20ed4c8206a1f8562c7e8730b1cd3920

Sharing

Copy URL

Twitter E-mail

General

Target

20ed4c8206a1f8562c7e8730b1cd3920
Size

358KB
MD5

20ed4c8206a1f8562c7e8730b1cd3920
SHA1

e4c7ef67ca2d7bf8add6be83a56c82fb6672d4c8
SHA256

a503d7f0e5774009902bf8998a3d2acc7fa4605d9f82895edd03ba86584cbba3
SHA512

78ccef26d3e053dd2aa5e2462e1e23631bb5d8d75dd723c2229a23a2ba440bae1cb86ff3a45681af08774db85bb622861603d68f330251dbeee14c613ac64713
SSDEEP

6144:+0O4QHf8KXYN8WiOPIsehCy4y23mFhhAhh09:1QHf8KI6WiYIsejFhhAhhE

Score

1^/10

Malware Config

Signatures

Files

20ed4c8206a1f8562c7e8730b1cd3920
.exe windows:4 windows x86 arch:x86

e876b1864a69783455bddbb957a62d47

Code Sign

75:b3:62:d1:5a:6d:51:e2:5b:63:78:3f:30:ba:3d:e1
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:f4:aa:2c:85:7e:59:e5:73:f0:b8:3c:57:21:8d:8f
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05/09/2008, 00:00

Not After

30/05/2020, 10:48

Subject

CN=The Code Project Code Signing CA,O=The Code Project,C=CA

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b5:11:80:67:b7:1e:99:8b:ec:4d:ef:4e:19:56:af:82
Certificate

Issuer

CN=The Code Project Code Signing CA,O=The Code Project,C=CA

Not Before

19/10/2010, 00:00

Not After

18/10/2013, 23:59

Subject

CN=Biz Secure Labs Pvt. Ltd.,O=Biz Secure Labs Pvt. Ltd.,POSTALCODE=411030,STREET=1206\, Sadashiv Peth\, Tilak Road,L=Pune,ST=Maharashtra,C=IN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d9:e8:bf:0c:24:c8:72:89:a2:16:98:f8:7d:2b:93:a2:41:31:ff:8f
Signer

Actual PE Digest

d9:e8:bf:0c:24:c8:72:89:a2:16:98:f8:7d:2b:93:a2:41:31:ff:8f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsA

wininet

InternetSetOptionA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetAttemptConnect
InternetReadFile
HttpQueryInfoA
InternetSetFilePointer
HttpSendRequestA

kernel32

FileTimeToLocalFileTime
GetFileAttributesA
GetFileTime
FormatMessageA
RtlUnwind
ExitProcess
TerminateProcess
GetStartupInfoA
GetCommandLineA
HeapFree
CreateThread
ExitThread
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
GetACP
GetTimeZoneInformation
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FileTimeToSystemTime
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetProfileStringA
CreateMutexA
OpenMutexA
GetModuleFileNameA
CreateDirectoryA
CreateProcessA
SuspendThread
CloseHandle
ReleaseMutex
CopyFileA
DeleteFileA
SetFileAttributesA
WaitForSingleObject
SetThreadPriority
Sleep
lstrlenA
GetTickCount
GetLastError
ResumeThread
GetFileSize
CreateFileA
WinExec
WritePrivateProfileStringA
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
GlobalAlloc
GlobalLock
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
UnlockFile
SetEvent
CreateEventA
SetLastError
GetProcAddress
GetModuleHandleA
MulDiv
GlobalUnlock
LoadResource
FindResourceA
LockResource
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetCurrentProcess
DuplicateHandle
SetErrorMode
GetOEMCP
GetCPInfo
GetThreadLocale
SizeofResource
GetProcessVersion
GlobalFlags
lstrcpynA
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalFree
LocalAlloc
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
LoadLibraryA
FreeLibrary
GetVersion
lstrcatA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
lstrcpyA
GlobalFree

user32

InflateRect
CharNextA
CopyAcceleratorTableA
SetRect
GetNextDlgGroupItem
MessageBeep
InvalidateRect
CharUpperA
RegisterClipboardFormatA
PostThreadMessageA
GetSysColorBrush
GetClassNameA
GetDesktopWindow
DestroyMenu
LoadStringA
MoveWindow
SetWindowTextA
IsDialogMessageA
UpdateWindow
SendDlgItemMessageA
MapWindowPoints
GetSysColor
AdjustWindowRectEx
GetTopWindow
IsChild
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetMenuItemID
TrackPopupMenu
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
DefWindowProcA
CreateWindowExA
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetWindowLongA
RegisterWindowMessageA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
MapDialogRect
SetWindowPos
GetWindow
SetWindowContextHelpId
CopyRect
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
DrawFocusRect
DefDlgProcA
IsWindowUnicode
ShowWindow
EndDialog
SetActiveWindow
IsWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
SetForegroundWindow
SetFocus
FindWindowA
EnableWindow
LoadIconA
SendMessageA
AppendMenuA
GetSystemMenu
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
MessageBoxA
KillTimer
SetTimer
GetCursorPos
GetSubMenu
LoadMenuA
SetCursor
LoadCursorA
PtInRect
PostMessageA
PostQuitMessage
GetWindowLongA
IsWindowEnabled
GetLastActivePopup
GetParent
SetWindowsHookExA

gdi32

ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
IntersectClipRect
DeleteObject
SetViewportExtEx
GetDeviceCaps
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
PatBlt
GetObjectA
GetMapMode
DPtoLP
GetTextColor
GetBkColor
LPtoDP
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetBkMode
SetBkColor
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
CreateBitmap
GetTextExtentPointA
BitBlt
CreateCompatibleDC
CreateSolidBrush
CreateDIBitmap
CreateFontIndirectA

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyA
RegCloseKey

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderPathA
Shell_NotifyIconA

comctl32

ord17

oledlg

ord8

ole32

OleInitialize
CoTaskMemAlloc
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
CLSIDFromProgID
CoTaskMemFree
CoRevokeClassObject

olepro32

ord253

oleaut32

SysStringLen
SysFreeString
SysAllocStringLen
VariantClear
VariantTimeToSystemTime
VariantCopy
VariantChangeType
SysAllocString
SysAllocStringByteLen

Sections

.text
Size: 168KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e876b1864a69783455bddbb957a62d47

Code Sign

75:b3:62:d1:5a:6d:51:e2:5b:63:78:3f:30:ba:3d:e1Certificate

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

25:f4:aa:2c:85:7e:59:e5:73:f0:b8:3c:57:21:8d:8fCertificate

Key Usages

b5:11:80:67:b7:1e:99:8b:ec:4d:ef:4e:19:56:af:82Certificate

Extended Key Usages

Key Usages

d9:e8:bf:0c:24:c8:72:89:a2:16:98:f8:7d:2b:93:a2:41:31:ff:8fSigner

Headers

File Characteristics

Imports

shlwapi

wininet

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

Sections

.text Size: 168KB - Virtual size: 166KB

.rdata Size: 40KB - Virtual size: 38KB

.data Size: 16KB - Virtual size: 29KB

.rsrc Size: 124KB - Virtual size: 120KB

75:b3:62:d1:5a:6d:51:e2:5b:63:78:3f:30:ba:3d:e1
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

25:f4:aa:2c:85:7e:59:e5:73:f0:b8:3c:57:21:8d:8f
Certificate

b5:11:80:67:b7:1e:99:8b:ec:4d:ef:4e:19:56:af:82
Certificate

d9:e8:bf:0c:24:c8:72:89:a2:16:98:f8:7d:2b:93:a2:41:31:ff:8f
Signer

.text
Size: 168KB - Virtual size: 166KB

.rdata
Size: 40KB - Virtual size: 38KB

.data
Size: 16KB - Virtual size: 29KB

.rsrc
Size: 124KB - Virtual size: 120KB