d82e0a3786dba17f88929d11d6b00b96[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

d82e0a3786dba17f88929d11d6b00b96.bin
Size

463KB
MD5

d82e0a3786dba17f88929d11d6b00b96
SHA1

098f9b676677dc3a30530ad5254b7fb41e1391d9
SHA256

ba8d7b5662f85aa901fd6bcf86fc5989013577b18c81a91bffc1211fec31d6c8
SHA512

4df64c5f421103fabf156342d41ff2cece82ce6b7015c454ac78680611d4ab64788c7ed50b0505edcd4cc704fdbe3c118370464c476f8047bd0e022ddbc3424d
SSDEEP

12288:jDrJL3QCiSt7hMYDbInjPp7ormE3Lu4iPnOEAPiWTydl6:jDrpQCpXZbCj5Y3C4MXlbK

Score

1^/10

Malware Config

Signatures

Files

d82e0a3786dba17f88929d11d6b00b96.bin
.exe windows:5 windows x86 arch:x86

f0e8305f3a2a23ba622fa7f18bf7cd51

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

30-12-2025 23:59

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:18:e4:04:4b:5a:b7:74:fc:aa:9d:61:bd:8e:83:b4
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-06-2018 13:44

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

22-10-2008 12:07

Not After

10-06-2027 10:46

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:18:e4:04:4b:5a:b7:74:fc:aa:9d:61:bd:8e:83:b4
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-06-2018 13:44

Not After

23-01-2020 20:43

Subject

CN=CrystalBit Solutions,O=CrystalBit Solutions,C=BE,1.2.840.113549.1.9.1=#0c17737570706f7274406372797374616c696465612e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a0:1c:49:44:89:8f:4d:60:53:6f:f6:4a:57:14:61:b5:ef:1c:99:8e:5c:96:b5:a0:31:5a:14:48:b8:dd:47:2e
Signer

Actual PE Digest

a0:1c:49:44:89:8f:4d:60:53:6f:f6:4a:57:14:61:b5:ef:1c:99:8e:5c:96:b5:a0:31:5a:14:48:b8:dd:47:2e

Digest Algorithm

sha256

PE Digest Matches

true

53:e1:e4:9c:8e:0b:7b:42:37:6b:63:c6:f9:5e:9c:85:58:65:37:35
Signer

Actual PE Digest

53:e1:e4:9c:8e:0b:7b:42:37:6b:63:c6:f9:5e:9c:85:58:65:37:35

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenEventW
CreateFileMappingW
OpenMutexW
CreateFileW
WriteConsoleW
UnmapViewOfFile
MapViewOfFile
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
CloseHandle
WaitForSingleObject
SetEvent
HeapSize
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LCMapStringW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetFileType
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
FlushFileBuffers

user32

MessageBoxA

advapi32

RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

z0tyg8go
Size: 58KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

oc7esfle
Size: 287KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0.jibmbs
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0e8305f3a2a23ba622fa7f18bf7cd51

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1bCertificate

Key Usages

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

44:18:e4:04:4b:5a:b7:74:fc:aa:9d:61:bd:8e:83:b4Certificate

Extended Key Usages

Key Usages

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28Certificate

Key Usages

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

44:18:e4:04:4b:5a:b7:74:fc:aa:9d:61:bd:8e:83:b4Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

a0:1c:49:44:89:8f:4d:60:53:6f:f6:4a:57:14:61:b5:ef:1c:99:8e:5c:96:b5:a0:31:5a:14:48:b8:dd:47:2eSigner

53:e1:e4:9c:8e:0b:7b:42:37:6b:63:c6:f9:5e:9c:85:58:65:37:35Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 96KB - Virtual size: 96KB

z0tyg8go Size: 58KB - Virtual size: 60KB

.data Size: 3KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 4KB

oc7esfle Size: 287KB - Virtual size: 288KB

0.jibmbs Size: 512B - Virtual size: 4KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

23:e8:29:0d:71:95:04:18:c0:08:59:7e:42:f7:48:1b
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

44:18:e4:04:4b:5a:b7:74:fc:aa:9d:61:bd:8e:83:b4
Certificate

93:92:85:40:01:65:71:5f:94:7f:28:8f:ef:c9:9b:28
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

44:18:e4:04:4b:5a:b7:74:fc:aa:9d:61:bd:8e:83:b4
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

a0:1c:49:44:89:8f:4d:60:53:6f:f6:4a:57:14:61:b5:ef:1c:99:8e:5c:96:b5:a0:31:5a:14:48:b8:dd:47:2e
Signer

53:e1:e4:9c:8e:0b:7b:42:37:6b:63:c6:f9:5e:9c:85:58:65:37:35
Signer

.text
Size: 96KB - Virtual size: 96KB

z0tyg8go
Size: 58KB - Virtual size: 60KB

.data
Size: 3KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 4KB

oc7esfle
Size: 287KB - Virtual size: 288KB

0.jibmbs
Size: 512B - Virtual size: 4KB