e44f6754867fd71dcbefd70b26fd5388[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

e44f6754867fd71dcbefd70b26fd5388.bin
Size

1.5MB
MD5

f85093fc7a1f81c2e0995aabb11879ed
SHA1

33b48758a32402dd4cf922c6d856c2bd8e50ec24
SHA256

ef0eb6c0e94cb7cde77b8de57f95dce08abddf33a2d5288c7c7820fe21f42527
SHA512

b9c24e582dbed67cfe360c69ea9b9e836449a14cab4ce8e21568714b33c4ccf73313936f955bde82a6e33d1645750d3fb518a9504b4005bf5e730f6b6d84141c
SSDEEP

49152:H9qb8fgQU9i3elk/T1RbFE5atECfsBSQvhdv:gAgz8ecrbFjtEWsBSan

Score

1^/10

Malware Config

Signatures

Files

e44f6754867fd71dcbefd70b26fd5388.bin
.zip

Password: infected
b758b935fc420e334d8afdff6dee8253bcdf4b107183b2ad1f32f9f9dd47e0f1.exe
.exe windows:6 windows x86 arch:x86

Password: infected

e15799106ee5d8d4266cacc80c1e9df9

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:07:ae:18:c2:81:62:55:65:f3:bb:e6
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31/01/2024, 16:00

Not After

31/01/2025, 16:00

Subject

SERIALNUMBER=1237700757315,CN=Stimul LLC,O=Stimul LLC,STREET=per Rastorguyevskiy\, 4A pomeshch 1/1,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2c:a7:e5:53:1c:77:57:dc:a7:09:23:2a:16:9c:94:eb:65:60:a7:42:19:d3:5f:0c:bd:9d:59:62:27:1f:4c:11
Signer

Actual PE Digest

2c:a7:e5:53:1c:77:57:dc:a7:09:23:2a:16:9c:94:eb:65:60:a7:42:19:d3:5f:0c:bd:9d:59:62:27:1f:4c:11

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\cpp\Notepad3\Bin\Debug_x86_v143\grepWinNP3.pdb

Imports

shlwapi

StrCmpLogicalW
SHGetValueW
AssocQueryStringW
PathCompactPathExW
StrFormatByteSizeW
SHDeleteKeyW
PathRemoveFileSpecW
PathAppendW
PathIsURLW
PathIsRootW
PathIsRelativeW
PathCanonicalizeW
PathIsDirectoryW
PathFileExistsW
SHSetValueW
PathRelativePathToW
SHAutoComplete

uxtheme

BufferedPaintSetAlpha
EndBufferedPaint
BeginBufferedPaint
SetWindowTheme
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeBackgroundContentRect
GetThemeColor
GetThemeInt

kernel32

lstrlenW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
GetCurrentThreadId
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
GetFullPathNameW
GetLongPathNameW
GetShortPathNameW
GetTempFileNameW
GetTempPathW
CloseHandle
Sleep
GetModuleFileNameW
SetCurrentDirectoryW
GetTickCount64
FormatMessageW
GetWindowsDirectoryW
GetCurrentProcess
DeleteFileW
GetFileSizeEx
GetFileTime
ReadFile
SetFileTime
WriteFile
GlobalMemoryStatusEx
WideCharToMultiByte
FindResourceExW
FlushFileBuffers
GetFileSize
SetEndOfFile
SetFilePointer
GetCommandLineW
SetErrorMode
CreateMutexW
GetSystemDirectoryW
SetDllDirectoryW
SystemTimeToFileTime
LoadLibraryA
GetStringTypeExW
LCMapStringW
GetUserDefaultLCID
ExpandEnvironmentStringsW
CompareFileTime
CreateFileA
GetFileAttributesW
GetFileInformationByHandle
SetFileAttributesW
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
CreateThread
CreateProcessW
GetSystemTime
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CopyFileW
MoveFileExA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringA
GetStringTypeExA
lstrcpyW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
CompareStringW
GetProcessHeap
HeapQueryInformation
HeapSize
HeapReAlloc
HeapFree
SetConsoleCtrlHandler
GetCurrentThread
FreeLibraryAndExitThread
ResumeThread
ExitThread
ExitProcess
SetEnvironmentVariableW
GlobalAddAtomW
HeapAlloc
WriteConsoleW
GetFileType
GetStdHandle
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
CreateFileMappingA
GetModuleHandleA
MapViewOfFileEx
GetSystemInfo
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
CompareStringEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitOnceExecuteOnce
SetFileInformationByHandle
LCMapStringEx
DecodePointer
EncodePointer
GetLocaleInfoEx
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
RtlCaptureStackBackTrace
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
RaiseException
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStringTypeW
FormatMessageA
GlobalLock
GlobalUnlock
GlobalAlloc
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
lstrcpynW
MulDiv
GetModuleHandleW
VerifyVersionInfoW
LoadLibraryW
GetProcAddress
FreeLibrary
SetLastError
GetLastError
VerSetConditionMask
LocalFree
LocalAlloc
GlobalFree
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
DeleteAtom
HeapValidate

user32

GetSysColor
LoadIconA
RedrawWindow
GetDCEx
AppendMenuW
InsertMenuW
CheckMenuItem
DestroyMenu
CreatePopupMenu
GetKeyState
SendDlgItemMessageW
DrawFocusRect
SendMessageW
GetFocus
GetCapture
GetSystemMetrics
DrawTextW
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRgn
GetWindowTextW
GetWindowTextLengthW
GetClientRect
CheckDlgButton
CreateWindowExA
PostMessageW
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
FrameRect
InflateRect
IntersectRect
PtInRect
GetWindowLongW
GetParent
GetClassNameW
SystemParametersInfoW
GetMessageW
TranslateMessage
DispatchMessageW
GetMessagePos
PostQuitMessage
CreateWindowExW
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
MoveWindow
SetWindowPos
GetWindowPlacement
BringWindowToTop
CreateDialogParamW
CreateDialogIndirectParamW
DialogBoxParamW
DialogBoxIndirectParamW
LoadStringA
KillTimer
SetTimer
IsDlgButtonChecked
EnumWindows
RegisterWindowMessageW
ClientToScreen
TrackPopupMenu
EndDialog
GetDlgItem
GetDlgItemTextW
DefDlgProcW
GetSubMenu
LoadMenuW
LoadStringW
DrawIconEx
GetSysColorBrush
SetDlgItemTextW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
GetMonitorInfoW
EnumThreadWindows
EnumChildWindows
SetWindowTextW
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemCount
GetSystemMenu
CloseWindow
LoadCursorW
CheckRadioButton
SetCursor
ReleaseCapture
SetCapture
RemovePropW
GetPropW
SetPropW
RegisterClipboardFormatW
InvalidateRect
SetWindowRgn
IsZoomed
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
FindWindowExW
CallWindowProcW
SetWindowPlacement
RegisterClassExW
DefWindowProcW
IsDialogMessageW
LoadImageW
GetDesktopWindow
SetWindowLongW
OffsetRect
CopyRect
SetCursorPos
MessageBoxW
GetWindowDC
SetForegroundWindow
TranslateAcceleratorW
LoadAcceleratorsW
EnableWindow
SetFocus

gdi32

SetBkMode
GetObjectW
CreateSolidBrush
EnumFontsW
SetTextColor
DeleteObject
SetRectRgn
CreateRectRgn
GetStockObject
PatBlt
SelectObject
SetPixel
SetBkColor
CreateRectRgnIndirect
ExtTextOutW
CreateFontIndirectW
GetDeviceCaps
CombineRgn

comdlg32

GetOpenFileNameW

advapi32

CryptAcquireContextW
CryptReleaseContext
RegOpenKeyW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam

shell32

SHBrowseForFolderW
SHGetKnownFolderPath
ShellExecuteExW
ShellExecuteW
SHGetFileInfoW
SHGetFolderPathW
CommandLineToArgvW
DragQueryFileW
SHGetDesktopFolder
ord701
SHCreateItemFromParsingName
SHGetMalloc
SHGetPathFromIDListW

ole32

CoTaskMemAlloc
DoDragDrop
OleDuplicateData
ReleaseStgMedium
CoUninitialize
CoInitialize
OleInitialize
CoInitializeEx
RegisterDragDrop
OleRun
CoCreateInstance
CoTaskMemFree
OleUninitialize

oleaut32

CreateErrorInfo
SysFreeString
GetErrorInfo
VariantInit
VariantClear
VariantChangeType
SetErrorInfo
SysAllocString

gdiplus

GdipCloneImage
GdipSetPenDashStyle
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArcI
GdipClosePathFigure
GdipStartPathFigure
GdipResetPath
GdipDeletePath
GdipCreatePath
GdipDisposeImage
GdiplusStartup
GdipFree
GdipAlloc
GdipDrawCachedBitmap
GdipDeleteCachedBitmap
GdipCreateCachedBitmap
GdipFillRectangleI
GdiplusShutdown
GdipDrawPath
GdipDrawRectangleI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP

comctl32

ImageList_GetImageInfo
ord410
ord412
ord381
ord413
InitCommonControlsEx
ImageList_GetImageCount

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CryptStringToBinaryA
CryptStringToBinaryW
CryptBinaryToStringA
CryptBinaryToStringW
CryptProtectData
CryptUnprotectData

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 445KB - Virtual size: 445KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 210KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

e15799106ee5d8d4266cacc80c1e9df9

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

27:07:ae:18:c2:81:62:55:65:f3:bb:e6Certificate

Extended Key Usages

Key Usages

2c:a7:e5:53:1c:77:57:dc:a7:09:23:2a:16:9c:94:eb:65:60:a7:42:19:d3:5f:0c:bd:9d:59:62:27:1f:4c:11Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

gdiplus

comctl32

version

crypt32

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.rdata Size: 445KB - Virtual size: 445KB

.data Size: 23KB - Virtual size: 35KB

.idata Size: 15KB - Virtual size: 15KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 270B

.rsrc Size: 210KB - Virtual size: 209KB

.reloc Size: 90KB - Virtual size: 89KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

27:07:ae:18:c2:81:62:55:65:f3:bb:e6
Certificate

2c:a7:e5:53:1c:77:57:dc:a7:09:23:2a:16:9c:94:eb:65:60:a7:42:19:d3:5f:0c:bd:9d:59:62:27:1f:4c:11
Signer

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 445KB - Virtual size: 445KB

.data
Size: 23KB - Virtual size: 35KB

.idata
Size: 15KB - Virtual size: 15KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 210KB - Virtual size: 209KB

.reloc
Size: 90KB - Virtual size: 89KB