MagicMouseTrails_Installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

MagicMouseTrails_Installer.exe
Size

408KB
MD5

22f339d49972e406375e9779f37c4864
SHA1

81ddb02b4a7b872b2492c5ed41e155ba120a63a2
SHA256

f7639f41792efe4b5fac39403b509dbce54fe3ccd1e47ca3a07d927444fa99ce
SHA512

0959168cd6d7b08ed535c5488a1e8f1550ae40d145cc88f551adbc8846cfe04d8924437ba3f118907e85b245201f0fa2a1e12375a29e3884ac0058e6b9578674
SSDEEP

12288:hnRSzxfdSDk8kh0kDWH93OjadRqTuVFzZl3PlQ85:h0z5dS4ukDWH93FqaV5/F5

Score

1^/10

Malware Config

Signatures

Files

MagicMouseTrails_Installer.exe
.exe windows:4 windows x64 arch:x64

e26dcce9ae477ee06cdea45f65dbdc8e

Code Sign

5c:ed:a3:96:d8:ca:15:4b:0e:23:f0:c8:8d:ec:f9:0f
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16/06/2019, 00:00

Not After

15/06/2021, 23:59

Subject

CN=Nenad Hrg,O=Nenad Hrg,POSTALCODE=82024,STREET=Edelweißstr. 104,L=Taufkirchen,ST=Bayern,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:59:cd:b2:b2:41:9d:c0:8b:e0:b3:5e:a3:8e:1a:64:cf:8b:01:46:eb:04:65:1b:a4:81:6f:87:a7:74:fa:b7
Signer

Actual PE Digest

f9:59:cd:b2:b2:41:9d:c0:8b:e0:b3:5e:a3:8e:1a:64:cf:8b:01:46:eb:04:65:1b:a4:81:6f:87:a7:74:fa:b7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SetFileAttributesW
RemoveDirectoryW
GetDriveTypeW
GetLogicalDriveStringsW
GetFullPathNameW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
InterlockedPopEntrySList
VirtualAlloc
GetCurrentProcessId
InterlockedPushEntrySList
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
CreateMutexW
CompareStringW
lstrcmpiW
GetUserDefaultLangID
CreateDirectoryW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetFileAttributesW
GlobalHandle
FreeResource
DeleteFileW
GetTempPathW
GetTimeZoneInformation
GetFileSize
ReadFile
CreateFileW
WriteFile
CloseHandle
CopyFileW
lstrcmpW
lstrcatW
HeapDestroy
InitializeCriticalSection
DeleteCriticalSection
WideCharToMultiByte
GetModuleFileNameW
GetModuleHandleW
GetLastError
FormatMessageW
LocalFree
OutputDebugStringA
TerminateThread
CreateThread
GetLocalTime
lstrcpynW
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
FindResourceW
LoadResource
LockResource
MultiByteToWideChar
SizeofResource
lstrcpyW
LoadLibraryW
FreeLibrary
SetLastError
__C_specific_handler
GetVersionExW
GetModuleHandleA
GetProcAddress
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetCurrentProcess
FlushInstructionCache
OutputDebugStringW
DebugBreak
lstrlenA
lstrlenW
VirtualFree

user32

CheckMenuItem
GetMenuItemInfoW
InsertMenuW
SetClassLongW
SetForegroundWindow
GetKeyboardState
DestroyIcon
DrawAnimatedRects
GetSubMenu
CreateIconIndirect
GetIconInfo
LoadIconW
GetMessagePos
GetMenuItemCount
TrackPopupMenuEx
GetSysColorBrush
SetWindowTextW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetKeyState
MapVirtualKeyW
keybd_event
GetCursorPos
EqualRect
SetRect
KillTimer
SetTimer
GetClassInfoExW
wsprintfW
DestroyMenu
MessageBoxW
GetDesktopWindow
LoadCursorW
RegisterClassExW
GetMessageW
DispatchMessageW
PeekMessageW
GetCapture
PostQuitMessage
GetActiveWindow
GetSystemMetrics
ReleaseDC
GetDC
EndPaint
FillRect
GetClassNameW
InvalidateRgn
CreateDialogParamW
BeginPaint
GetSysColor
GetWindowLongPtrW
DrawTextW
CallWindowProcW
RegisterWindowMessageW
DefWindowProcW
OffsetRect
PtInRect
CopyRect
SetWindowLongW
GetDlgCtrlID
SetCapture
ShowWindow
InvalidateRect
CreatePopupMenu
AppendMenuW
SetMenuItemInfoW
SetMenu
PostMessageW
SetCursor
IsWindowEnabled
UpdateWindow
SetRectEmpty
EnumWindows
SendMessageTimeoutW
EnableWindow
CreateDialogIndirectParamW
GetWindowTextLengthW
CreateAcceleratorTableW
IsWindow
GetWindowLongW
SendMessageW
GetWindowRect
ScreenToClient
RedrawWindow
SetDlgItemTextW
GetParent
GetDlgItem
SetWindowPos
MapWindowPoints
GetClientRect
SystemParametersInfoW
GetWindow
TranslateMessage
SetParent
CharLowerW
IsChild
LoadImageW
GetFocus
IsDialogMessageW
DialogBoxParamW
GetWindowTextW
FindWindowExW
EnumChildWindows
SetFocus
IsWindowVisible
LoadStringW
wvsprintfW
CharNextW
EndDialog
SetWindowLongPtrW
ReleaseCapture
FrameRect
DrawFocusRect
DrawEdge
CreateWindowExW
DestroyWindow

gdi32

CreateCompatibleBitmap
EnumFontsW
GetObjectW
GetPixel
CreateBitmap
GetCurrentObject
BitBlt
CreateCompatibleDC
CreateDIBSection
GetStockObject
DeleteDC
SetTextColor
SetBkColor
GetDeviceCaps
CreateFontIndirectW
DeleteObject
CreateSolidBrush
ExtTextOutW
SetBkMode
SetPixel
SelectObject

comdlg32

GetOpenFileNameW
ChooseFontW

advapi32

RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
CryptDestroyHash
CryptReleaseContext
CryptCreateHash
RegOpenKeyW
RegDeleteKeyW
RegCloseKey
CryptGetHashParam
CryptHashData
CryptAcquireContextW

shell32

ord17
ord16
ord155
SHAppBarMessage
Shell_NotifyIconW
SHGetFileInfoW
ord190
SHGetDesktopFolder
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW
ord18

ole32

StringFromCLSID
CoTaskMemFree
CreateStreamOnHGlobal
CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
OleLockRunning
OleInitialize
OleUninitialize
CoUninitialize
CoInitialize
CLSIDFromProgID

oleaut32

SafeArrayDestroy
SysAllocStringLen
LoadRegTypeLi
SysStringLen
DispCallFunc
VariantInit
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
SysFreeString
SysAllocString

msvcrt

wcscmp
_wtoi
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memcpy
wcslen
free
malloc
wcschr
__set_app_type
_fmode
_commode
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
_cexit
_exit
_c_exit
_XcptFilter
_onexit
__dllonexit
wcsncpy
localtime
wcsftime
_wfopen
mktime
abs
fclose
fread
fwrite
getc
putc
exit
time
sprintf
wcscat
iswspace
wcsrchr
memcmp
strlen
clock
memmove
wcsstr
rand
memset
??1type_info@@UEAA@XZ
_CxxThrowException
_purecall
_wcsicmp
realloc
iswdigit
?terminate@@YAXXZ

comctl32

ImageList_Replace
ImageList_Add
ImageList_Create
_TrackMouseEvent
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_LoadImageW
ImageList_Draw

gdiplus

GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipCreateFromHDC
GdiplusStartup
GdipCreateBitmapFromStream
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipPrivateAddMemoryFont
GdipDeletePrivateFontCollection
GdipNewPrivateFontCollection
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCloneImage
GdipDrawImageRectRect
GdipDrawImageRect
GdipGetImageGraphicsContext
GdipSetImageAttributesColorMatrix
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipFree
GdipAlloc
GdipCreateHICONFromBitmap

Sections

.text
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e26dcce9ae477ee06cdea45f65dbdc8e

Code Sign

5c:ed:a3:96:d8:ca:15:4b:0e:23:f0:c8:8d:ec:f9:0fCertificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

f9:59:cd:b2:b2:41:9d:c0:8b:e0:b3:5e:a3:8e:1a:64:cf:8b:01:46:eb:04:65:1b:a4:81:6f:87:a7:74:fa:b7Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

msvcrt

comctl32

gdiplus

Sections

.text Size: 182KB - Virtual size: 182KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 64KB - Virtual size: 259KB

.pdata Size: 7KB - Virtual size: 6KB

.rsrc Size: 110KB - Virtual size: 109KB

5c:ed:a3:96:d8:ca:15:4b:0e:23:f0:c8:8d:ec:f9:0f
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

f9:59:cd:b2:b2:41:9d:c0:8b:e0:b3:5e:a3:8e:1a:64:cf:8b:01:46:eb:04:65:1b:a4:81:6f:87:a7:74:fa:b7
Signer

.text
Size: 182KB - Virtual size: 182KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 64KB - Virtual size: 259KB

.pdata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 110KB - Virtual size: 109KB