95b72c62d1a926f94f30bce3edcd3134

Sharing

Copy URL Twitter E-mail

General

Target

95b72c62d1a926f94f30bce3edcd3134
Size

1.2MB
MD5

95b72c62d1a926f94f30bce3edcd3134
SHA1

19f7599ac20619dd1f0488f107046bd4ab5ad3fc
SHA256

1319791402eeb2b2a4090f16c5134cda75f2b651490c146e6bd8fd204502f046
SHA512

5a6223702f391e5124a1c6fc8b7498a1ee699a03a026a2100158d59c32699581800ccc5d5163b14f2075d154b871a96e3065a90dcee23a4bb6dec68715625fd3
SSDEEP

24576:ANndFr5xfq2Sh8qJ2KANUpLUmN36fdWeANd/RgoCkycHPM781x:ud95H+gE36f9AH/WoCkFHP3

Score

1^/10

Malware Config

Signatures

Files

95b72c62d1a926f94f30bce3edcd3134
.exe windows:4 windows x86 arch:x86

df5fa80cd4f0b55fe6762f965755eb84

Code Sign

0b:d0:b9:8e:9b:73:5a:33:b3:cf:02:71:ca:6f:1f:79
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

17/09/2014, 00:00

Not After

25/11/2015, 12:00

Subject

CN=Consortium ltd.,O=Consortium ltd.,L=Roseau,ST=Commonwealth of Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e4:ca:ce:c8:e4:9a:20:4d:41:1b:a6:f1:39:c6:5e:6f:d4:4f:24:ec
Signer

Actual PE Digest

e4:ca:ce:c8:e4:9a:20:4d:41:1b:a6:f1:39:c6:5e:6f:d4:4f:24:ec

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_DragShowNolock
ImageList_EndDrag
ImageList_BeginDrag
ImageList_GetDragImage
ImageList_DrawEx
ImageList_Create
ImageList_Read
ImageList_Write
ImageList_GetIconSize
ImageList_SetIconSize
ImageList_Remove
ord17

version

VerQueryValueW

setupapi

SetupDiDestroyDeviceInfoList

wininet

InternetCloseHandle
HttpEndRequestA
InternetOpenA

kernel32

GetModuleHandleW
GetCommandLineW
ReadFile
GetCurrentProcess
CopyFileW
lstrcmpiW
GetTempPathW
GetWindowsDirectoryW
lstrcatW
SetCurrentDirectoryW
DeleteFileW
CreateDirectoryW
GetTempPathA
GetSystemInfo
FreeResource
InterlockedIncrement
GetCPInfo
SetFilePointer
FlushFileBuffers
SetStdHandle
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
HeapAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
HeapFree
CreateFileA
VirtualAlloc
ExitProcess
WriteFile
SetErrorMode
GetVersion
GetProcAddress
GetStringTypeW
CreateFileMappingA
CloseHandle
GetStartupInfoA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetVersionExA
GetCommandLineA
GetCurrentProcessId
GetLastError
GetTickCount
GetACP
GetOEMCP
LoadLibraryA
SetEndOfFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeExA

user32

GetWindowRect
GetWindowPlacement
GetWindowLongA
GetSystemMenu
MessageBoxA
GetSystemMetrics
ShowWindow
RegisterClassExA
GetClassNameA
GetCapture
GetClassInfoA
GetWindowTextA
GetWindowThreadProcessId
IntersectRect
InvalidateRect
IsChild
IsDialogMessageA
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
CharNextW

gdi32

CreatePen
ExcludeClipRect
SetEnhMetaFileBits
SetPixel
SetROP2
StretchBlt
UnrealizeObject
Rectangle
DeleteMetaFile
GetLogColorSpaceW
SetAbortProc
CreatePenIndirect
GetClipBox
DeleteEnhMetaFile
CreateFontIndirectA
TextOutW
DeleteObject
OffsetWindowOrgEx

comdlg32

ReplaceTextW
FindTextW
GetSaveFileNameA
GetOpenFileNameA
ChooseFontA
PageSetupDlgW

advapi32

RegCloseKey
RegQueryValueExW
RegCreateKeyExA

shell32

ShellExecuteA
StrStrIA
SHGetFileInfoW

ole32

OleInitialize
CoTaskMemAlloc

oleaut32

VarDecRound
VariantInit
VarRound
VarNumFromParseNum
VariantChangeType
SafeArrayCreate
SafeArrayRedim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayPutElement

Sections

.text
Size: 948KB - Virtual size: 947KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

code
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df5fa80cd4f0b55fe6762f965755eb84

Code Sign

0b:d0:b9:8e:9b:73:5a:33:b3:cf:02:71:ca:6f:1f:79Certificate

Extended Key Usages

Key Usages

e4:ca:ce:c8:e4:9a:20:4d:41:1b:a6:f1:39:c6:5e:6f:d4:4f:24:ecSigner

Headers

File Characteristics

Imports

comctl32

version

setupapi

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 948KB - Virtual size: 947KB

code Size: 132KB - Virtual size: 131KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 12KB - Virtual size: 57KB

.rsrc Size: 148KB - Virtual size: 145KB

.reloc Size: 8KB - Virtual size: 6KB

0b:d0:b9:8e:9b:73:5a:33:b3:cf:02:71:ca:6f:1f:79
Certificate

e4:ca:ce:c8:e4:9a:20:4d:41:1b:a6:f1:39:c6:5e:6f:d4:4f:24:ec
Signer

.text
Size: 948KB - Virtual size: 947KB

code
Size: 132KB - Virtual size: 131KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 12KB - Virtual size: 57KB

.rsrc
Size: 148KB - Virtual size: 145KB

.reloc
Size: 8KB - Virtual size: 6KB