42276a117df3452c9a016f64503de745

Sharing

Copy URL Twitter E-mail

General

Target

42276a117df3452c9a016f64503de745
Size

1.2MB
MD5

42276a117df3452c9a016f64503de745
SHA1

cfbe5a13ed9bd7908e0f3f23e3b9e7eff564ca95
SHA256

7655dc0a0ff85116db41b6e6d48e0168960828aa5a7214f6859d08d2cf47a8eb
SHA512

4846114db37ac311450ce32f8b2cda98402681f5184db6da513b93418c079ce017875c3359ae343b613afff37adefee0356ff5d8076986190b09fd481156e106
SSDEEP

24576:tYcez4bQ/ErdX5Z5Ohzm11zYIpHaEObw7SuwSFzi4+js7:Ccez4bsErdpZ5Ohzm112w7STsMY

Score

1^/10

Malware Config

Signatures

Files

42276a117df3452c9a016f64503de745
.exe windows:4 windows x86 arch:x86

ff35cdbf4590368fa547501976bb3d9e

Code Sign

ed:72:df:71:20:8f:78:36:d0:ab:00:9f:ca:97:e0:1f
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

22/12/2014, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO SHA-256 Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:95:9e:54:f1:d5:e5:b8:4f:7c:d1:9b:6d:2d:84:97
Certificate

Issuer

CN=COMODO SHA-256 Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

05/11/2015, 00:00

Not After

15/01/2017, 23:59

Subject

CN=Tweaking LLC,OU=Major Geeks,O=Tweaking LLC,POSTALCODE=13031,STREET=7 Braniff Dr,L=Camillus,ST=New York,C=US,2.5.4.18=#13053133303331

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:15:70:9e:20:94:18:d7:75:d8:97:df:b1:6c:e1:ab:9d:7c:8a:ad
Signer

Actual PE Digest

08:15:70:9e:20:94:18:d7:75:d8:97:df:b1:6c:e1:ab:9d:7c:8a:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

EVENT_SINK_GetIDsOfNames
__vbaVarTstGt
ord582
__vbaR8FixI4
__vbaVarSub
ord583
__vbaStrI2
ord584
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
ord693
__vbaVarVargNofree
__vbaFpCDblR4
__vbaCyMul
__vbaAryMove
__vbaFreeVar
__vbaLineInputStr
ord588
__vbaStrVarMove
__vbaLateIdCall
__vbaLenBstr
__vbaVarIdiv
__vbaFreeVarList
_adj_fdiv_m64
ord698
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord626
ord519
__vbaResume
ord628
__vbaCopyBytes
__vbaStrCat
__vbaForEachCollAd
__vbaLsetFixstr
__vbaStrDate
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenBstrB
ord662
__vbaLenVar
_adj_fdiv_m32
__vbaVarTstLe
__vbaAryVar
ord667
Zombie_GetTypeInfo
__vbaVarCmpGe
__vbaAryDestruct
ord669
__vbaLateMemSt
__vbaVarIndexLoadRefLock
ord592
ord593
__vbaForEachCollObj
__vbaExitProc
__vbaBoolStr
__vbaStrBool
ord300
__vbaI4Abs
ord594
__vbaCyAdd
__vbaOnError
__vbaObjSet
ord595
ord596
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaVarIndexLoad
ord599
__vbaFpR4
ord306
__vbaBoolVar
__vbaStrFixstr
ord521
__vbaFPFix
__vbaBoolVarNull
__vbaFpR8
_CIsin
__vbaErase
ord709
ord631
__vbaVargVarMove
__vbaVarZero
ord525
__vbaLateMemStAd
__vbaNextEachCollObj
__vbaChkstk
__vbaCyVar
__vbaFileClose
EVENT_SINK_AddRef
ord527
__vbaGenerateBoundsError
__vbaStrCmp
__vbaExitEachColl
__vbaCyI2
__vbaAryConstruct2
__vbaVarTstEq
__vbaCyI4
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarLateMemSt
__vbaFpUI1
__vbaCastObjVar
__vbaLbound
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
__vbaR4Cy
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaR8Cy
__vbaStrR8
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
__vbaVarAnd
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaFpCmpCy
__vbaUI1I4
__vbaExceptHandler
ord711
__vbaStrToUnicode
ord712
__vbaPrintFile
ord606
__vbaDateStr
_adj_fprem
_adj_fdivr_m64
ord607
__vbaVarDiv
__vbaI2Str
__vbaLateIdStAd
ord716
__vbaFPException
ord717
ord319
__vbaUbound
__vbaStrVarVal
__vbaVarCat
ord535
__vbaDateVar
__vbaCheckType
__vbaI2Var
__vbaLsetFixstrFree
__vbaLateMemNamedCallLd
ord537
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
__vbaVarLateMemCallLdRf
ord648
__vbaInStr
ord571
__vbaCyMulI2
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaI4Str
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
__vbaR8Var
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
__vbaFpCy
ord610
__vbaVarAdd
__vbaAryLock
__vbaLateMemCall
ord320
__vbaStrComp
__vbaVarDup
__vbaStrToAnsi
ord612
ord321
__vbaVerifyVarObj
ord614
__vbaFpI2
__vbaVarCopy
__vbaVarTstGe
ord616
__vbaVarLateMemCallLd
__vbaFpI4
__vbaLateMemCallLd
_CIatan
__vbaStrMove
ord618
__vbaCastObj
__vbaAryCopy
__vbaR8IntI4
__vbaI4Cy
__vbaStrVarCopy
ord619
ord650
_allmul
__vbaFpCSngR4
__vbaLenVarB
__vbaLateIdSt
__vbaLateMemCallSt
_CItan
ord546
__vbaNextEachCollAd
__vbaFPInt
__vbaUI1Var
__vbaAryUnlock
__vbaFpCSngR8
_CIexp
__vbaStrCy
__vbaR8FixI2
__vbaFreeStr
__vbaFreeObj
ord581

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff35cdbf4590368fa547501976bb3d9e

Code Sign

ed:72:df:71:20:8f:78:36:d0:ab:00:9f:ca:97:e0:1fCertificate

Extended Key Usages

Key Usages

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

76:95:9e:54:f1:d5:e5:b8:4f:7c:d1:9b:6d:2d:84:97Certificate

Extended Key Usages

Key Usages

08:15:70:9e:20:94:18:d7:75:d8:97:df:b1:6c:e1:ab:9d:7c:8a:adSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvbvm60

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.data Size: 4KB - Virtual size: 20KB

.idata Size: 8KB - Virtual size: 4KB

.rsrc Size: 80KB - Virtual size: 79KB

ed:72:df:71:20:8f:78:36:d0:ab:00:9f:ca:97:e0:1f
Certificate

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

76:95:9e:54:f1:d5:e5:b8:4f:7c:d1:9b:6d:2d:84:97
Certificate

08:15:70:9e:20:94:18:d7:75:d8:97:df:b1:6c:e1:ab:9d:7c:8a:ad
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 4KB - Virtual size: 20KB

.idata
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 80KB - Virtual size: 79KB