df2a0d01004ad06bf3c6207d04774f0b

Sharing

Copy URL Twitter E-mail

General

Target

df2a0d01004ad06bf3c6207d04774f0b
Size

69KB
MD5

df2a0d01004ad06bf3c6207d04774f0b
SHA1

e77ffe1ec009ff9a9c397301debd75d15da9f3c6
SHA256

723e1600c0cb515babcdb9c43a6fd6d6d0e82ded1f22385d556e15b3db373193
SHA512

c3804a0df4c364b887def4c0e5c75a522f0bba17c4e5b0d5d1c2741e1b65bfd871c2b3d1e152e1fc053dfbfd410825efabaa186620be331539a110616684884e
SSDEEP

1536:bfkjVZLp89I1OcvcKnWZ/fyOvjOODIGeHn3ZmSar80SBWVg:bfQYSXv0Z/tviODIGUar39Vg

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
static1/unpack001/ProduKey.exe	Nirsoft

Files

df2a0d01004ad06bf3c6207d04774f0b
.zip
ProduKey.chm
.chm
ProduKey.exe
.exe windows:4 windows x64 arch:x64

82a400b414e8056f21aedfd859b484a8

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a1:a3:e7:28:0e:0a:2d:f1:2f:84:30:96:49:82:05:19
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

17/09/2012, 00:00

Not After

17/09/2014, 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fb:8a:53:5b:6b:a1:5a:69:b9:7d:dc:93:08:7d:e2:48:94:d4:68:4d
Signer

Actual PE Digest

fb:8a:53:5b:6b:a1:5a:69:b9:7d:dc:93:08:7d:e2:48:94:d4:68:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\Projects\VS2005\ProduKey\x64\Release\ProduKey.pdb

Imports

mpr

WNetCloseEnum
WNetOpenEnumA
WNetEnumResourceA

msvcrt

_exit
_cexit
exit
_acmdln
_purecall
qsort
_strlwr
_itoa
_memicmp
_c_exit
malloc
free
strtoul
strcmp
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
strrchr
_XcptFilter
__C_specific_handler
__dllonexit
_onexit
strchr
_strcmpi
memcpy
strlen
atof
memcmp
atoi
_strnicmp
_mbsicmp
_stricmp
memset
strcpy
strcat
strncat
sprintf
__getmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type

comctl32

ImageList_SetImageCount
ord6
CreateToolbarEx
ImageList_Create
ImageList_AddMasked
ord17
ImageList_ReplaceIcon

ws2_32

gethostbyname
WSACleanup
WSAStartup
htons
WSAGetLastError
connect
WSAAsyncSelect
gethostbyaddr
closesocket
WSASetLastError

kernel32

OpenProcess
CreateThread
ResumeThread
ReadProcessMemory
ExitProcess
GetCurrentProcessId
DeleteFileA
SetErrorMode
GetStdHandle
GetPrivateProfileIntA
GetStartupInfoA
GetFileAttributesA
FindClose
GetVersionExA
GetTempFileNameA
EnumResourceNamesA
WritePrivateProfileStringA
MultiByteToWideChar
FindNextFileA
GlobalUnlock
GetModuleFileNameA
GetWindowsDirectoryA
GetFileSize
CreateFileA
FormatMessageA
LocalFree
GetTempPathA
GetSystemDirectoryA
ReadFile
CloseHandle
GetTimeFormatA
FileTimeToLocalFileTime
GetDriveTypeA
WideCharToMultiByte
GetPrivateProfileStringA
Sleep
GetCurrentProcess
CompareFileTime
GetLogicalDrives
GetComputerNameA
FreeLibrary
FileTimeToSystemTime
GetProcAddress
LoadLibraryA
GetDateFormatA
WriteFile
GetModuleHandleA
FindFirstFileA
LoadLibraryExA
GetLastError
GlobalAlloc
GlobalLock

user32

KillTimer
GetFocus
EndDeferWindowPos
GetWindowTextA
GetMenuItemInfoA
TrackPopupMenu
DestroyWindow
CreateDialogParamA
DestroyMenu
GetDlgCtrlID
DialogBoxParamA
LoadStringA
BeginDeferWindowPos
PostQuitMessage
TranslateMessage
DeferWindowPos
IsDialogMessageA
EnumChildWindows
GetMenuItemCount
RegisterWindowMessageA
GetMessageA
DispatchMessageA
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
SetCursor
LoadCursorA
GetDlgItemTextA
SetWindowTextA
SendDlgItemMessageA
GetDlgItemInt
EndDialog
GetDlgItem
CreateWindowExA
SetDlgItemInt
SetDlgItemTextA
UpdateWindow
GetSystemMetrics
GetWindowRect
PostMessageA
SetMenu
LoadAcceleratorsA
SetWindowPos
DefWindowProcA
TranslateAcceleratorA
MessageBoxA
GetWindowPlacement
SendMessageA
RegisterClassA
LoadImageA
LoadIconA
GetWindowLongA
SetWindowLongA
InvalidateRect
SetFocus
SetClipboardData
EnableWindow
EmptyClipboard
GetClientRect
MapWindowPoints
EnableMenuItem
ReleaseDC
OpenClipboard
GetClassNameA
CloseClipboard
GetParent
ModifyMenuA
GetMenuStringA
GetSubMenu
GetMenu
MoveWindow
GetCursorPos
GetDC
CheckMenuItem
GetSysColor
LoadMenuA
SetTimer

gdi32

GetStockObject
GetTextExtentPoint32A
SetBkColor
SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject
GetDeviceCaps

comdlg32

GetSaveFileNameA
FindTextA
GetOpenFileNameA

advapi32

RegUnLoadKeyA
RegEnumValueA
RegConnectRegistryA
RegEnumKeyExA
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyA
RegOpenKeyExA
RegDeleteKeyA
RegLoadKeyA

shell32

ShellExecuteA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetMalloc

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
readme.txt

Sharing

General

Malware Config

Signatures

Files

82a400b414e8056f21aedfd859b484a8

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

a1:a3:e7:28:0e:0a:2d:f1:2f:84:30:96:49:82:05:19Certificate

Extended Key Usages

Key Usages

fb:8a:53:5b:6b:a1:5a:69:b9:7d:dc:93:08:7d:e2:48:94:d4:68:4dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mpr

msvcrt

comctl32

ws2_32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 71KB - Virtual size: 71KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 1024B - Virtual size: 4KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 13KB - Virtual size: 12KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

a1:a3:e7:28:0e:0a:2d:f1:2f:84:30:96:49:82:05:19
Certificate

fb:8a:53:5b:6b:a1:5a:69:b9:7d:dc:93:08:7d:e2:48:94:d4:68:4d
Signer

.text
Size: 71KB - Virtual size: 71KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 1024B - Virtual size: 4KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 13KB - Virtual size: 12KB