d4bb33434ad2cd488f6fed6704b50c19c085bf774aed2d137379d454c5f1b561

Sharing

Copy URL Twitter E-mail

General

Target

d4bb33434ad2cd488f6fed6704b50c19c085bf774aed2d137379d454c5f1b561
Size

1.4MB
MD5

fe5af3ebb1673514f25b2b3a004cce6f
SHA1

a4d63a265058529478a59a8d51e3b7b8fd4dba2e
SHA256

d4bb33434ad2cd488f6fed6704b50c19c085bf774aed2d137379d454c5f1b561
SHA512

022da5c4b1d0b08d058d3f3f43eb8688c4f4eda87eb67369e92198ad9232c475a8837d03289e90280a258e112e7002b24cc63b8a9ee574bcb30880b6ffe522a4
SSDEEP

24576:mRGVunWx0WS1Qeq3Q/rkqK09fqw8rUPopzFv73OZNBl2gTiXcOO:mIMn1XDkjAfYrUPUhvsl2gTiMOO

Score

1^/10

Malware Config

Signatures

Files

d4bb33434ad2cd488f6fed6704b50c19c085bf774aed2d137379d454c5f1b561
.exe windows:5 windows x86 arch:x86

f821ddc2c48e9cad70f8c9e961dd2649

Code Sign

ff:f7:ca:8b:5e:ea:fd:32:e4:de:3b:6c:44:f5:11:93
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

10/07/2020, 00:00

Not After

10/07/2023, 23:59

Subject

CN=GLAVSOFT\, OOO,O=GLAVSOFT\, OOO,POSTALCODE=634021,STREET=d. 132 kv. 82\, ul. Altaiskaya,L=Tomsk,ST=Tomskaya oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a4:46:66:81:9a:86:53:fe:79:76:00:f8:9b:d5:82:fb:01:4a:82:86
Signer

Actual PE Digest

a4:46:66:81:9a:86:53:fe:79:76:00:f8:9b:d5:82:fb:01:4a:82:86

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Y:\build\tightvnc-2.8.81-gpl\Release\tvnserver.pdb

Imports

winmm

timeEndPeriod
timeBeginPeriod

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

kernel32

RemoveDirectoryW
FindClose
MoveFileW
SetFileTime
CreateDirectoryW
GetLogicalDriveStringsW
SetErrorMode
FindFirstFileW
GetFileSizeEx
GetProcessTimes
GetLocalTime
SystemTimeToFileTime
FileTimeToSystemTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleHandleA
HeapReAlloc
VirtualAlloc
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapAlloc
GetTickCount
VirtualFree
HeapCreate
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapSize
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapFree
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GlobalUnlock
GlobalAlloc
GlobalLock
DisconnectNamedPipe
LocalAlloc
ReadFile
WriteFile
ConnectNamedPipe
GetOverlappedResult
CreateNamedPipeW
DuplicateHandle
CreateProcessW
GetExitCodeProcess
WaitForMultipleObjects
TerminateProcess
GetProcAddress
LoadLibraryW
FreeLibrary
GetModuleFileNameW
GetVersionExW
GetComputerNameW
SetEvent
CreateEventW
FormatMessageW
LocalFree
CreateThread
SwitchToThread
DeleteFileW
ResumeThread
CreateMutexW
GetLastError
ReleaseMutex
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetModuleHandleW
ProcessIdToSessionId
Sleep
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
CreateFileW
GetCurrentProcess
SetUnhandledExceptionFilter
FindResourceW
LoadResource
LockResource
FreeResource
SetHandleInformation
CreatePipe
SetNamedPipeHandleState
CreateFileMappingW
MapViewOfFile
OpenThread
UnmapViewOfFile
FreeEnvironmentStringsW
OpenProcess
FindNextFileW

user32

ToUnicodeEx
GetKeyState
MapVirtualKeyW
GetKeyboardLayout
ReleaseDC
GetClientRect
DestroyIcon
UnregisterClassW
EnumChildWindows
MapWindowPoints
MoveWindow
VkKeyScanExW
MessageBoxW
LoadIconW
EnumDisplayMonitors
TrackPopupMenu
GetSubMenu
LoadMenuW
GetCursorPos
RemoveMenu
SetMenuDefaultItem
EnumDisplayDevicesW
ChangeDisplaySettingsExW
DrawIconEx
GetIconInfo
GetCursorInfo
EnumWindows
IsWindowVisible
GetWindowInfo
FindWindowExW
GetClassNameW
GetDC
CloseClipboard
IsClipboardFormatAvailable
GetClipboardData
EmptyClipboard
ChangeClipboardChain
OpenClipboard
SetClipboardData
SetClipboardViewer
CallNextHookEx
WaitMessage
PeekMessageW
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
GetWindowRect
SendInput
GetSystemMetrics
GetWindowThreadProcessId
GetWindow
SystemParametersInfoW
FindWindowW
ExitWindowsEx
LockWorkStation
OpenWindowStationW
SetProcessWindowStation
CloseWindowStation
GetMessageW
TranslateMessage
DispatchMessageW
IsDialogMessageW
RegisterClassW
DefWindowProcW
PostQuitMessage
PostMessageW
CreateWindowExW
GetThreadDesktop
GetUserObjectInformationW
SetThreadDesktop
CloseDesktop
OpenDesktopW
OpenInputDesktop
SetForegroundWindow
SetFocus
GetForegroundWindow
InvalidateRect
GetWindowTextW
ShowWindow
SetWindowTextW
DestroyWindow
DialogBoxParamW
GetWindowLongW
SetClassLongW
SetWindowLongW
EndDialog
CreateDialogParamW
IsWindow
SendMessageW
SetTimer
KillTimer
GetDlgItem
RegisterWindowMessageW

gdi32

GetCurrentObject
ExtEscape
CreateDCW
GetBitmapBits
GetObjectW
BitBlt
DeleteDC
CreateDIBSection
SelectObject
CreateCompatibleDC
DeleteObject
GetDIBits

advapi32

ChangeServiceConfig2W
ImpersonateLoggedOnUser
DuplicateToken
ConvertStringSidToSidW
CopySid
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ImpersonateNamedPipeClient
RevertToSelf
SetTokenInformation
GetTokenInformation
LookupAccountSidW
OpenThreadToken
DuplicateTokenEx
OpenProcessToken
CreateProcessAsUserW
DeleteService
ControlService
OpenServiceW
StartServiceW
QueryServiceStatusEx
CreateServiceW
CloseServiceHandle
OpenSCManagerW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegCreateKeyExW
RegCreateKeyW
RegCloseKey
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
SetSecurityInfo
ReportEventW
DeregisterEventSource
RegisterEventSourceW

shell32

ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
CommandLineToArgvW
ord680
Shell_NotifyIconW

ws2_32

setsockopt
recv
send
select
__WSAFDIsSet
accept
closesocket
getsockname
getpeername
listen
shutdown
connect
socket
htons
ntohl
ntohs
gethostname
gethostbyname
inet_ntoa
inet_addr
htonl
WSACleanup
WSAStartup
WSAGetLastError
bind
ioctlsocket

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 746KB - Virtual size: 746KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 564KB - Virtual size: 563KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f821ddc2c48e9cad70f8c9e961dd2649

Code Sign

ff:f7:ca:8b:5e:ea:fd:32:e4:de:3b:6c:44:f5:11:93Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

a4:46:66:81:9a:86:53:fe:79:76:00:f8:9b:d5:82:fb:01:4a:82:86Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winmm

psapi

kernel32

user32

gdi32

advapi32

shell32

ws2_32

comctl32

version

Sections

.text Size: 746KB - Virtual size: 746KB

.rdata Size: 564KB - Virtual size: 563KB

.data Size: 23KB - Virtual size: 30KB

.rsrc Size: 43KB - Virtual size: 43KB

.reloc Size: 52KB - Virtual size: 51KB

ff:f7:ca:8b:5e:ea:fd:32:e4:de:3b:6c:44:f5:11:93
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

a4:46:66:81:9a:86:53:fe:79:76:00:f8:9b:d5:82:fb:01:4a:82:86
Signer

.text
Size: 746KB - Virtual size: 746KB

.rdata
Size: 564KB - Virtual size: 563KB

.data
Size: 23KB - Virtual size: 30KB

.rsrc
Size: 43KB - Virtual size: 43KB

.reloc
Size: 52KB - Virtual size: 51KB