notmyfault[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

notmyfault.exe
Size

232KB
MD5

0c6ed0f4b8ef5d1ead326a667ee3004a
SHA1

a9421aa84420b303219f40a771c94be7056cbcc3
SHA256

b7e46980edf43028b116ab589c2c51fc37d52c1ca1cf38e097b1bafc86be3ca6
SHA512

fc257f5b9948a08dcd1021885ca316db688794f050c3273ea8970f3bd6baac904899ee5a09e2d310f9931bd0f2b2c39dc56e231f2ecace023f9f0131fe710350
SSDEEP

3072:QfavAG1nVZqZUFroLNwXiWACrOxdZJ+XXknfpns4RI0EEtajsEJ4:n7riCCjO0f+4bQ4

Score

1^/10

Malware Config

Signatures

Files

notmyfault.exe
.exe windows:5 windows x86 arch:x86

e4bc6901153fccf1b1c41b775abf19a6

Code Sign

33:00:00:00:9d:42:68:ee:31:1c:d7:56:bd:00:00:00:00:00:9d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30-03-2016 19:21

Not After

30-06-2017 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-08-2016 20:17

Not After

02-11-2017 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28-10-2015 20:31

Not After

28-01-2017 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:99:04:be:8e:ed:ed:58:de:d3:d5:d0:11:b6:dc:78:25:7a:09:85:d8:f5:db:e5:26:72:ae:fa:d1:4a:29:45
Signer

Actual PE Digest

cd:99:04:be:8e:ed:ed:58:de:d3:d5:d0:11:b6:dc:78:25:7a:09:85:d8:f5:db:e5:26:72:ae:fa:d1:4a:29:45

Digest Algorithm

sha256

PE Digest Matches

true

7c:f7:95:1d:99:e1:12:d0:01:b6:69:d4:e2:bc:bd:2a:c7:b1:da:62
Signer

Actual PE Digest

7c:f7:95:1d:99:e1:12:d0:01:b6:69:d4:e2:bc:bd:2a:c7:b1:da:62

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrFormatKBSizeW

comctl32

PropertySheetW

kernel32

OutputDebugStringW
ReadConsoleW
WriteConsoleW
SetFilePointerEx
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetStringTypeW
LoadLibraryExW
GetModuleHandleW
GetCurrentThreadId
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
TlsFree
TlsSetValue
DeleteFileW
SetFileAttributesW
FindResourceW
GetEnvironmentVariableW
FormatMessageW
GetTickCount
GetSystemInfo
MulDiv
DeviceIoControl
SizeofResource
LoadResource
LockResource
CreateFileW
GetLastError
CloseHandle
GetVersion
GetStdHandle
GetCommandLineW
LocalFree
LocalAlloc
GetProcAddress
GetModuleFileNameW
SetEndOfFile
GetFileType
LCMapStringW
GetProcessHeap
LoadLibraryW
HeapSize
RtlUnwind
TlsGetValue
TlsAlloc
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
HeapAlloc
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
CreateThread
ExitThread
ResumeThread
GetCommandLineA
DeleteCriticalSection
FlushFileBuffers
WriteFile
GetConsoleCP
IsDebuggerPresent
IsProcessorFeaturePresent
ReadFile
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess

user32

MessageBoxW
InvalidateRect
ReleaseDC
GetDC
DrawTextW
KillTimer
SetTimer
SetFocus
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextW
SetDlgItemTextW
GetDlgItemInt
ShowWindow
FillRect
PostMessageW
RegisterWindowMessageW
wsprintfW
LoadCursorW
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
SendMessageW
PostQuitMessage

gdi32

SetBkMode
SelectObject
DeleteObject
DeleteDC
CreateSolidBrush
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
EndPage
StartPage
EndDoc
StartDocW
SetMapMode
GetDeviceCaps
SetTextColor

comdlg32

PrintDlgW
ChooseColorW

advapi32

RegQueryValueExW
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
RegSetValueExW
RegOpenKeyExW
RegOpenKeyW
RegCreateKeyW
RegCloseKey

shell32

CommandLineToArgvW

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4bc6901153fccf1b1c41b775abf19a6

Code Sign

33:00:00:00:9d:42:68:ee:31:1c:d7:56:bd:00:00:00:00:00:9dCertificate

Extended Key Usages

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

cd:99:04:be:8e:ed:ed:58:de:d3:d5:d0:11:b6:dc:78:25:7a:09:85:d8:f5:db:e5:26:72:ae:fa:d1:4a:29:45Signer

7c:f7:95:1d:99:e1:12:d0:01:b6:69:d4:e2:bc:bd:2a:c7:b1:da:62Signer

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

Sections

.text Size: 70KB - Virtual size: 69KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 93KB - Virtual size: 92KB

33:00:00:00:9d:42:68:ee:31:1c:d7:56:bd:00:00:00:00:00:9d
Certificate

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

cd:99:04:be:8e:ed:ed:58:de:d3:d5:d0:11:b6:dc:78:25:7a:09:85:d8:f5:db:e5:26:72:ae:fa:d1:4a:29:45
Signer

7c:f7:95:1d:99:e1:12:d0:01:b6:69:d4:e2:bc:bd:2a:c7:b1:da:62
Signer

.text
Size: 70KB - Virtual size: 69KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 93KB - Virtual size: 92KB