3a6ea4c5c42bcde056a5057a68c10d5c00717cb55c94a8676abc1052ea3f5f6e

Sharing

Copy URL Twitter E-mail

General

Target

3a6ea4c5c42bcde056a5057a68c10d5c00717cb55c94a8676abc1052ea3f5f6e
Size

764KB
MD5

9e04148780fa656567ca7d49b97a87d6
SHA1

ceff55784e9027284e7eca8b274fabe447571e5c
SHA256

3a6ea4c5c42bcde056a5057a68c10d5c00717cb55c94a8676abc1052ea3f5f6e
SHA512

2bd8f25b3661d7055d1b21c738343bef242b85f1ed672661a0944a70de32dee3afd7f82f1d0f995dc4d39aaf1a3cc2ad360dc7289b24ab831332cc24ad7345bf
SSDEEP

12288:YvY1R6YMV8fUQyqwTUcb5yFWTbnCxZrrKMRjj+KZld0qWdEwYTIh0TipXvDW55J6:YxxbnCxZHKMRjj+KZld0qW+wY0pvDWWH

Score

1^/10

Malware Config

Signatures

Files

3a6ea4c5c42bcde056a5057a68c10d5c00717cb55c94a8676abc1052ea3f5f6e
.exe windows:6 windows x86 arch:x86

9a8e2d8ce1198956b47ea825e86bbedc

Code Sign

05:2b:a8:f6:bf:67:58:8e:83:6e:2d:fd:1c:a8:9c:16
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/11/2017, 00:00

Not After

03/12/2020, 12:00

Subject

CN=Spotify AB,OU=Technology,O=Spotify AB,L=Stockholm,C=SE,1.2.840.113549.1.9.1=#0c1473656375726974794073706f746966792e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

90:76:cf:1e:b6:95:85:72:46:33:80:a1:8c:7c:22:5e:22:b0:08:9c
Signer

Actual PE Digest

90:76:cf:1e:b6:95:85:72:46:33:80:a1:8c:7c:22:5e:22:b0:08:9c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Y:\work\80d8bf0ac6046a03\shell\build\desktop\webhelper\Release\SpotifyWebHelper.pdb

Imports

shell32

SHGetFolderPathW
ShellExecuteW

ws2_32

htonl
WSACleanup
WSAStartup
WSAGetLastError
getaddrinfo
WSAStringToAddressW
accept
bind
closesocket
connect
getpeername
getsockname
listen
setsockopt
socket
freeaddrinfo
WSAEnumNetworkEvents
WSAEventSelect
WSARecv
WSASend
WSAWaitForMultipleEvents
htons
ntohl
WSASetLastError
WSAAddressToStringW

kernel32

EncodePointer
GetNativeSystemInfo
GetExitCodeThread
LoadLibraryExA
VirtualQuery
WriteConsoleW
HeapSize
SetStdHandle
Sleep
ExitProcess
GetCurrentThreadId
GetModuleHandleW
CreateEventA
CloseHandle
SetEvent
GetProcessHeap
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
OutputDebugStringW
GetStdHandle
WriteFile
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetConsoleMode
WriteConsoleA
VerSetConditionMask
CreateFileW
FlushFileBuffers
GetFileSizeEx
ReadFile
SetFilePointerEx
IsDebuggerPresent
RaiseException
GetLastError
GetModuleHandleA
GetProcAddress
LoadLibraryW
FormatMessageA
VerifyVersionInfoW
DecodePointer
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentProcessId
OpenEventA
WaitForSingleObjectEx
ResetEvent
MapViewOfFile
UnmapViewOfFile
OpenMutexA
OpenFileMappingA
WaitForSingleObject
TerminateProcess
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
LocalFree
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
SleepEx
CreateEventW
SetWaitableTimer
WaitForMultipleObjects
QueueUserAPC
TerminateThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InitializeCriticalSection
GetProcessTimes
GetCurrentProcess
GetSystemInfo
GetTickCount
WaitForMultipleObjectsEx
ReleaseSemaphore
CreateWaitableTimerW
ResumeThread
GetLogicalProcessorInformation
SystemTimeToFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
CompareStringW
FindClose
LCMapStringW
AreFileApisANSI
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetCurrentThread
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
GetConsoleCP
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetModuleFileNameA
HeapReAlloc
GetACP
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
FormatMessageW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
InterlockedPopEntrySList
VirtualFree
VirtualProtect
VirtualAlloc
InitializeCriticalSectionAndSpinCount
GetVersionExW
LoadLibraryExW
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetThreadPriority
SetThreadPriority
CreateThread
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetStartupInfoW
SetUnhandledExceptionFilter
DuplicateHandle
UnhandledExceptionFilter

user32

GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
DefWindowProcW
RegisterClassExW
CreateWindowExA
BringWindowToTop
SetTimer
KillTimer
GetForegroundWindow
SetForegroundWindow
GetWindowThreadProcessId
FindWindowA
AttachThreadInput

ole32

CoInitializeEx

advapi32

CryptEnumProvidersA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

Sections

.text
Size: 583KB - Virtual size: 582KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a8e2d8ce1198956b47ea825e86bbedc

Code Sign

05:2b:a8:f6:bf:67:58:8e:83:6e:2d:fd:1c:a8:9c:16Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

90:76:cf:1e:b6:95:85:72:46:33:80:a1:8c:7c:22:5e:22:b0:08:9cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

ws2_32

kernel32

user32

ole32

advapi32

wtsapi32

Sections

.text Size: 583KB - Virtual size: 582KB

.rdata Size: 140KB - Virtual size: 139KB

.data Size: 28KB - Virtual size: 33KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2KB - Virtual size: 2KB

05:2b:a8:f6:bf:67:58:8e:83:6e:2d:fd:1c:a8:9c:16
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

90:76:cf:1e:b6:95:85:72:46:33:80:a1:8c:7c:22:5e:22:b0:08:9c
Signer

.text
Size: 583KB - Virtual size: 582KB

.rdata
Size: 140KB - Virtual size: 139KB

.data
Size: 28KB - Virtual size: 33KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2KB - Virtual size: 2KB