b52ea419616297c0453629bc0ef36dfd

Sharing

Copy URL

Twitter E-mail

General

Target

b52ea419616297c0453629bc0ef36dfd
Size

718KB
MD5

b52ea419616297c0453629bc0ef36dfd
SHA1

b4d2ca20baa237c57c1bf83ada71a8a8c2d65cb0
SHA256

224a4f6cd3a9cb24875f6220f13f28a55bae164c5a54032584fe8900bc6637ee
SHA512

305b6d1886dbb62b02f289afb198bc783b79a56287012b6c30c879ed9bbd8ee0f810d4dbef8d0078a10f736541a7f5c2e3550ca77df20069311c01585b6d0def
SSDEEP

6144:KoBC/4V9CeJcskP9PRyMi5K9uRtcgEr3HhxaPiJ+FYuPIiREE7uXMeB3PPX2fvTf:FC/05c05KsfErXTa6cdEUyMImfvTPTt

Score

1^/10

Malware Config

Signatures

Files

b52ea419616297c0453629bc0ef36dfd
.exe windows:5 windows x86 arch:x86

d090daebaacdd92405fb824b4966e5f2

Code Sign

70:96:0d:d1:3b:d9:99:7e:55:80:8b:f8:05:36:53:3d
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28-07-2014 00:00

Not After

28-07-2015 23:59

Subject

CN=Monkey Code Lab,O=Monkey Code Lab,POSTALCODE=2025,STREET=Dasoupoli Strovolos+STREET=Athinodorou 3,L=Nicosia,ST=Cyprus,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09-07-1999 18:31

Not After

09-07-2019 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

eb:ed:a0:a7:b8:b7:a4:ef:0e:9e:59:68:e4:d6:88:4e:e9:9d:48:32
Signer

Actual PE Digest

eb:ed:a0:a7:b8:b7:a4:ef:0e:9e:59:68:e4:d6:88:4e:e9:9d:48:32

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

wininet

InternetCrackUrlA
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetOpenA
InternetConnectA
InternetReadFile
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle

ws2_32

WSAStartup
inet_ntoa
gethostbyname
WSACleanup

kernel32

GetMailslotInfo
GetModuleFileNameA
FindResourceW
FindResourceExW
GetDiskFreeSpaceA
CreateFileA
DeleteFileA
FindFirstFileA
FindNextFileA
MultiByteToWideChar
WideCharToMultiByte
GetFileSize
GetFileSizeEx
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetSystemTimeAsFileTime
ExpandEnvironmentStringsA
CreateDirectoryA
GetFileAttributesA
FreeLibrary
GetProcAddress
OpenProcess
GetCurrentProcess
TerminateProcess
LoadLibraryA
GetVersion
GetModuleHandleA
GetVersionExA
ReleaseMutex
CreateMutexA
OpenMutexA
LocalFree
SetLastError
GetCurrentProcessId
GetCurrentThreadId
GlobalAlloc
GlobalFlags
GlobalLock
GlobalUnlock
GlobalFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForMultipleObjects
lstrcpyA
lstrlenA
CreateEventA
RemoveDirectoryA
FindFirstChangeNotificationA
LocalAlloc
InterlockedIncrement
PeekNamedPipe
RaiseException
MulDiv
lstrcmpA
InitializeCriticalSection
GlobalHandle
lstrcmpiA
LoadLibraryExA
FindResourceA
IsDBCSLeadByte
GetTempPathA
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InterlockedCompareExchange
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
DecodePointer
EncodePointer
GetStringTypeW
RtlUnwind
GetSystemInfo
VirtualProtect
VirtualQuery
AreFileApisANSI
IsDebuggerPresent
ExitThread
LoadLibraryExW
GetCommandLineA
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetTimeZoneInformation
CloseHandle
FindClose
GetFileType
SizeofResource
LoadResource
Sleep
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
GetLastError
OpenThread
CreateThread
LockResource
InterlockedDecrement
GetACP
GetOEMCP
GetConsoleCP
GetConsoleMode
MoveFileExW
QueryPerformanceCounter
GetEnvironmentStringsW
GetStartupInfoW
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
IsValidCodePage
FreeEnvironmentStringsW
OutputDebugStringW
LoadLibraryW
SetFilePointerEx
SetStdHandle
WriteConsoleW
CreateFileW
ReadConsoleW
SetEnvironmentVariableA
FlushInstructionCache
HeapDestroy

user32

SetActiveWindow
SetMenuDefaultItem
SetMenuItemInfoA
GetMenuItemInfoA
EnableWindow
ShowWindow
CreateDialogIndirectParamA
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
RegisterClassA
UnregisterClassA
GetClassInfoA
UpdateLayeredWindow
ValidateRect
MapDialogRect
SetWindowContextHelpId
KillTimer
SetTimer
LoadIconA
EndDialog
GetMonitorInfoA
MonitorFromWindow
IsDialogMessageA
LoadCursorA
GetWindow
GetDesktopWindow
SetWindowLongA
GetWindowLongA
FillRect
GetSysColor
MapWindowPoints
ScreenToClient
ClientToScreen
GetClientRect
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
RedrawWindow
InvalidateRgn
EndPaint
BeginPaint
CreateAcceleratorTableA
ReleaseCapture
SetCapture
GetFocus
IsWindowVisible
SendDlgItemMessageA
SetFocus
CharNextA
GetDlgItem
MoveWindow
DestroyWindow
IsChild
CreateWindowExA
GetClassInfoExA
RegisterClassExA
CallWindowProcA
PostQuitMessage
DefWindowProcA
RegisterWindowMessageA
DestroyIcon
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
FindWindowExA
GetWindowRect
InvalidateRect
ReleaseDC
GetDC
SendMessageA
SystemParametersInfoA
GetWindowThreadProcessId
GetClassNameA
FindWindowA
GetParent
MessageBoxA
AllowSetForegroundWindow
SetForegroundWindow
GetForegroundWindow
keybd_event
GetKeyboardState
BringWindowToTop
SetWindowPos
IsWindow
AttachThreadInput
PostMessageA
SendMessageTimeoutA
DestroyAcceleratorTable

gdi32

GetTextExtentPoint32A
SelectObject
DeleteObject
BitBlt
CreateCompatibleBitmap
CreateFontA
CreateDIBSection
GetDeviceCaps
DeleteDC
CreateSolidBrush
GetObjectA
CreateCompatibleDC
GetStockObject

advapi32

GetTokenInformation
RegCloseKey
RegOpenKeyExA
GetSidSubAuthority
RegQueryValueExA
OpenProcessToken
GetSidSubAuthorityCount
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegEnumValueA
LookupPrivilegeValueA
AdjustTokenPrivileges

shell32

SHGetFolderPathA
SHFileOperationA
SHCreateDirectoryExA
ShellExecuteExA

ole32

CLSIDFromProgID
CreateStreamOnHGlobal
CoUninitialize
CoInitializeEx
CoGetClassObject
CLSIDFromString
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
OleInitialize
OleUninitialize
OleLockRunning
CoInitialize
CoTaskMemRealloc
CoCreateInstance

oleaut32

SysStringLen
VariantInit
VariantClear
VariantChangeType
LoadTypeLi
SysFreeString
OleCreateFontIndirect
DispCallFunc
VarUI4FromStr
VariantCopy
SysAllocStringLen
LoadRegTypeLi
SysAllocString

shlwapi

UrlEscapeA

comctl32

ImageList_Remove
ImageList_ReplaceIcon
ImageList_GetImageCount
InitCommonControlsEx

gdiplus

GdipDrawPath
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCloneBitmapAreaI
GdipCreateHICONFromBitmap
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipDeletePen
GdipCreatePen1
GdipGraphicsClear
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterColor
GdipCreatePathGradientFromPath
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipWindingModeOutline
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipFillPath
GdipDrawLineI
GdipSetSmoothingMode
GdipReleaseDC
GdipCreateFromHDC
GdipLoadImageFromStream
GdipSetPenMode
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipSetPathGradientFocusScales
GdipDrawImageRectI

Sections

.text
Size: 578KB - Virtual size: 578KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d090daebaacdd92405fb824b4966e5f2

Code Sign

70:96:0d:d1:3b:d9:99:7e:55:80:8b:f8:05:36:53:3dCertificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

eb:ed:a0:a7:b8:b7:a4:ef:0e:9e:59:68:e4:d6:88:4e:e9:9d:48:32Signer

Headers

DLL Characteristics

File Characteristics

Imports

version

wininet

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

Sections

.text Size: 578KB - Virtual size: 578KB

.rdata Size: 113KB - Virtual size: 113KB

.data Size: 13KB - Virtual size: 28KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 8KB - Virtual size: 7KB

70:96:0d:d1:3b:d9:99:7e:55:80:8b:f8:05:36:53:3d
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

eb:ed:a0:a7:b8:b7:a4:ef:0e:9e:59:68:e4:d6:88:4e:e9:9d:48:32
Signer

.text
Size: 578KB - Virtual size: 578KB

.rdata
Size: 113KB - Virtual size: 113KB

.data
Size: 13KB - Virtual size: 28KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 8KB - Virtual size: 7KB