DriveSort[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

DriveSort.exe
Size

198KB
MD5

c3d9ddd3e42e55eefdbe20d713a29d29
SHA1

3f6c7594f8edfcc95c796372e7329debfef9909d
SHA256

d65d499a7f52b92b4a8c7d3373d45b2c6e2a75fdfe6431f10b0d977bce3ac99b
SHA512

25756e97a1a64ef47717f031608a03243bf08cfd41572b6225803f5197b34278bb2c46c86bc92c3aa91b9264441a483876100637f4289b84d636bb73592dc34a
SSDEEP

3072:wXEtnx9TS9Y6Y0GIHHEwp7Jq8Czm2zRKsuEFzH1vXhr5rnvuWTwGs:wUtnSY0Fkwpw8Ca2zJuE55rnFTwGs

Score

1^/10

Malware Config

Signatures

Files

DriveSort.exe
.exe windows:5 windows x86 arch:x86

2372b8d5c96dc77194c1fac34773938e

Code Sign

72:60:08:aa
Certificate

Issuer

CN=Anerty,O=Anerty,L=Paris,C=FR

Not Before

26-12-2017 00:18

Not After

25-12-2020 00:18

Subject

CN=Anerty,O=Anerty,L=Paris,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:dc:b0:f2
Certificate

Issuer

CN=Anerty,O=Anerty,L=Paris,C=FR

Not Before

26-12-2017 00:20

Not After

25-12-2020 00:20

Subject

CN=Anerty,O=Anerty,L=Paris,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04-01-2017 00:00

Not After

18-01-2028 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:c4:1a:75:8f:50:2a:6a:54:48:14:0d:b7:e3:10:b1:b2:53:ce:bb:7e:6c:58:82:54:c5:80:3f:0c:ed:05:08
Signer

Actual PE Digest

39:c4:1a:75:8f:50:2a:6a:54:48:14:0d:b7:e3:10:b1:b2:53:ce:bb:7e:6c:58:82:54:c5:80:3f:0c:ed:05:08

Digest Algorithm

sha256

PE Digest Matches

true

f5:ff:b6:22:ed:4e:85:83:9b:7f:e6:42:26:90:49:cb:19:c7:4e:64
Signer

Actual PE Digest

f5:ff:b6:22:ed:4e:85:83:9b:7f:e6:42:26:90:49:cb:19:c7:4e:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

mfc140u

ord4974
ord4912
ord4927
ord4988
ord4502
ord5790
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord6877
ord11717
ord13703
ord5935
ord2682
ord12124
ord3941
ord3372
ord3371
ord3265
ord12168
ord7493
ord12131
ord6218
ord13752
ord2760
ord9210
ord12172
ord9040
ord11015
ord11396
ord10472
ord3404
ord3403
ord3164
ord458
ord6531
ord3697
ord6795
ord6559
ord6489
ord3882
ord2522
ord6566
ord6129
ord6220
ord13756
ord2761
ord1476
ord12220
ord7820
ord14137
ord1002
ord1133
ord6549
ord6316
ord501
ord6122
ord1464
ord7909
ord5816
ord6851
ord3833
ord13028
ord8817
ord4886
ord6486
ord1171
ord4884
ord3182
ord540
ord1405
ord3359
ord3237
ord6801
ord8746
ord4227
ord14377
ord2526
ord4885
ord3932
ord6607
ord2215
ord12601
ord11581
ord11278
ord11275
ord7787
ord11117
ord2680
ord12859
ord5024
ord5025
ord5029
ord5026
ord5027
ord13544
ord4477
ord4466
ord2865
ord6300
ord13469
ord14328
ord7504
ord6219
ord13754
ord8912
ord8920
ord12176
ord3173
ord9528
ord10504
ord1149
ord511
ord7137
ord12088
ord12123
ord9226
ord6876
ord10048
ord10047
ord11146
ord9011
ord11122
ord9526
ord9991
ord9986
ord9514
ord9524
ord9509
ord8304
ord1179
ord12262
ord1461
ord3262
ord6849
ord1066
ord1412
ord13963
ord928
ord9135
ord1446
ord4236
ord3257
ord6834
ord1182
ord1655
ord8505
ord551
ord8062
ord7891
ord5669
ord5222
ord13380
ord5813
ord13656
ord5850
ord13654
ord5837
ord1131
ord13961
ord484
ord4571
ord1465
ord13259
ord13965
ord987
ord1070
ord14416
ord1105
ord14056
ord3162
ord6526
ord9126
ord4219
ord3145
ord6490
ord7654
ord8345
ord1391
ord890
ord13293
ord4881
ord8365
ord8811
ord14047
ord13289
ord13086
ord13087
ord9130
ord1162
ord4223
ord3342
ord3175
ord6570
ord7509
ord9132
ord1180
ord4225
ord6589
ord1068
ord362
ord4171
ord4649
ord4882
ord5419
ord6865
ord7505
ord10402
ord11495
ord12081
ord9237
ord12102
ord4587
ord3843
ord12177
ord5369
ord11795
ord11800
ord9213
ord8209
ord1151
ord9352
ord8831
ord5955
ord11430
ord4495
ord2557
ord5938
ord13707
ord5939
ord13709
ord13700
ord5934
ord1788
ord12460
ord6130
ord5034
ord5019
ord8398
ord3174
ord514
ord7138
ord1447
ord968
ord7815
ord2010
ord9131
ord2753
ord14573
ord3874
ord2994
ord8745
ord4224
ord7027
ord3189
ord6588
ord8712
ord9128
ord3872
ord2993
ord8744
ord4222
ord3147
ord6497
ord13878
ord3266
ord9256
ord11002
ord6978
ord8965
ord14588
ord11936
ord3838
ord12089
ord9139
ord11726
ord11725
ord5652
ord10288
ord10284
ord10286
ord10287
ord10285
ord14785
ord8210
ord10255
ord3302
ord3305
ord3816
ord14405
ord2345
ord2223
ord5109
ord557
ord8511
ord1661
ord12697
ord6181
ord1188
ord954
ord8482
ord14451
ord948
ord1428
ord2172
ord2303
ord12611
ord13648
ord8072
ord8464
ord12584
ord12559
ord5117
ord13646
ord8067
ord8360
ord8756
ord8719
ord12884
ord4663
ord2996
ord1526
ord1653
ord975
ord2011
ord1451
ord286
ord5921
ord285
ord3009
ord14320
ord477
ord9209
ord10250
ord5763
ord12612
ord4092
ord1111
ord14234
ord953
ord6860
ord995
ord6348
ord14667
ord8000
ord12531
ord14466
ord1866
ord11983
ord11982
ord2034
ord7941
ord12947
ord4090
ord4152
ord9398
ord14595
ord7922
ord14589
ord12542
ord12541
ord2486
ord10144
ord10147
ord5357
ord8324
ord4589
ord12865
ord12928
ord10433
ord12247
ord8386
ord1472
ord7653
ord8470
ord12219
ord12251
ord8217
ord12239
ord5918
ord3852
ord8032
ord1687
ord1692
ord1689
ord4323
ord2562
ord4499
ord8219
ord5409
ord7712
ord7723
ord7722
ord5228
ord5411
ord5252
ord5525
ord9350
ord5760
ord5549
ord5249
ord2246
ord2304
ord265
ord929
ord12679
ord1888
ord2008
ord1413
ord2383
ord7121
ord481
ord14065
ord13832
ord2858
ord5609
ord6199
ord14490
ord9081
ord3857
ord10976
ord11024
ord11267
ord9197
ord12786
ord5577
ord12575
ord11252
ord8395
ord7655
ord2843
ord13352
ord2558
ord12418
ord12660
ord4703
ord9484
ord2718
ord12964
ord12093
ord1128
ord4138
ord4088
ord4942
ord14511
ord5377
ord4997
ord5013
ord4954
ord4960
ord4966
ord4948
ord5003
ord4936
ord5368
ord10431
ord1777
ord10251
ord10721
ord1756
ord11138
ord11139
ord9363
ord11743
ord9979
ord9212
ord10152
ord7501
ord5765
ord4814
ord4827
ord1770
ord1511
ord3849
ord266
ord14259
ord14261
ord1744
ord3846
ord2990
ord1525
ord1523
ord1045
ord280
ord296
ord4815
ord6349
ord1722
ord14668
ord6350
ord5033
ord12258
ord14669
ord6120
ord1513
ord2409

kernel32

DeviceIoControl
VirtualAlloc
InterlockedDecrement
CreateFileW
Sleep
CloseHandle
GetNativeSystemInfo
GetSystemInfo
SetFilePointerEx
InterlockedIncrement
GetVersionExW
WideCharToMultiByte
DosDateTimeToFileTime
FileTimeToDosDateTime
GetCurrentProcess
GetModuleHandleA
HeapSetInformation
GetProcAddress
SetFilePointer
GetTickCount
WaitForSingleObject
ResumeThread
DuplicateHandle
CreateEventW
SetEvent
WriteFile
GetLocalTime
GetModuleFileNameW
FormatMessageW
LocalFree
GetModuleHandleW
GetVolumeInformationW
GetLogicalDrives
SetErrorMode
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
VirtualFree
SetLastError
ReadFile
SystemTimeToFileTime
DeleteCriticalSection
GetCurrentProcessId
GetStartupInfoW
GetDiskFreeSpaceW
FileTimeToSystemTime
GetLastError
InitializeCriticalSectionAndSpinCount
ResetEvent
OutputDebugStringW
QueryPerformanceCounter

user32

FillRect
InvalidateRect
GetKeyState
CheckMenuRadioItem
GetMenu
GetSystemMetrics
CreatePopupMenu
CopyRect
GetDlgCtrlID
SetCapture
CheckMenuItem
GetClientRect
IsZoomed
AppendMenuW
GetDesktopWindow
EnableMenuItem
ReleaseCapture
IsIconic
GetNextDlgTabItem
LoadMenuW
GetWindowRect
ScreenToClient
GetSubMenu
SetCursor
DrawIconEx
GetForegroundWindow
KillTimer
GetParent
UnregisterDeviceNotification
SetForegroundWindow
GetCursorPos
DestroyIcon
GetSysColor
LoadImageW
EnableWindow
GetClassInfoW
LoadIconW
LoadStringW
PostMessageW
SendMessageW
ShowWindowAsync
SetWindowPos
MessageBoxA
FindWindowA
UpdateWindow
PeekMessageW
LoadCursorW
DrawFocusRect
SetTimer
GetIconInfo
ClientToScreen
IsWindow
OffsetRect

gdi32

SetBkMode
SetBkColor
SaveDC
RestoreDC
GetTextExtentPoint32W
ExtTextOutW
DeleteObject
CreateFontW
SetTextColor
CreateSolidBrush
CreatePen

shell32

ShellExecuteW

comctl32

FlatSB_SetScrollProp
FlatSB_EnableScrollBar
ImageList_ReplaceIcon
ImageList_GetImageCount
ImageList_AddMasked
FlatSB_ShowScrollBar

shlwapi

StrCmpLogicalW

wininet

InternetConnectW
InternetCloseHandle
InternetReadFile
HttpEndRequestW
HttpSendRequestExW
HttpQueryInfoW
InternetOpenW
InternetSetStatusCallbackW
HttpOpenRequestW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

vcruntime140

_except_handler4_common
wcsrchr
memchr
memcmp
memcpy
_purecall
memmove
__std_terminate
memset
__CxxFrameHandler3

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswscanf
__stdio_common_vsscanf
__p__commode
_set_fmode
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

malloc
realloc
free
_set_new_mode

api-ms-win-crt-math-l1-1-0

ceil
fabs
modf
__setusermatherr

api-ms-win-crt-string-l1-1-0

wcscmp
_wcsdup
_wcsicoll
wcsncpy_s
wcslen
towupper

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

_itow_s

api-ms-win-crt-runtime-l1-1-0

exit
_exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
_set_app_type
_get_wide_winmain_command_line
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_controlfp_s
_seh_filter_exe
_initialize_wide_environment
_initterm_e
_configure_wide_argv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2372b8d5c96dc77194c1fac34773938e

Code Sign

72:60:08:aaCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

4c:dc:b0:f2Certificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

39:c4:1a:75:8f:50:2a:6a:54:48:14:0d:b7:e3:10:b1:b2:53:ce:bb:7e:6c:58:82:54:c5:80:3f:0c:ed:05:08Signer

f5:ff:b6:22:ed:4e:85:83:9b:7f:e6:42:26:90:49:cb:19:c7:4e:64Signer

Headers

DLL Characteristics

File Characteristics

Imports

mfc140u

kernel32

user32

gdi32

shell32

comctl32

shlwapi

wininet

version

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 94KB - Virtual size: 93KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 35KB - Virtual size: 34KB

.reloc Size: 14KB - Virtual size: 14KB

72:60:08:aa
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

4c:dc:b0:f2
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

39:c4:1a:75:8f:50:2a:6a:54:48:14:0d:b7:e3:10:b1:b2:53:ce:bb:7e:6c:58:82:54:c5:80:3f:0c:ed:05:08
Signer

f5:ff:b6:22:ed:4e:85:83:9b:7f:e6:42:26:90:49:cb:19:c7:4e:64
Signer

.text
Size: 94KB - Virtual size: 93KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 35KB - Virtual size: 34KB

.reloc
Size: 14KB - Virtual size: 14KB