c3e71
SHA256

1408eb35a6f0abed3e3a3896a256eb416e79d4f01d20df27dd1b505e76122ca4
SHA512

fd70acd500b843466b9dd8c31e536552c7af997b6d239ea7e6c2c00a83e0690775f8028fed0dd62bd95754d8c7b9a243d967916b408380ddb9fc60e24bf3cbb3
SSDEEP

6144:hWUlEo99cSHJTGjMVsmD0+aBYosy5JnoIhZTSABCR:MUWUGSHJDD7L3y5NoM/CR

Score

1^/10

Malware Config

Signatures

Files

4a0752ee19529f5ceb27c3e74c3a00bf
.exe windows:4 windows x86 arch:x86

0f2689e0ef45d6babefc06cf46131973

Code Sign

10:25:72:a3:83:8e:18:c1:d9:86:9b:bb:dc:47:b8:69
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

24/02/2015, 00:00

Not After

24/02/2016, 23:59

Subject

CN=Consortium Group ltd,O=Consortium Group ltd,POSTALCODE=00152,STREET=CORNER OF GR.MARLBOROUGH UN GR.GEORGE STR.+STREET=3RD FLOOR\, C&h TOWERS\,,L=ROSEAU,ST=ROSEAU,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d9:be:b8:c5:82:59:fa:88:9e:af:53:4b:d1:8b:d9:f3:61:8d:ca:4a
Signer

Actual PE Digest

d9:be:b8:c5:82:59:fa:88:9e:af:53:4b:d1:8b:d9:f3:61:8d:ca:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

wininet

HttpEndRequestA
InternetOpenA

kernel32

GetCurrentThreadId
CloseHandle
lstrcmpiA
GetVersionExA
GetStartupInfoA
TlsGetValue
GetProcAddress
GetTickCount
GetVersion
WriteFile
ExitProcess
VirtualAlloc
CreateFileA
ReadFile
GetLastError
CreateFileMappingA
GetCurrentProcess
CreateDirectoryW
GetCommandLineA
QueryPerformanceCounter
GetCurrentProcessId
CreateThread
GetSystemTimeAsFileTime
InterlockedDecrement
DeleteFileW
GetACP
GetCPInfo
SetFilePointer
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapAlloc
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
LCMapStringW
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
GetUserDefaultLangID
SetCurrentDirectoryW
LoadLibraryA
GetOEMCP
SetEndOfFile
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
GetTempPathW
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
TerminateProcess
HeapFree
GetModuleHandleA

user32

LoadIconW
LoadCursorW
RegisterClassW
CharNextW
RegisterClassExA
CreateWindowExA
GetSystemMetrics
MessageBoxA
ShowWindow
CreateWindowExW

gdi32

Rectangle
GetStockObject

advapi32

RegCreateKeyExA
AllocateAndInitializeSid
RegCloseKey

ole32

CoTaskMemAlloc

oleaut32

VarNumFromParseNum
VarDecRound
SysAllocStringLen
SysReAllocStringLen
SysFreeString

Sections

.text
Size: 272KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

.data
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f2689e0ef45d6babefc06cf46131973

Code Sign

10:25:72:a3:83:8e:18:c1:d9:86:9b:bb:dc:47:b8:69Certificate

Extended Key Usages

Key Usages

d9:be:b8:c5:82:59:fa:88:9e:af:53:4b:d1:8b:d9:f3:61:8d:ca:4aSigner

Headers

File Characteristics

Imports

comctl32

wininet

kernel32

user32

gdi32

advapi32

ole32

oleaut32

Sections

.text Size: 272KB - Virtual size: 268KB

.data Size: 24KB - Virtual size: 22KB

.rsrc Size: 32KB - Virtual size: 28KB

10:25:72:a3:83:8e:18:c1:d9:86:9b:bb:dc:47:b8:69
Certificate

d9:be:b8:c5:82:59:fa:88:9e:af:53:4b:d1:8b:d9:f3:61:8d:ca:4a
Signer

.text
Size: 272KB - Virtual size: 268KB

.data
Size: 24KB - Virtual size: 22KB

.rsrc
Size: 32KB - Virtual size: 28KB