95bc41da4969f9e8d81435d7673b6a8616ebd4e8de9c8c1149cf2294f87db153

Sharing

Copy URL Twitter E-mail

General

Target

95bc41da4969f9e8d81435d7673b6a8616ebd4e8de9c8c1149cf2294f87db153
Size

29KB
MD5

6d318d62d06474d3d9e73388d4ea9206
SHA1

37396588575845da5c5d2a6bb8d10fdeb828452f
SHA256

95bc41da4969f9e8d81435d7673b6a8616ebd4e8de9c8c1149cf2294f87db153
SHA512

90e9e845e0c992ca81e4457a9971ba53dc43026f2617c3184fd0639cf7def214e9ed67158781deebe707fce74c541c264a62f8bd16ebb8bd52a9dd9b0b595f36
SSDEEP

192:Syp7JeySUzriVFJMpWeb74/z+hH0pTI1g6lE99999tI9RPKhOI1hMszND2q5Xo2z:VYQHiVvSWeb74ShUpceUPKYIoHW82Pt

Score

1^/10

Malware Config

Signatures

Files

95bc41da4969f9e8d81435d7673b6a8616ebd4e8de9c8c1149cf2294f87db153
.exe windows:5 windows x86 arch:x86

af5cae2c36ddfac2d17661004da71287

Code Sign

04:7a:55
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:58

Not After

03/03/2024, 12:58

Subject

CN=Certum Time-Stamping Authority,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

04:7a:53
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:53

Not After

03/03/2024, 12:53

Subject

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:94:69:b4:26:77:7d:b5:18:2f:82:8b:72:6b:80:62
Certificate

Issuer

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

15/12/2011, 12:12

Not After

14/12/2012, 12:12

Subject

CN=Rainmeter (Open Source Software),O=Rainmeter (Open Source Software),C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

17:51:57:a2:7a:89:d6:d1:1d:fb:cb:ce:c5:4c:c4:3c:09:75:a1:16
Signer

Actual PE Digest

17:51:57:a2:7a:89:d6:d1:1d:fb:cb:ce:c5:4c:c4:3c:09:75:a1:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rainmeter

ord1

msvcr100

__dllonexit
_lock
_onexit
_unlock
_invoke_watson
_controlfp_s
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_except_handler4_common

kernel32

IsDebuggerPresent
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
SetUnhandledExceptionFilter
EncodePointer
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 440B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af5cae2c36ddfac2d17661004da71287

Code Sign

04:7a:55Certificate

Extended Key Usages

04:7a:53Certificate

Key Usages

47:94:69:b4:26:77:7d:b5:18:2f:82:8b:72:6b:80:62Certificate

Extended Key Usages

Key Usages

17:51:57:a2:7a:89:d6:d1:1d:fb:cb:ce:c5:4c:c4:3c:09:75:a1:16Signer

Headers

DLL Characteristics

File Characteristics

Imports

rainmeter

msvcr100

kernel32

Sections

.text Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 948B

.rsrc Size: 19KB - Virtual size: 18KB

.reloc Size: 512B - Virtual size: 440B

04:7a:55
Certificate

04:7a:53
Certificate

47:94:69:b4:26:77:7d:b5:18:2f:82:8b:72:6b:80:62
Certificate

17:51:57:a2:7a:89:d6:d1:1d:fb:cb:ce:c5:4c:c4:3c:09:75:a1:16
Signer

.text
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 948B

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 512B - Virtual size: 440B