669ed06d3605117638115ba179f6d5a3d87033a9c951c011a05ec92eaeff48b0

Sharing

Copy URL Twitter E-mail

General

Target

669ed06d3605117638115ba179f6d5a3d87033a9c951c011a05ec92eaeff48b0
Size

9.1MB
MD5

dd44f1cad8a9be0741483e1747f05f30
SHA1

5dcd7e17af5c520ed9b8583744d5e74d8428e2b5
SHA256

669ed06d3605117638115ba179f6d5a3d87033a9c951c011a05ec92eaeff48b0
SHA512

6c3030656ce2558c890078d9d57567671797b07378626689be1c63bd33d220e64d9bd068355a639648200371d371c1e88f7cef6548b33f8f70b409be59bf006d
SSDEEP

196608:AiIWKsq9P0I7OcOqhhp0+gNANKvHvP+6mRVsVgZ/s4F6GJk/o0Rz:mWK99c8z2+g+NKPO6SVsVE/9U0k7B

Score

1^/10

Malware Config

Signatures

Files

669ed06d3605117638115ba179f6d5a3d87033a9c951c011a05ec92eaeff48b0
.exe windows:10 windows x86 arch:x86

27fac8d858e217ea5785e853638cfd68

Code Sign

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2016, 20:17

Not After

02/11/2017, 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:53:27:9d:bf:7c:2c:80:ca:90:00:00:00:00:01:53
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/01/2017, 17:37

Not After

12/04/2018, 17:37

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e9:68:f1:d5:ab:0b:9c:9e:1c:73:71:ff:3b:e6:90:f3:15:c6:f3:32:52:92:a7:b1:76:77:3f:8c:eb:9a:0c:14
Signer

Actual PE Digest

e9:68:f1:d5:ab:0b:9c:9e:1c:73:71:ff:3b:e6:90:f3:15:c6:f3:32:52:92:a7:b1:76:77:3f:8c:eb:9a:0c:14

Digest Algorithm

sha256

PE Digest Matches

false

bf:3a:f8:df:86:af:30:50:30:22:24:fc:61:03:0c:dc:b5:00:fb:d1
Signer

Actual PE Digest

bf:3a:f8:df:86:af:30:50:30:22:24:fc:61:03:0c:dc:b5:00:fb:d1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mrtstub.pdb

Imports

advapi32

RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
TraceMessage
RegCreateKeyExW
RegCloseKey
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
GetLengthSid
AllocateAndInitializeSid
CopySid
FreeSid
CheckTokenMembership

kernel32

GetModuleFileNameW
GetExitCodeProcess
CreateProcessW
FreeLibrary
GetProcAddress
QueryFullProcessImageNameW
FindResourceW
LoadResource
CloseHandle
Process32FirstW
LockResource
Process32NextW
GetLastError
Sleep
CreateToolhelp32Snapshot
SetFileAttributesW
FormatMessageW
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
GetStdHandle
WriteFile
MultiByteToWideChar
ExitProcess
GetModuleHandleExW
GetACP
SetStdHandle
GetFileType
DeleteCriticalSection
SetFilePointerEx
SetLastError
WaitForSingleObject
GetConsoleCP
GetConsoleMode
HeapAlloc
GetStringTypeW
ReadFile
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
LCMapStringW
GetProcessHeap
FlushFileBuffers
CreateFileW
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
EncodePointer
DecodePointer
RaiseException
GetFileAttributesW
GetSystemDirectoryW
OpenProcess
HeapSetInformation
VirtualLock
LeaveCriticalSection
TerminateProcess
DeviceIoControl
EnterCriticalSection
GetVolumeInformationW
SizeofResource
HeapFree

ntdll

RtlGetVersion
RtlUnwind
RtlNtStatusToDosError

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData

crypt32

CertVerifyCertificateChainPolicy

Sections

.text
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8.9MB - Virtual size: 8.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

27fac8d858e217ea5785e853638cfd68

Code Sign

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9Certificate

Extended Key Usages

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:01:53:27:9d:bf:7c:2c:80:ca:90:00:00:00:00:01:53Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

e9:68:f1:d5:ab:0b:9c:9e:1c:73:71:ff:3b:e6:90:f3:15:c6:f3:32:52:92:a7:b1:76:77:3f:8c:eb:9a:0c:14Signer

bf:3a:f8:df:86:af:30:50:30:22:24:fc:61:03:0c:dc:b5:00:fb:d1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

ntdll

wintrust

crypt32

Sections

.text Size: 172KB - Virtual size: 172KB

.data Size: 3KB - Virtual size: 6KB

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 8.9MB - Virtual size: 8.9MB

.reloc Size: 7KB - Virtual size: 7KB

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9
Certificate

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:01:53:27:9d:bf:7c:2c:80:ca:90:00:00:00:00:01:53
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

e9:68:f1:d5:ab:0b:9c:9e:1c:73:71:ff:3b:e6:90:f3:15:c6:f3:32:52:92:a7:b1:76:77:3f:8c:eb:9a:0c:14
Signer

bf:3a:f8:df:86:af:30:50:30:22:24:fc:61:03:0c:dc:b5:00:fb:d1
Signer

.text
Size: 172KB - Virtual size: 172KB

.data
Size: 3KB - Virtual size: 6KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 8.9MB - Virtual size: 8.9MB

.reloc
Size: 7KB - Virtual size: 7KB