Cold Turkey Blocker Pro 3.10.zip
- SHA256 95e20f1bd143d295e3aa4279d8e3d1ed1e4a6dd83e148c6abdca49890190d38c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Cold Turkey Blocker Pro 3.10/CTBActivator/Activator.exe
Resource
win7-20240215-en
windows7-x64
29 signatures
300 seconds
Behavioral task
behavioral2
Sample
Cold Turkey Blocker Pro 3.10/CTBActivator/Activator.exe
Resource
win11-20240419-en
windows11-21h2-x64
8 signatures
300 seconds
Behavioral task
behavioral3
Sample
Cold Turkey Blocker Pro 3.10/Cold_Turkey_Installer.exe
Resource
win7-20240419-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
Cold Turkey Blocker Pro 3.10/Cold_Turkey_Installer.exe
Resource
win11-20240426-en
windows11-21h2-x64
2 signatures
300 seconds
General
- Target Cold Turkey Blocker Pro 3.10.zip
- Size 59.3MB
- Sample240430-237j2aaa3y
- SHA256 95e20f1bd143d295e3aa4279d8e3d1ed1e4a6dd83e148c6abdca49890190d38c
- MD5 f8da838bfacf71500e5b63ce7258d32b
- SHA1 9a99b9dc6011704622200be20bf3c321dbc9f346
- SHA512 b7fc5b5c60784086e733713a4c12d7e4d5cc9b6077d21138c1817bb7edbe3997b3acec4d119a5e65f77a9ad5947f66032f7cd114812b4fbb9c20ac36353dfc93
- SSDEEP 1572864:tu+kdWDfXmupHSNO9x4vUfHIoC6z9+piLZG/Ttiep:gIaw9x4mHICz9+fTt3p
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Cold Turkey Blocker Pro 3.10/CTBActivator/Activator.exe
File Explorer
-
Cold Turkey Blocker Pro 3.10.zip.zip 59.3MB
-
Cold Turkey Blocker Pro 3.10/CTBActivator/Activator.exe.exe 7.8MB
-
Cold Turkey Blocker Pro 3.10/CTBActivator/readme.txt2KB
-
Cold Turkey Blocker Pro 3.10/Cold_Turkey_Installer.exe.exe 55.9MB
-
Cold Turkey Blocker Pro 3.10/Instructions.txt146B
Cold Turkey Blocker Pro 3.10/CTBActivator/Activator.exe
- IMPHASH 06ac1f21ee2a357ffb0dd7db52cbbb13
- SHA256 b9ef692ccc85d8d010ab568f80622ded90813885f459cfe5b47175f5c854a236
- MD5 49e0ff5b272c2e4edc2b45a71d1dc3a0
- SHA1 89faa62ed4fdca507024e3b4368cf294545aee49
- SHA512 d29c2dc8fde21ab8f480342b1542f0199d0cb94d9bc31a7e7450e4874f046f62b1dd6bf0913b87429af1ac6e476c2b55fb79af62af144e779b57f51442a30901
- SSDEEP 98304:u3q35gz3xycD3d6wkq6PnYsnmGug3KEA4pdyEsQ:Fgz3xP6wkjPnmG9jb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncpy
_strnicmp
strncmp
strlen
strcmp
memmove
memcpy
sprintf
kernel32
GetModuleHandleA
HeapCreate
RemoveDirectoryA
GetShortPathNameA
HeapDestroy
ExitProcess
GetTempFileNameA
FindResourceA
LoadResource
SizeofResource
GetExitCodeProcess
HeapFree
HeapAlloc
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
InitializeCriticalSection
GetCommandLineA
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
CloseHandle
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
GetVersionExA
Sleep
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
SetLastError
GetCurrentDirectoryA
SetCurrentDirectoryA
DeleteFileA
GetTempPathA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
comctl32
InitCommonControls
InitCommonControlsEx
user32
MessageBoxA
SendMessageA
GetWindowThreadProcessId
IsWindowVisible
IsWindowEnabled
GetForegroundWindow
EnableWindow
EnumWindows
DestroyWindow
GetSysColor
GetSysColorBrush
CreateWindowExA
GetWindowLongA
PostMessageA
CallWindowProcA
SetWindowLongA
SetFocus
GetWindowTextLengthA
GetWindowTextA
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRect
GetSystemMetrics
GetActiveWindow
GetWindowRect
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
SetCursorPos
LoadImageA
SetCursor
MapWindowPoints
MoveWindow
SystemParametersInfoA
GetKeyState
SetCapture
GetCursorPos
ReleaseCapture
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetFocus
IsChild
GetClassNameA
gdi32
GetStockObject
SetBkColor
SetTextColor
CreateSolidBrush
DeleteObject
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
shlwapi
PathQuoteSpacesA
Name
.code
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7.8MB
Virtual Size
7.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Cold Turkey Blocker Pro 3.10/CTBActivator/readme.txt
- SHA256 6d5b1dfbc04b77927c7d3995776171240627e8107f3a6008f5c46e678c07fb31
- MD5 b248d1c496bd747bcc51251527b0ede2
- SHA1 066bd56e9510412bbbc482a5e795d38b93d50b37
- SHA512 5554d750c4efeea6f7bb2f45bce2e4c3bd84ed2627ceac2d67775553f5b15c8ceaa99490a6c83b71a4559c7600abb9e6cbfa743cf4bde946e8f7b2be6c3d425a
- MD5 SHA1 SHA512
Cold Turkey Blocker Pro 3.10/Cold_Turkey_Installer.exe
- IMPHASH 20dd26497880c05caed9305b3c8b9109
- SHA256 91fbb470a8fd8dfb3df4f8deb007cacd4942eb2fc7472ec182ef17a3e66ebbff
- MD5 78b909d37b3033ad4a6e9a58ab5fcea2
- SHA1 b58335f022de47b3a6ecb9d627056b5eb648a4c5
- SHA512 ac2eb803b9236e2c30984ca1a51d7e5338bf6a6fb3cf0b8d3849471ec1433d656a45258fe42ade1c9e303a1ce8bc5528d070f9bff9489cce130ed257be4d921b
- SSDEEP 1572864:YwG0VcRVVc6z7gzw/b8/olZgyA0df8h09BCvW:JoG6/b8uZgIdf8RW
- MD5 SHA1 SHA512 SSDEEP
Digest
5d:4f:c1:be:56:d9:15:73:aa:f9:19:4b:24:24:b2:07:70:52:50:e1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=979342-9,CN=Cold Turkey Software\, Inc.,O=Cold Turkey Software\, Inc.,L=Belleville,ST=Ontario,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
Chains
Jun 17, 2019
SERIALNUMBER=979342-9,CN=Cold Turkey Software\, Inc.,O=Cold Turkey Software\, Inc.,L=Belleville,ST=Ontario,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
SERIALNUMBER=979342-9,CN=Cold Turkey Software\, Inc.,O=Cold Turkey Software\, Inc.,L=Belleville,ST=Ontario,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
Serial Number
06:e0:9b:d2:6a:e5:b6:aa:86:29:24:4a:3a:75:4f:3b
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 15, 2019 - Mar 18, 2022
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
5
Entry point
71644
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
user32
GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
TranslateMessage
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
ExitWindowsEx
DispatchMessageW
DestroyWindow
CharUpperBuffW
CallWindowProcW
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
SignalObjectAndWait
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LoadLibraryW
GetWindowsDirectoryW
GetVersionExW
GetVersion
GetUserDefaultLangID
GetThreadLocale
GetSystemInfo
GetSystemDirectoryW
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
DeleteFileW
CreateProcessW
CreateFileW
CreateEventW
CreateDirectoryW
CloseHandle
Sleep
comctl32
InitCommonControls
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
21KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
313KB
Virtual Size
313KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Cold Turkey Blocker Pro 3.10/Instructions.txt
- SHA256 5f74d755ae5cb441df6c7142e2b294dd4b28d9bb59f76ffee7f47b6427d79b63
- MD5 1fe95db5eb2ea6a5e5f3abb866ad8871
- SHA1 dd0f7d8292938859178c9e2112c2a437d34c9e11
- SHA512 c4b22b51299679747df82e25a617a03ad74d1ed862b21f537ad6ab9bb95df1965590b52df82f4dddaa9a46c69043145c752f042e004d29f4ad7742a2da9de8c7
- MD5 SHA1 SHA512