0ac9e77cbe608c50e2b956b1c5d0ce89

Sharing

Copy URL Twitter E-mail

General

Target

0ac9e77cbe608c50e2b956b1c5d0ce89
Size

101KB
MD5

0ac9e77cbe608c50e2b956b1c5d0ce89
SHA1

2a8eb3c85c4b5e4e682f9a4ebdf2678ce497b39e
SHA256

ed2012acf4f7ead4b0ddb6e736d0b74ce77b426d6d173be472bfb1452859166b
SHA512

a8c2aaf0cd5992aa15aa29a2c7a28f377886fa700fab178707713b2dfc0d4c4566366f39980f32717e2743244b280901f32bef60b5e794620f38a3eb3197d87c
SSDEEP

1536:NHkwmvip17xdaSbNNDSXHSjS5+uC04M3+j5Byx2PTiw:Njh1HnDSXaZuCH1zyx2PTiw

Score

1^/10

Malware Config

Signatures

Files

0ac9e77cbe608c50e2b956b1c5d0ce89
.exe windows:5 windows x86 arch:x86

224032459593c89ae8710f6241d2dc0a

Code Sign

18:1d:cf:81:1e:4a:56:56:b2:5c:77:eb:9a:d0:96:be
Certificate

Issuer

CN=534634 inc

Not Before

02/02/2012, 05:24

Not After

31/12/2039, 23:59

Subject

CN=534634 inc

Extended Key Usages

ExtKeyUsageCodeSigning

57:e7:ad:89:67:13:b7:b3:47:a6:3b:30:3b:68:8f:b7:e1:da:ed:c5
Signer

Actual PE Digest

57:e7:ad:89:67:13:b7:b3:47:a6:3b:30:3b:68:8f:b7:e1:da:ed:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
lstrcatW
GetWindowsDirectoryW
GetProcAddress
GetSystemInfo
AssignProcessToJobObject
BackupRead
BackupWrite
CallNamedPipeW
CloseHandle
CompareStringW
CreateDirectoryExA
CreateEventW
CreateHardLinkW
CreateSemaphoreW
DebugActiveProcess
DefineDosDeviceW
DeleteVolumeMountPointW
EnumSystemLocalesA
FileTimeToLocalFileTime
FindFirstChangeNotificationW
FindFirstFileExA
FindFirstVolumeMountPointW
FindNextVolumeMountPointW
FoldStringA
FreeResource
GetACP
GetCalendarInfoW
GetCommProperties
GetCommandLineW
GetCompressedFileSizeW
GetComputerNameW
GetConsoleAliasExesW
GetConsoleAliasW
GetCurrentProcess
GetDiskFreeSpaceExA
GetDiskFreeSpaceW
GetDriveTypeW
GetEnvironmentVariableA
GetFileAttributesA
GetFileInformationByHandle
GetLocalTime
GetLogicalDrives
GetModuleHandleA
GetNamedPipeInfo
GetPrivateProfileSectionA
GetProfileSectionW
GetShortPathNameA
GetStringTypeExA
GetSystemWindowsDirectoryA
GetProcessHeap
GetTempPathW
GetThreadSelectorEntry
GetUserDefaultLangID
GetUserDefaultUILanguage
GetVolumeInformationW
GetVolumePathNameA
GlobalAlloc
GlobalFree
GlobalHandle
GlobalUnWire
GlobalUnfix
HeapAlloc
HeapWalk
InitializeCriticalSection
InterlockedExchange
InterlockedIncrement
IsValidLocale
LockFile
Module32Next
MoveFileWithProgressW
OpenJobObjectA
PurgeComm
ReadConsoleOutputA
ReadConsoleOutputCharacterA
ReadFileScatter
ResetEvent
SetCommMask
SetEvent
SetFileAttributesA
SetFilePointerEx
SetInformationJobObject
SetLocaleInfoA
SetPriorityClass
SetThreadIdealProcessor
SetThreadLocale
SetTimeZoneInformation
SetUnhandledExceptionFilter
SetupComm
SystemTimeToFileTime
UnlockFile
WaitForMultipleObjectsEx
WideCharToMultiByte
WriteFileEx
WriteProcessMemory
_lwrite
lstrcmpi
lstrcpyW
lstrcpyn
lstrcpynA
GetTempFileNameA
LoadLibraryA

msvcrt

memset

user32

AllowSetForegroundWindow
CharLowerA
CharNextA
CharUpperA
ClientToScreen
DdeCreateStringHandleA
DeferWindowPos
DeregisterShellHookWindow
DestroyAcceleratorTable
DialogBoxParamW
EnableScrollBar
EndPaint
EnumClipboardFormats
EnumWindowStationsA
GetActiveWindow
GetAltTabInfo
GetCapture
GetClassLongW
GetClassWord
GetClientRect
GetKeyState
GetKeyboardLayoutList
GetMenuCheckMarkDimensions
GetMenuDefaultItem
GetMenuItemID
GetMenuItemRect
GetMonitorInfoW
GetUserObjectInformationA
GetWindowInfo
GetWindowTextLengthA
GetWindowThreadProcessId
GrayStringW
InsertMenuItemW
IsWindowEnabled
LoadCursorA
LoadIconA
LoadKeyboardLayoutW
MoveWindow
NotifyWinEvent
OffsetRect
OpenClipboard
OpenIcon
RealChildWindowFromPoint
RealGetWindowClassA
RealGetWindowClassW
RemovePropA
ScrollDC
SendIMEMessageExW
SendMessageCallbackA
SendMessageW
SetMenuContextHelpId
SetParent
SetProcessWindowStation
SetThreadDesktop
SetUserObjectInformationW
SetWindowPlacement
SetWindowRgn
ShowWindow
SwitchDesktop
ToUnicode
TrackPopupMenu
TranslateMessage
UnhookWinEvent
UnregisterDeviceNotification
VkKeyScanW
wsprintfA

advapi32

RegOpenKeyExW

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

224032459593c89ae8710f6241d2dc0a

Code Sign

18:1d:cf:81:1e:4a:56:56:b2:5c:77:eb:9a:d0:96:beCertificate

Extended Key Usages

57:e7:ad:89:67:13:b7:b3:47:a6:3b:30:3b:68:8f:b7:e1:da:ed:c5Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

user32

advapi32

Sections

.text Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 516B

.text Size: 68KB - Virtual size: 67KB

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 1KB - Virtual size: 1KB

18:1d:cf:81:1e:4a:56:56:b2:5c:77:eb:9a:d0:96:be
Certificate

57:e7:ad:89:67:13:b7:b3:47:a6:3b:30:3b:68:8f:b7:e1:da:ed:c5
Signer

.text
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 516B

.text
Size: 68KB - Virtual size: 67KB

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 1KB - Virtual size: 1KB