72da77b3fe29ca8b1c003faa2675ec516b52343176414db782607784c8ea33ae

Sharing

Copy URL Twitter E-mail

General

Target

72da77b3fe29ca8b1c003faa2675ec516b52343176414db782607784c8ea33ae
Size

8.5MB
MD5

8d93f946187996e8a9d1d8c52b8ab58c
SHA1

c8f6fcab201edb653e943c42439dba0be5fda1ca
SHA256

72da77b3fe29ca8b1c003faa2675ec516b52343176414db782607784c8ea33ae
SHA512

d5e042bec7ed40fba59ffaea9fe56319c37cbbb08917d536c84c1a6464e5a6e9b9bde85beb8c95f8b6a0d8bce168493860e69431f2e3af53c112c3bc8b18c4fb
SSDEEP

49152:5dhzkjsdjJNifrF8SFXs2XncTGwaNsWoTbbAO95nmqZ:5dhcUNixNKAWnx

Score

1^/10

Malware Config

Signatures

Files

72da77b3fe29ca8b1c003faa2675ec516b52343176414db782607784c8ea33ae
.exe windows:4 windows x86 arch:x86

bd3a5a2eae1146df1bf0621fda057486

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2e:36:a3:31:c3:72:5d:a2:55:47:05:d6:eb:74:32:8b
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/11/2018, 00:00

Not After

14/11/2021, 23:59

Subject

CN=Apollo Video Technology\, LLC,O=Apollo Video Technology\, LLC,L=Bothell,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fd:06:3e:67:67:9f:ee:36:77:bc:91:5f:19:97:46:db:d4:73:48:a0
Signer

Actual PE Digest

fd:06:3e:67:67:9f:ee:36:77:bc:91:5f:19:97:46:db:d4:73:48:a0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFindFileNameW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
wnsprintfW
PathFindFileNameA
PathFileExistsW
SHDeleteKeyW

ole32

CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleIsCurrentClipboard
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
OleFlushClipboard
CoRegisterMessageFilter

kernel32

TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
SetStdHandle
GetFileType
GetSystemTimeAsFileTime
HeapReAlloc
GetTimeFormatA
GetDateFormatA
CreateThread
HeapSize
VirtualProtect
VirtualAlloc
VirtualQuery
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetEnvironmentVariableA
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
RtlUnwind
CreateFileA
GetProcessHeap
HeapAlloc
HeapFree
GetFileTime
GetFileAttributesW
FileTimeToLocalFileTime
SetErrorMode
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalFlags
WritePrivateProfileStringW
TlsFree
FoldStringW
GetCurrencyFormatW
IsDBCSLeadByteEx
LocalSize
EnumResourceTypesW
EnumResourceNamesW
GetDateFormatW
GetTimeFormatW
OpenProcess
FlushInstructionCache
lstrcpynA
lstrcpynW
RegisterWaitForSingleObject
UnregisterWait
InterlockedCompareExchange
GetModuleFileNameW
FindClose
FindNextFileW
FindFirstFileW
RaiseException
GetStartupInfoW
WaitForSingleObjectEx
SetEvent
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleTextAttribute
GetConsoleWindow
GetModuleHandleW
GetLastError
FormatMessageW
WriteConsoleW
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetSystemInfo
GetVersionExW
IsWow64Process
GetCurrentProcess
FreeLibrary
LoadLibraryW
LocalUnlock
LocalFree
LocalLock
LocalAlloc
ReleaseMutex
InitializeCriticalSection
CreateMutexW
GetCurrentThreadId
GetTickCount
DeleteFileW
RemoveDirectoryW
SizeofResource
LockResource
LoadResource
FindResourceW
LocalReAlloc
TlsSetValue
CreateEventA
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetThreadLocale
InterlockedIncrement
FileTimeToSystemTime
InterlockedDecrement
lstrlenA
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
GetModuleHandleA
FreeResource
GlobalAddAtomW
CreateEventW
ResumeThread
SetThreadPriority
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
lstrcmpA
WaitForSingleObject
GetLocaleInfoW
LoadLibraryExW
CompareStringA
InterlockedExchange
lstrcmpW
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
lstrlenW
MulDiv
SetLastError
GetUserDefaultUILanguage
CreateFileW
GetCurrentProcessId
OutputDebugStringW
GetTimeZoneInformation

user32

PostThreadMessageW
GetSystemMenu
RegisterClipboardFormatW
UnregisterClassW
LoadMenuW
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
IsRectEmpty
CopyAcceleratorTableW
CharUpperW
GetSysColorBrush
CharNextW
WaitMessage
ReleaseCapture
LoadCursorW
SetCapture
InflateRect
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
RegisterWindowMessageW
GetSystemMetrics
IsWindow
SetRectEmpty
GetPropW
RemovePropW
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetScrollPos
GetScrollPos
SetForegroundWindow
UpdateWindow
GetMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetScrollInfo
PtInRect
SetRect
GetClientRect
SendMessageW
GetWindowRect
GetDC
ReleaseDC
SetTimer
KillTimer
GetLastActivePopup
EnableWindow
DrawTextW
wsprintfW
CopyRect
MapDialogRect
LoadImageW
DestroyIcon
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuStringW
GetMenuState
PostQuitMessage
PostMessageW
CheckMenuItem
EnableMenuItem
ModifyMenuW
UnregisterClassA
DefWindowProcW
CallWindowProcW
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowTextLengthW
GetWindowTextW
SetFocus
ShowWindow
MoveWindow
SetWindowLongW
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
ScreenToClient
GrayStringW
DrawTextExW
TabbedTextOutW
FillRect
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
GetNextDlgTabItem
CreateIconIndirect
CopyIcon
DrawFocusRect
LookupIconIdFromDirectoryEx
EndDialog
GetWindow
SetWindowContextHelpId
CreateIconFromResourceEx
GetMenuDefaultItem
SetMenuDefaultItem
GetDoubleClickTime
SetClassLongW
SetWindowRgn
SetWindowPos
GetWindowThreadProcessId
GetWindowLongW
IsWindowEnabled
MessageBoxW
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
EnumWindows
SetWindowLongA
GetWindowLongA
IsWindowUnicode
DrawStateW
SendMessageTimeoutW
DrawEdge
DrawIconEx
GetIconInfo
LoadIconW

gdi32

SetBkColor
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps
GetObjectW
CreateFontIndirectW
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateCompatibleDC
SetBkMode
SelectPalette
GetObjectType
CreatePen
CreateSolidBrush
CreateRectRgnIndirect
CombineRgn
GetMapMode
PatBlt
GetBkColor
GetTextColor
GetRgnBox
GetTextExtentPoint32W
GetTextMetricsW
CreateCompatibleBitmap
StretchDIBits
GetStockObject
SetStretchBltMode
SetTextColor
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
DeleteObject
SelectClipRgn
GetClipRgn
CreateRectRgn
CreateBrushIndirect
StretchBlt
CreateDIBSection
OffsetRgn
GetTextCharsetInfo
CreatePalette
CreateDIBitmap
GetCurrentObject
GetBkMode
BeginPath
EndPath
StrokePath
EnumFontFamiliesExW
SetBrushOrgEx
GetDIBits
GetViewportExtEx
GetWindowExtEx
BitBlt
GetPixel
SelectObject
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyW
RegCloseKey
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW

comctl32

InitCommonControlsEx
_TrackMouseEvent
FlatSB_GetScrollProp
ImageList_GetIconSize
ImageList_GetBkColor
ImageList_GetImageInfo
ImageList_Destroy
ImageList_DrawIndirect

oledlg

OleUIBusyW

oleaut32

SysFreeString
SysAllocStringLen
VariantClear
VariantInit
SysStringLen
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
VariantCopy
SafeArrayDestroy
SysAllocString
OleLoadPicturePath

gdiplus

GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdiplusShutdown
GdipGetFamilyName
GdiplusStartup

imagehlp

ImageDirectoryEntryToData

winmm

PlaySoundW

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 552KB - Virtual size: 570KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 816KB - Virtual size: 812KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd3a5a2eae1146df1bf0621fda057486

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

2e:36:a3:31:c3:72:5d:a2:55:47:05:d6:eb:74:32:8bCertificate

Extended Key Usages

Key Usages

fd:06:3e:67:67:9f:ee:36:77:bc:91:5f:19:97:46:db:d4:73:48:a0Signer

Headers

File Characteristics

Imports

shlwapi

ole32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

oledlg

oleaut32

gdiplus

imagehlp

winmm

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 6.1MB - Virtual size: 6.1MB

.data Size: 552KB - Virtual size: 570KB

.rsrc Size: 816KB - Virtual size: 812KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

2e:36:a3:31:c3:72:5d:a2:55:47:05:d6:eb:74:32:8b
Certificate

fd:06:3e:67:67:9f:ee:36:77:bc:91:5f:19:97:46:db:d4:73:48:a0
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 6.1MB - Virtual size: 6.1MB

.data
Size: 552KB - Virtual size: 570KB

.rsrc
Size: 816KB - Virtual size: 812KB