4e0389a2ce3619202681bee416ae1996

Sharing

Copy URL

Twitter E-mail

General

Target

4e0389a2ce3619202681bee416ae1996
Size

260KB
MD5

4e0389a2ce3619202681bee416ae1996
SHA1

001b0e528fcb326520cc1b7adea3bbd807208a9e
SHA256

1ed81f78708ad1fb18e2bea51e9b6798514a1e3e27aa80e39da6ea13bd307762
SHA512

d2bd798b8dd41841a4cc7375fbfbbfa13cd9ed892269855551e348508b01a8a1fb4d05c70242b8be9c56d053ab0547b39072785abf1edae17038ecc73820880f
SSDEEP

6144:aBqXOzmT+faTVGKbAyPteldiwuM/sXMSy3Q:aBbm0KtVelquOy3Q

Score

1^/10

Malware Config

Signatures

Files

4e0389a2ce3619202681bee416ae1996
.dll regsvr32 windows:6 windows x86 arch:x86

12a54e3581f0bfc737652232ff16beaa

Code Sign

3c:fe:dd:d1:63:6b:53:82:8e:23:4a:ae:c4:bd:45:c4
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

05/01/2015, 00:00

Not After

05/01/2020, 23:59

Subject

CN=Hendrik Leppkes,O=Hendrik Leppkes,POSTALCODE=22419,STREET=Wulffsblöcken 35,L=Hamburg,ST=Hamburg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c6:48:cf:c6:33:a6:5d:28:21:8f:7e:8a:3e:af:93:80:d5:d9:80:1c:a5:34:3d:dd:eb:44:35:4b:f1:33:3c:91
Signer

Actual PE Digest

c6:48:cf:c6:33:a6:5d:28:21:8f:7e:8a:3e:af:93:80:d5:d9:80:1c:a5:34:3d:dd:eb:44:35:4b:f1:33:3c:91

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

CoUninitialize
CoCreateInstance
CoFreeUnusedLibraries
StringFromGUID2
CoInitialize
CoTaskMemFree
CoTaskMemAlloc

user32

KillTimer
SetTimer
SendMessageW
UnregisterClassW
InvalidateRect
SetWindowLongW
MoveWindow
ShowWindow
DestroyWindow
DefWindowProcW
CreateDialogParamW
GetWindowLongW
GetDlgItem
DispatchMessageW
GetDesktopWindow
LoadStringW
GetWindowRect
CreateWindowExW
SetWindowPos
GetMessageW
TranslateMessage
DestroyIcon
RegisterClassExW
LoadImageW
GetWindow
SetForegroundWindow
PostQuitMessage
EnumThreadWindows
GetCursorPos
TrackPopupMenu
PostMessageW
DestroyMenu
EnableWindow
SendDlgItemMessageW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

avformat-lav-58

avformat_new_stream
avio_alloc_context
avformat_alloc_output_context2
avformat_write_header
av_write_trailer
avformat_free_context
av_write_frame
ff_sipr_subpk_size
ff_vorbis_comment
ff_rm_reorder_sipr_data

avutil-lav-56

av_get_channel_layout_nb_channels
av_dict_free
av_get_bytes_per_sample
av_dict_get
av_frame_alloc
av_frame_unref
av_opt_set_double
av_frame_free
av_log_set_callback
av_mallocz
av_freep
av_free
av_opt_set_int

avcodec-lav-58

avpriv_dca_sample_rates
avpriv_dca_convert_bitstream
av_packet_unref
avcodec_decode_audio4
avpriv_mpegaudio_decode_header
av_packet_new_side_data
avcodec_is_open
ff_flac_is_extradata_valid
avcodec_open2
av_parser_init
avcodec_alloc_context3
avcodec_find_decoder_by_name
avcodec_find_decoder
av_parser_close
avcodec_close
av_parser_parse2
av_init_packet
avcodec_flush_buffers

avresample-lav-4

avresample_open
avresample_build_matrix
avresample_convert
avresample_alloc_context
avresample_free
avresample_close
avresample_set_matrix

kernel32

GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
LCMapStringW
GetFileType
GetStdHandle
HeapSize
GetStringTypeW
GetACP
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedFlushSList
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetStdHandle
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetModuleFileNameW
LoadLibraryExW
LoadLibraryW
FreeLibrary
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetLastError
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
GetModuleFileNameA
lstrlenW
lstrlenA
GetVersionExW
DisableThreadLibraryCalls
InitializeCriticalSection
lstrcmpW
GetCurrentProcess
WaitForSingleObject
GetCurrentThreadId
CreateEventW
SetEvent
CloseHandle
ResetEvent
CreateThread
GetModuleHandleW
SetLastError
WideCharToMultiByte
OutputDebugStringW
IsDebuggerPresent
FlushFileBuffers
WriteConsoleW
CreateFileW
SetUnhandledExceptionFilter

advapi32

RegOpenKeyExW
RegSetValueExW
RegCreateKeyW
RegSetValueW
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumKeyExW

oleaut32

OleCreatePropertyFrame

shell32

Shell_NotifyIconW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
OpenConfiguration

Sections

.text
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

12a54e3581f0bfc737652232ff16beaa

Code Sign

3c:fe:dd:d1:63:6b:53:82:8e:23:4a:ae:c4:bd:45:c4Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

c6:48:cf:c6:33:a6:5d:28:21:8f:7e:8a:3e:af:93:80:d5:d9:80:1c:a5:34:3d:dd:eb:44:35:4b:f1:33:3c:91Signer

Headers

DLL Characteristics

File Characteristics

Imports

ole32

user32

shlwapi

comctl32

version

avformat-lav-58

avutil-lav-56

avcodec-lav-58

avresample-lav-4

kernel32

advapi32

oleaut32

shell32

Exports

Exports

Sections

.text Size: 170KB - Virtual size: 169KB

.rdata Size: 54KB - Virtual size: 53KB

.data Size: 5KB - Virtual size: 8KB

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 11KB - Virtual size: 10KB

3c:fe:dd:d1:63:6b:53:82:8e:23:4a:ae:c4:bd:45:c4
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

c6:48:cf:c6:33:a6:5d:28:21:8f:7e:8a:3e:af:93:80:d5:d9:80:1c:a5:34:3d:dd:eb:44:35:4b:f1:33:3c:91
Signer

.text
Size: 170KB - Virtual size: 169KB

.rdata
Size: 54KB - Virtual size: 53KB

.data
Size: 5KB - Virtual size: 8KB

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 11KB - Virtual size: 10KB