Skinchanger[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Skinchanger.exe
Size

6.6MB
MD5

42685b6d86c7896eb81a5d74dc0d1888
SHA1

a22e40e1f79599ee00832fddb13683e0acc46ef9
SHA256

0dbc85c12b73342cce460c2a2a6c4b5481cdbdf97d5f43c02eb4093bac91fdd4
SHA512

2432c4566ba02415165456f76577be74821e8087c33e65c971c552eea9aecd29a45fd3514364548576c9490f94c207907b9ed6ad418472b6b4d69f4f3b377c91
SSDEEP

196608:/JcMbawUg9PUX0rw/R8fUHsnc6TiJT+u:/+Mb2gTk/G4sjmJT+u

Score

1^/10

Malware Config

Signatures

Files

Skinchanger.exe
.exe windows:6 windows x64 arch:x64

6f914af498cad59c5bedda29d54d12f9

Code Sign

b7:37:e5:ec:65:f3:ca:c3:40:41:ca:e6:65:b6:87:53
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-12-2020 00:00

Not After

23-12-2021 23:59

Subject

CN=IP LANKO IRINA VASILYEVNA,O=IP LANKO IRINA VASILYEVNA,STREET=34\, ter. Cibino-1\, d. Cibino,L=Voskresenskij,ST=Moskovskaja oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6b:88:a5:19:4b:8d:3a:fa:56:08:6d:6b:e1:99:80:53:49:9a:7f:b7
Signer

Actual PE Digest

6b:88:a5:19:4b:8d:3a:fa:56:08:6d:6b:e1:99:80:53:49:9a:7f:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleFileNameA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

PostQuitMessage
CharUpperBuffW

shell32

ShellExecuteA

ole32

CoInitialize

oleaut32

VariantClear

d3dx9_43

D3DXCreateTextureFromFileInMemory

d3d9

Direct3DCreate9

ws2_32

WSAGetLastError

shlwapi

SHDeleteKeyW

xinput1_3

ord4

imm32

ImmSetCompositionWindow

winhttp

WinHttpQueryDataAvailable

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW

Sections

.text
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 604KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.7CK0
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.7CK1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.7CK2
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f914af498cad59c5bedda29d54d12f9

Code Sign

b7:37:e5:ec:65:f3:ca:c3:40:41:ca:e6:65:b6:87:53Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

6b:88:a5:19:4b:8d:3a:fa:56:08:6d:6b:e1:99:80:53:49:9a:7f:b7Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

d3dx9_43

d3d9

ws2_32

shlwapi

xinput1_3

imm32

winhttp

advapi32

Sections

.text Size: - Virtual size: 1.5MB

.rdata Size: - Virtual size: 604KB

.data Size: - Virtual size: 90KB

.pdata Size: - Virtual size: 68KB

_RDATA Size: - Virtual size: 8KB

.7CK0 Size: - Virtual size: 3.4MB

.7CK1 Size: 4KB - Virtual size: 4KB

.7CK2 Size: 6.6MB - Virtual size: 6.6MB

.reloc Size: 512B - Virtual size: 220B

.rsrc Size: 18KB - Virtual size: 17KB

b7:37:e5:ec:65:f3:ca:c3:40:41:ca:e6:65:b6:87:53
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

6b:88:a5:19:4b:8d:3a:fa:56:08:6d:6b:e1:99:80:53:49:9a:7f:b7
Signer

.text
Size: - Virtual size: 1.5MB

.rdata
Size: - Virtual size: 604KB

.data
Size: - Virtual size: 90KB

.pdata
Size: - Virtual size: 68KB

_RDATA
Size: - Virtual size: 8KB

.7CK0
Size: - Virtual size: 3.4MB

.7CK1
Size: 4KB - Virtual size: 4KB

.7CK2
Size: 6.6MB - Virtual size: 6.6MB

.reloc
Size: 512B - Virtual size: 220B

.rsrc
Size: 18KB - Virtual size: 17KB