cb51ad5fd124cfabc4dc7ef22bae879e

Sharing

Copy URL Twitter E-mail

General

Target

cb51ad5fd124cfabc4dc7ef22bae879e
Size

675KB
MD5

cb51ad5fd124cfabc4dc7ef22bae879e
SHA1

e1f0f59c0e60ad499b38926ac7ce79fcd97f3a3e
SHA256

1330fc80e33bf757a79223268639216c2d2e180222a1da890e023c2704a91c19
SHA512

2237ed543dcec107fe14a8d7b2d4a378ce0c96a6d8c98db6a771a0d78c7574367e3682c2cee7bee183e00167ea207a6ea8b49fa7f3deefe07bc759d9a918cc4e
SSDEEP

12288:HvrRzNSici8gB/myLYepMYOdDtgyc68ceAjhll6t:HvrRBqEwBdDtgy8ceANll6t

Score

1^/10

Malware Config

Signatures

Files

cb51ad5fd124cfabc4dc7ef22bae879e
.exe windows:4 windows x86 arch:x86

2230cd929d36e31958230dd27604d011

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9d:13:0a:c5:a3:4c:11:40:7b:15:51:47:f0:e2:a1:7e
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/05/2015, 00:00

Not After

12/05/2016, 23:59

Subject

CN=ASKAD,O=ASKAD,POSTALCODE=644045,STREET=pr-t Koroleva\, 16/1\, 68,L=Omsk,ST=Omsk region,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e7:69:37:99:b8:c0:00:59:e9:e8:7f:b6:e6:fc:31:72:2c:0c:e7:57
Signer

Actual PE Digest

e7:69:37:99:b8:c0:00:59:e9:e8:7f:b6:e6:fc:31:72:2c:0c:e7:57

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

SetScrollPos
GetProgmanWindow
RemovePropW
InsertMenuA
MenuWindowProcA
CharNextExA
SetDlgItemInt
GetClassInfoA
DrawFrame
IsHungAppWindow
GetWindow
KillTimer
TranslateMessage
InvalidateRect
PaintDesktop
EqualRect
UnregisterHotKey
DeleteMenu
GetCaretPos
GetGuiResources
GetIconInfo
EnableScrollBar
PostMessageW
OemToCharBuffW
SetWindowsHookW
SetClassWord
GetMenuStringW
DefDlgProcA
OpenClipboard
GetWindowPlacement
PeekMessageA
GetWindowRect
GetDC
FindWindowExA
ValidateRect
GetAltTabInfoW
DefWindowProcW
GetProgmanWindow
IsMenu
SetSysColors
ToUnicode
EnumDisplaySettingsW
DrawStateA
GetSystemMetrics
LoadCursorFromFileA
InflateRect
GetFocus
CharToOemBuffW
CheckDlgButton
DrawTextA
TabbedTextOutW
SetMenuDefaultItem
DragDetect
LoadMenuA
GetAsyncKeyState
CloseWindowStation
RegisterWindowMessageW
WinHelpA
ExitWindowsEx
CharLowerA
DialogBoxParamW
SetMenuInfo
DefFrameProcA
GetWindowContextHelpId
SetWindowsHookA
GetWindowRgn
OemToCharW
ChangeDisplaySettingsW
GetWindowInfo
GetUpdateRgn
UnregisterClassA
CreateMDIWindowA
HideCaret
GetSysColor
RegisterDeviceNotificationA
CharToOemW
PrivateExtractIconsA
IsIconic
CharToOemA
EnumPropsExA
SetWindowWord
GetNextDlgGroupItem
GetTitleBarInfo
SetFocus
SetLastErrorEx
CharNextA
GetKeyNameTextW
GetUpdateRect
TabbedTextOutA
EnableWindow
MessageBoxA
GetKeyboardLayoutNameW
RegisterClassExA
CharUpperBuffW
DrawIconEx
SetMenuItemInfoA
BroadcastSystemMessageA
SetScrollInfo
GetUserObjectSecurity
GetProcessWindowStation
GetParent
GetDCEx
LoadAcceleratorsW
SetForegroundWindow
MapWindowPoints
PrintWindow
GetCaretBlinkTime
GetMenuItemCount

kernel32

LocalFileTimeToFileTime
FindFirstFileExW
SetStdHandle
GlobalFindAtomW
SetFilePointerEx
IsValidLocale
GetProcessHeap
WriteFileGather
GlobalUnlock
GlobalMemoryStatusEx
FindFirstVolumeMountPointW
SignalObjectAndWait
GetCalendarInfoA
WriteFile
WriteConsoleOutputW
IsBadStringPtrW
FindFirstVolumeA
InitAtomTable
lstrcpyA
DisableThreadLibraryCalls
ExitProcess
OpenWaitableTimerA
DeleteTimerQueue
SetLocalTime
ExpandEnvironmentStringsW
SetVolumeMountPointW
ConvertDefaultLocale
Heap32First
GetFileSizeEx
CreateHardLinkW
GetCompressedFileSizeA
SetComputerNameW
EraseTape
GetCurrentProcess
GetVersion
WritePrivateProfileSectionA
FreeUserPhysicalPages
SetLocaleInfoA
OpenFileMappingW
FlushConsoleInputBuffer
MultiByteToWideChar
OpenEventA
GetCurrentDirectoryW
GetEnvironmentStrings
EnumCalendarInfoExW
GetShortPathNameA
EnumTimeFormatsW
ReadConsoleOutputCharacterW
GetTempPathW
SetInformationJobObject
FoldStringW
OpenMutexA
SetPriorityClass
ReleaseMutex
UnmapViewOfFile
TlsFree
WriteFileEx
LZCopy
SetThreadAffinityMask
GetCurrencyFormatW
LocalFlags
GlobalReAlloc
GetVolumePathNameA
GetComputerNameA
EnumDateFormatsExA
GetTempPathA
Sleep
FindVolumeMountPointClose
EnumCalendarInfoW
AllocConsole
GetSystemDefaultLCID
GetVolumeInformationW
GlobalSize
GetModuleHandleExW
GetSystemTimeAsFileTime
GlobalAddAtomW
GetTimeFormatW
AddVectoredExceptionHandler
LZStart
BackupSeek
CreateMemoryResourceNotification
HeapSize
IsDBCSLeadByte
FatalExit
OpenSemaphoreA
CloseHandle
AddAtomA
LoadLibraryExA
GetCommandLineA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

ole32

CoCreateInstanceEx
CoCreateObjectInContext
StgPropertyLengthAsVariant
OleConvertOLESTREAMToIStorage
CoGetClassObject
CoPopServiceDomain
CoGetProcessIdentifier
CoWaitForMultipleHandles
StgSetTimes
OleRun
ReadOleStg
PropSysFreeString
CoCreateInstance
CoRegisterPSClsid
HMENU_UserMarshal

comdlg32

ChooseFontA
ChooseColorW
PrintDlgExA
GetSaveFileNameA
WantArrows
GetOpenFileNameA
FindTextW

shell32

SHGetFileInfoA
SHGetMalloc
StrChrA
StrRStrIW
DragQueryPoint
SHParseDisplayName

advapi32

ConvertSecurityDescriptorToAccessNamedA
ControlService
SaferiPopulateDefaultsInRegistry
CredProfileLoaded
LsaEnumerateTrustedDomainsEx

gdi32

FONTOBJ_pifi
GetTextExtentPointA
GdiGetDC
CreateFontIndirectExA
EnumFontFamiliesA
ExcludeClipRect
ClearBrushAttributes
GdiGetCharDimensions
GdiGetPageCount
SetWindowExtEx
GdiValidateHandle
GetTextCharset
SetICMProfileA
BitBlt
CombineTransform
GdiTransparentBlt
cGetTTFFromFOT

wtsapi32

WTSSendMessageW
WTSWaitSystemEvent
WTSSetSessionInformationA
WTSQueryUserToken
WTSEnumerateSessionsW
WTSVirtualChannelPurgeOutput
WTSVirtualChannelPurgeInput
WTSShutdownSystem
WTSQueryUserConfigW
WTSVirtualChannelOpen
WTSCloseServer
WTSSetUserConfigW
WTSQuerySessionInformationA

ws2_32

ntohs
WSAIoctl
bind
WSCDeinstallProvider
WSAEnumProtocolsA
getaddrinfo
WSASetServiceA
WSAStringToAddressA
WSCInstallProvider
WSAAddressToStringW
shutdown
ntohl

comctl32

FlatSB_GetScrollRange
CreatePropertySheetPageA
ImageList_Replace
CreateToolbar
InitCommonControls
DrawStatusText
ImageList_GetBkColor
UninitializeFlatSB
ImageList_SetIconSize
FlatSB_GetScrollInfo
FlatSB_EnableScrollBar

Sections

CODE
Size: 438KB - Virtual size: 437KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 753B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2230cd929d36e31958230dd27604d011

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

9d:13:0a:c5:a3:4c:11:40:7b:15:51:47:f0:e2:a1:7eCertificate

Extended Key Usages

Key Usages

e7:69:37:99:b8:c0:00:59:e9:e8:7f:b6:e6:fc:31:72:2c:0c:e7:57Signer

Headers

File Characteristics

Imports

user32

kernel32

ole32

comdlg32

shell32

advapi32

gdi32

wtsapi32

ws2_32

comctl32

Sections

CODE Size: 438KB - Virtual size: 437KB

DATA Size: 11KB - Virtual size: 11KB

BSS Size: - Virtual size: 753B

.idata Size: 7KB - Virtual size: 7KB

.text0 Size: 35KB - Virtual size: 34KB

.tls Size: 512B - Virtual size: 24B

.text1 Size: 71KB - Virtual size: 70KB

.reloc Size: 6KB - Virtual size: 5KB

.rsrc Size: 99KB - Virtual size: 99KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

9d:13:0a:c5:a3:4c:11:40:7b:15:51:47:f0:e2:a1:7e
Certificate

e7:69:37:99:b8:c0:00:59:e9:e8:7f:b6:e6:fc:31:72:2c:0c:e7:57
Signer

CODE
Size: 438KB - Virtual size: 437KB

DATA
Size: 11KB - Virtual size: 11KB

BSS
Size: - Virtual size: 753B

.idata
Size: 7KB - Virtual size: 7KB

.text0
Size: 35KB - Virtual size: 34KB

.tls
Size: 512B - Virtual size: 24B

.text1
Size: 71KB - Virtual size: 70KB

.reloc
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 99KB - Virtual size: 99KB