064620cf7033b01a5c1db1df89833513

Sharing

Copy URL Twitter E-mail

General

Target

064620cf7033b01a5c1db1df89833513
Size

11.2MB
MD5

064620cf7033b01a5c1db1df89833513
SHA1

31660fc88526b83efc41d96270ee3d6561252f0e
SHA256

61ef1eee12aa982613dbb6a399acc6a3830312eda18f51a48a72049a90f65d32
SHA512

8994626927d14b62227e3a194a7b9ed3701ce10841d42add6acb93f4d35134cab0b53518c2609f7358750804e313d21f4717d60355774fa8255c0b2bb0bd7626
SSDEEP

196608:bxEyMgXfkQy4zpwZhVlZxD1wlVvkY4U+NVoqpYXE05mnZuLInF6:VrXf5y9ZhFrwltwU+X5pCd2sIF6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Keygen.exe

Files

064620cf7033b01a5c1db1df89833513
.rar
Keygen.exe
.exe windows:4 windows x86 arch:x86

f5844a17675a9c10ee2bbf23a88083a5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

waveOutUnprepareHeader
waveOutGetPosition
waveOutRestart
waveOutPause
waveOutWrite
waveOutClose
waveOutReset
waveOutPrepareHeader
waveOutOpen

kernel32

HeapDestroy
Sleep
CreateFileA
ReadFile
SetFilePointer
FindResourceA
LoadResource
SizeofResource
HeapFree
GlobalLock
GlobalAlloc
MulDiv
GlobalUnlock
LockResource
GetModuleHandleA
ExitProcess
GetTickCount
RtlUnwind
InitializeCriticalSection
LoadLibraryA
GetConsoleMode
HeapCreate
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapAlloc
SetThreadPriority
CreateThread
CloseHandle
WaitForSingleObject
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
FlushFileBuffers
GetConsoleCP
GetModuleFileNameA
GetStdHandle
WriteFile
IsDebuggerPresent
GetCommandLineA
GetVersionExA
GetProcessHeap
GetStartupInfoA
GetLastError
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

user32

ReleaseDC
GetDC
SetTimer
GetWindowRect
RegisterClassExA
SendDlgItemMessageA
FillRect
SetCapture
KillTimer
DrawTextA
AnimateWindow
LoadBitmapA
GetParent
TrackMouseEvent
LoadIconA
wsprintfA
SendMessageA
SetWindowLongA
InvalidateRect
GetWindowLongA
CreateWindowExA
GetDlgItem
EndDialog
DefWindowProcA
SetWindowPos
ShowWindow
ReleaseCapture
SetWindowTextA
LoadCursorA
GetDlgCtrlID
GetDlgItemTextA
DialogBoxParamA
SetDlgItemTextA

gdi32

SetTextColor
BitBlt
DeleteDC
CreateFontA
SetPixel
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetPixel
GetStockObject
CreateSolidBrush
TextOutA
GetDeviceCaps

ole32

CreateStreamOnHGlobal

oleaut32

OleLoadPicture

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
solsuite.exe
.exe windows:1 windows x86 arch:x86

Code Sign

3a:ab:7d:ea:a6:85:08:57:f4:89:fa:5d:7d:65:dd:17
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

29/03/2007, 00:00

Not After

28/03/2009, 23:59

Subject

CN=TreeCardGames.com,O=TreeCardGames.com,POSTALCODE=29100,STREET=C.P. 187 - Poste Centrali,L=Piacenza,ST=PC,C=IT

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

17/05/2005, 00:00

Not After

16/05/2010, 23:59

Subject

CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
安装说明.url
.url

Sharing

General

Malware Config

Signatures

Files

f5844a17675a9c10ee2bbf23a88083a5

Headers

File Characteristics

Imports

winmm

kernel32

user32

gdi32

ole32

oleaut32

Sections

.text Size: 48KB - Virtual size: 48KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 212KB

.rsrc Size: 52KB - Virtual size: 52KB

Code Sign

3a:ab:7d:ea:a6:85:08:57:f4:89:fa:5d:7d:65:dd:17Certificate

Extended Key Usages

Key Usages

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 36KB - Virtual size: 35KB

DATA Size: 1024B - Virtual size: 584B

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 2KB

.rsrc Size: 10KB - Virtual size: 10KB

.text
Size: 48KB - Virtual size: 48KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 212KB

.rsrc
Size: 52KB - Virtual size: 52KB

3a:ab:7d:ea:a6:85:08:57:f4:89:fa:5d:7d:65:dd:17
Certificate

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

CODE
Size: 36KB - Virtual size: 35KB

DATA
Size: 1024B - Virtual size: 584B

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 10KB - Virtual size: 10KB