1e2b14c8748d00dbc42db4370390fd59

Sharing

Copy URL

Twitter E-mail

General

Target

1e2b14c8748d00dbc42db4370390fd59
Size

637KB
MD5

1e2b14c8748d00dbc42db4370390fd59
SHA1

8207a81f0c11ab182adc997acfc4874f284e6348
SHA256

06f2f4f1263b0067221dbee97ffcf4f5b8d7dcd558f307b357c72818f7c7724d
SHA512

ea551a0420e922a7564db20946011c9bfe9b64e415faca8ca444d6f5d78459d5aaeeb58eb908bdbff70b1371e9df7b166574f7bed2d4af98236bf9ee20d71db6
SSDEEP

12288:aHZKLiNomy1J8m9QnitNx5CIn0g9Or88Q1iTSiI+bbU46F:aCiNA1J8m2ivZ0EOY8Q1iTSiI+bbUj

Score

1^/10

Malware Config

Signatures

Files

1e2b14c8748d00dbc42db4370390fd59
.exe windows:4 windows x86 arch:x86

e1328078b6eb227518dcf5bbd7614952

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:60:b6:ea:64:0e:70:aa:e0:49:d9:8a:3d:8d:27:8c
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

06-03-2015 00:00

Not After

05-03-2016 23:59

Subject

CN=100 PROGRAMM,O=100 PROGRAMM,POSTALCODE=398001,STREET=SOVETSKAYA\, 66,L=LIPECK,ST=LIPECK REGION,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cb:3a:24:06:6d:49:30:a7:76:09:d3:eb:06:5d:9c:3e:13:94:f7:97
Signer

Actual PE Digest

cb:3a:24:06:6d:49:30:a7:76:09:d3:eb:06:5d:9c:3e:13:94:f7:97

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
GetLastError
FindClose
Sleep
GetModuleHandleA
VirtualLock
VirtualProtect
GetLocaleInfoA
HeapSize
LCMapStringW
LCMapStringA
GetStringTypeW
ExitProcess
GetStartupInfoA
GetCommandLineA
GetVersionExA
GetProcAddress
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapFree
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
HeapReAlloc
RaiseException
GetStringTypeA
MultiByteToWideChar
GetSystemInfo

user32

GetWindowTextA

oleaut32

SysAllocString

secur32

SetContextAttributesA

Sections

.data
Size: 472KB - Virtual size: 472KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ISYX
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aXex73
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aXex71
Size: 4KB - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.IS2YX
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1328078b6eb227518dcf5bbd7614952

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

07:60:b6:ea:64:0e:70:aa:e0:49:d9:8a:3d:8d:27:8cCertificate

Extended Key Usages

Key Usages

cb:3a:24:06:6d:49:30:a7:76:09:d3:eb:06:5d:9c:3e:13:94:f7:97Signer

Headers

File Characteristics

Imports

kernel32

user32

oleaut32

secur32

Sections

.data Size: 472KB - Virtual size: 472KB

.ISYX Size: 36KB - Virtual size: 32KB

.aXex73 Size: 12KB - Virtual size: 11KB

.aXex71 Size: 4KB - Virtual size: 520B

.IS2YX Size: 80KB - Virtual size: 79KB

.rsrc Size: 24KB - Virtual size: 22KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

07:60:b6:ea:64:0e:70:aa:e0:49:d9:8a:3d:8d:27:8c
Certificate

cb:3a:24:06:6d:49:30:a7:76:09:d3:eb:06:5d:9c:3e:13:94:f7:97
Signer

.data
Size: 472KB - Virtual size: 472KB

.ISYX
Size: 36KB - Virtual size: 32KB

.aXex73
Size: 12KB - Virtual size: 11KB

.aXex71
Size: 4KB - Virtual size: 520B

.IS2YX
Size: 80KB - Virtual size: 79KB

.rsrc
Size: 24KB - Virtual size: 22KB