ba4996999030388b412cb72a1e3080d2ee39675536797dacf988f4a87c1b7104

Sharing

Copy URL

Twitter E-mail

General

Target

ba4996999030388b412cb72a1e3080d2ee39675536797dacf988f4a87c1b7104
Size

2.3MB
MD5

1004c573279bcc44e41531ff81b881b4
SHA1

94c2b15dee3cbb566d604280a016e38a160e24ff
SHA256

ba4996999030388b412cb72a1e3080d2ee39675536797dacf988f4a87c1b7104
SHA512

58f5f81052fb735b20fe4d9ce6b505bbcd04eee526e74cec8110c7221be35c94e0e882e0f90d6a1190b81a3558d0c99174310fcd8642257ae19aa220d64b157f
SSDEEP

24576:XKlObFn0NgfokO2flpmcVo+b1cegA53mfwNLUgsYoEHYPg4h3/JxDxzxZhhxJWui:6gQxDxzxZhhxckgqbCMEf

Score

1^/10

Malware Config

Signatures

Files

ba4996999030388b412cb72a1e3080d2ee39675536797dacf988f4a87c1b7104
.dll windows:6 windows x86 arch:x86

6a66d5406732ee8bcda2d6a1c8573299

Code Sign

19:69:7b:80:91:61:d1:79:37:51:94:78:68:bb:c5:91
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

05/03/2018, 00:00

Not After

04/03/2021, 23:59

Subject

CN=Pingman Tools,O=Pingman Tools,POSTALCODE=83702,STREET=405 S. 8th Street #321,L=Boise,ST=ID,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6c:67:61:c9:df:73:54:46:4a:3f:d1:32:9e:aa:81:d5:dd:3e:d7:b4:c5:d4:2f:4f:bf:b9:41:f4:71:4b:db:cf
Signer

Actual PE Digest

6c:67:61:c9:df:73:54:46:4a:3f:d1:32:9e:aa:81:d5:dd:3e:d7:b4:c5:d4:2f:4f:bf:b9:41:f4:71:4b:db:cf

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapFree
DecodePointer
GetStdHandle
SetCurrentDirectoryW
SetFileAttributesW
GetTimeFormatW
QueryPerformanceCounter
GetLongPathNameW
TlsGetValue
DuplicateHandle
WaitForMultipleObjects
FindCloseChangeNotification
LoadResource
OutputDebugStringW
GetSystemInfo
GetTimeZoneInformation
RegisterWaitForSingleObject
lstrcpynW
DeleteFileW
UnmapViewOfFile
GetSystemTimeAsFileTime
TryEnterCriticalSection
CancelIo
LocalAlloc
WaitForSingleObjectEx
SetStdHandle
CopyFileW
SizeofResource
FindResourceW
FindFirstFileW
SetThreadPriority
GetStartupInfoW
FindClose
CloseHandle
GetNumaHighestNodeNumber
Sleep
LeaveCriticalSection
GetFileAttributesExW
LCMapStringW
SetLastError
SystemTimeToTzSpecificLocalTime
ReadDirectoryChangesW
WaitForSingleObject
EnumSystemLocalesW
GetDateFormatW
WriteFile
CancelIoEx
SignalObjectAndWait
InitializeSListHead
QueueUserAPC
WideCharToMultiByte
SetEnvironmentVariableA
FileTimeToSystemTime
lstrcmpiW
MoveFileExW
GetModuleHandleA
DeleteCriticalSection
GetTempPathW
HeapAlloc
UnregisterWait
FindFirstFileExW
GetLogicalProcessorInformation
EncodePointer
TlsFree
ResetEvent
IsValidCodePage
GetFileAttributesW
CreateFileW
HeapSize
LockResource
GetFullPathNameW
SetUnhandledExceptionFilter
GetFileType
WriteConsoleW
GetCurrentDirectoryW
IsValidLocale
GlobalUnlock
GlobalFree
GetConsoleCP
HeapReAlloc
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
ExitProcess
TlsAlloc
GetLastError
IsDebuggerPresent
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RaiseException
SleepEx
UnregisterWaitEx
CreateThread
SetEndOfFile
FreeLibrary
FindNextFileW
ReleaseMutex
lstrlenW
LocalFree
ChangeTimerQueueTimer
FlushFileBuffers
GetLocalTime
CreateFileMappingW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
ExpandEnvironmentStringsW
GetThreadPriority
GetLocaleInfoW
MultiByteToWideChar
GetModuleHandleW
ReadFile
VirtualFree
CreateDirectoryW
MapViewOfFileEx
GlobalSize
VirtualProtect
GetProcessAffinityMask
CreateTimerQueueTimer
GlobalLock
lstrcmpW
GetModuleFileNameW
GlobalAlloc
SetFilePointerEx
CreateEventW
SetEvent
QueryDepthSList
GetStringTypeW
GetProcAddress
MulDiv
TlsSetValue
EnterCriticalSection
CompareStringW
ReleaseSemaphore
ReadConsoleW
lstrcpyW
InterlockedPopEntrySList
LoadLibraryW
IsProcessorFeaturePresent
GetModuleHandleExW
RtlUnwind
DeleteTimerQueueTimer
GetCPInfo
InterlockedFlushSList
GetConsoleMode
InterlockedPushEntrySList
SetThreadAffinityMask

user32

GetMenuItemInfoW
SetCursor
RemovePropW
LoadMenuW
GetScrollRange
DestroyCursor
ClientToScreen
MessageBoxW
GetWindowLongW
CreateDialogIndirectParamW
SetDlgItemTextW
GetCursorPos
EndDeferWindowPos
IsCharUpperW
FlashWindowEx
GetDC
FrameRect
CreateCursor
TranslateMessage
GetWindowRect
OpenClipboard
PostMessageW
GetWindowTextLengthW
InflateRect
InsertMenuItemW
GetMenuItemID
RegisterWindowMessageW
SetScrollInfo
DestroyAcceleratorTable
CheckMenuItem
SetParent
GetDCEx
UpdateWindow
IsCharAlphaNumericW
CreateAcceleratorTableW
DefWindowProcW
ShowWindow
GetSysColor
ShowCursor
SetScrollRange
GetDlgItem
GetKeyState
IsWindowEnabled
ShowCaret
SetMenu
DestroyWindow
SetClipboardViewer
IsWindowUnicode
SystemParametersInfoW
IsCharAlphaW
SetWindowsHookExW
MoveWindow
SetWindowTextW
DrawMenuBar
DeferWindowPos
GetMenuItemCount
ScreenToClient
SetDlgItemTextA
DialogBoxIndirectParamW
GetSysColorBrush
HideCaret
GetMonitorInfoW
CheckMenuRadioItem
RegisterClassExW
DrawEdge
IsCharLowerW
CallNextHookEx
ReleaseDC
CreateCaret
IsDialogMessageW
EndPaint
GetDlgCtrlID
FillRect
ModifyMenuW
mouse_event
AllowSetForegroundWindow
CallWindowProcW
InvalidateRect
DestroyIcon
LockWindowUpdate
EndDialog
BeginPaint
SetCursorPos
EnableWindow
DialogBoxParamW
GetDlgItemTextW
SetMenuDefaultItem
RegisterClassW
DrawFocusRect
SetPropW
GetClassNameA
LoadIconW
SetWindowPos
MapWindowPoints
GetClassNameW
ChangeClipboardChain
SetScrollPos
InsertMenuW
EnableMenuItem
DeleteMenu
CreateWindowExW
AdjustWindowRectEx
SetForegroundWindow
GetMenu
GetSubMenu
GetMenuItemRect
DrawTextExW
DispatchMessageW
SendMessageW
TrackPopupMenu
UnregisterClassW
AppendMenuW
GetWindowTextW
SetMenuItemInfoW
GetMenuItemInfoA
IsClipboardFormatAvailable
LoadCursorW
UnhookWindowsHookEx
ShowScrollBar
GetPropW
GetSystemMetrics
SetCapture
DestroyMenu
SetDlgItemInt
SetWindowLongW
RemoveMenu
DrawIconEx
RegisterClipboardFormatW
IsIconic
CharLowerW
SendDlgItemMessageW
IsWindow
MessageBeep
GetMenuState
SetWindowPlacement
GetMessageW
GetDlgItemTextA
CharUpperW
LockSetForegroundWindow
SetRectEmpty
BeginDeferWindowPos
IsZoomed
DrawTextW
MonitorFromWindow
CreateDialogParamW
IsChild
GetScrollPos
LoadStringW
LoadImageW
MessageBoxA
SetFocus
FindWindowW
GetWindowPlacement
GetDlgItemInt
TrackMouseEvent
LoadBitmapW
SetCaretPos
GetParent
TranslateAcceleratorW

gdi32

SetTextColor
GetPixel
PatBlt
SetWindowOrgEx
MoveToEx
EnumFontFamiliesExW
GetTextExtentPoint32W
SetTextAlign
CreateFontIndirectW
SetStretchBltMode
GetDeviceCaps
OffsetWindowOrgEx
CreatePatternBrush
SelectObject
SaveDC
GetStockObject
GetObjectW
CreateFontW
StartPage
CreateHatchBrush
BitBlt
DeleteDC
GetTextExtentPointW
CreateFontA
GetTextMetricsW
StretchBlt
StartDocW
LineTo
EndDoc
CreateSolidBrush
ExtTextOutW
CreateCompatibleBitmap
GetDCOrgEx
GetROP2
SetBkColor
DeleteObject
CreateCompatibleDC
Rectangle
SetBrushOrgEx
SetBkMode
RestoreDC
DPtoLP
EndPage
SetROP2
CreateBitmap

advapi32

RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
FreeSid
RegOpenKeyExW
CheckTokenMembership

ole32

CoInitialize
CoInitializeEx

Exports

Exports

Abeziwaquv
AlphaBlend
Dtelorahisep
Ilesawufuzeli
Ljohuwikun
Oqogaheco
Ozavanixyhiky
Pqupitilewisy

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a66d5406732ee8bcda2d6a1c8573299

Code Sign

19:69:7b:80:91:61:d1:79:37:51:94:78:68:bb:c5:91Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

6c:67:61:c9:df:73:54:46:4a:3f:d1:32:9e:aa:81:d5:dd:3e:d7:b4:c5:d4:2f:4f:bf:b9:41:f4:71:4b:db:cfSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

Exports

Exports

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 87KB - Virtual size: 87KB

.data Size: 2KB - Virtual size: 5KB

.reloc Size: 21KB - Virtual size: 20KB

.rsrc Size: 35KB - Virtual size: 34KB

19:69:7b:80:91:61:d1:79:37:51:94:78:68:bb:c5:91
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

6c:67:61:c9:df:73:54:46:4a:3f:d1:32:9e:aa:81:d5:dd:3e:d7:b4:c5:d4:2f:4f:bf:b9:41:f4:71:4b:db:cf
Signer

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 87KB - Virtual size: 87KB

.data
Size: 2KB - Virtual size: 5KB

.reloc
Size: 21KB - Virtual size: 20KB

.rsrc
Size: 35KB - Virtual size: 34KB