414dafdae8a85e9163cfea1957c5c8df51a0fceb2e9b541fc693c341cc33c60e[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

414dafdae8a85e9163cfea1957c5c8df51a0fceb2e9b541fc693c341cc33c60e.exe
Size

655KB
MD5

b443db102f2ea685b50e1d32c2cc6650
SHA1

f7d20ef85d3644f3a55e5ff48708833cb8b3da6b
SHA256

414dafdae8a85e9163cfea1957c5c8df51a0fceb2e9b541fc693c341cc33c60e
SHA512

c535e6e6e506cf70cc246734e7e2d585d324b6ebb543b10419f3784f8a0965243a36dce71ffe6af2880174b4a89b37d5745dcb83f2542647ebd753b0772619b7
SSDEEP

12288:szT1Frjnckk2swagh0dg5/E64p0V0zGw80t0MTBjvrEH7wd:Mvjnckki0dq8t00rEH70

Score

1^/10

Malware Config

Signatures

Files

414dafdae8a85e9163cfea1957c5c8df51a0fceb2e9b541fc693c341cc33c60e.exe
.dll windows:5 windows x86 arch:x86

cb76f1e59efd09a929789fff83abfab4

Code Sign

09:f6:f0:84:76:4b:3f:f5:68:6b:21:3d:91:d8:ab:64
Certificate

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-10-2017 00:00

Not After

29-11-2019 12:00

Subject

CN=Letasoft LLC,O=Letasoft LLC,L=Surrey,ST=British Columbia,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:8e:a7:40:ab:c6:bd:59:3a:ab:9c:a3:32:9c:e1:b4
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-10-2017 00:00

Not After

29-11-2019 12:00

Subject

CN=Letasoft LLC,O=Letasoft LLC,L=Surrey,ST=British Columbia,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04-01-2017 00:00

Not After

18-01-2028 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

75:e8:f0:f6:e6:2d:6e:53:6c:a6:46:d8:24:b2:ed:f9:59:bf:5f:f0:a5:bf:b7:df:45:40:e3:11:85:6e:cc:ba
Signer

Actual PE Digest

75:e8:f0:f6:e6:2d:6e:53:6c:a6:46:d8:24:b2:ed:f9:59:bf:5f:f0:a5:bf:b7:df:45:40:e3:11:85:6e:cc:ba

Digest Algorithm

sha256

PE Digest Matches

false

1c:32:62:91:fa:66:e8:a0:89:61:a0:3c:0f:1b:ce:61:9b:65:78:ff
Signer

Actual PE Digest

1c:32:62:91:fa:66:e8:a0:89:61:a0:3c:0f:1b:ce:61:9b:65:78:ff

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

timeBeginPeriod
timeGetTime

shlwapi

PathAppendW
PathFindFileNameW

kernel32

WaitForSingleObject
ReleaseMutex
ResetEvent
SetEvent
WaitForMultipleObjects
CloseHandle
UnmapViewOfFile
CreateThread
ReadFile
WriteFile
FlushFileBuffers
InitializeCriticalSection
DeleteCriticalSection
CreateFileW
WaitNamedPipeW
SetNamedPipeHandleState
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryW
GetModuleHandleExW
GetModuleFileNameW
GetCurrentThreadId
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualFree
Sleep
GetCurrentProcess
VirtualProtectEx
FlushInstructionCache
QueryPerformanceFrequency
QueryPerformanceCounter
WideCharToMultiByte
GetACP
OpenProcess
GetSystemTimeAsFileTime
lstrcmpiW
GetTickCount
GetProcessTimes
CreateProcessW
InterlockedExchange
InterlockedCompareExchange
GetFileAttributesW
GetFileAttributesExW
GetCurrentDirectoryW
SetCurrentDirectoryW
FindClose
FindFirstFileW
FindNextFileW
InterlockedDecrement
InterlockedIncrement
InterlockedExchangeAdd
LocalAlloc
LocalFree
DecodePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindNextFileA
FindFirstFileExA
GetOEMCP
IsValidCodePage
GetCPInfo
HeapReAlloc
GetStringTypeW
OpenEventW
OpenMutexW
OpenFileMappingW
GetCurrentProcessId
MapViewOfFile
CreateEventW
CreateMutexW
GetLastError
CreateFileMappingW
lstrcpyW
lstrlenW
GetProcessHeap
SetStdHandle
SetFilePointerEx
HeapSize
lstrcpynW
GetVersionExW
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
EncodePointer
RaiseException
InterlockedFlushSList
SetLastError
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameA
WriteConsoleW
MultiByteToWideChar
ExitProcess
HeapFree
HeapAlloc
OutputDebugStringW

user32

CallNextHookEx
GetParent
IsWindow
GetWindowLongW
SetWindowLongW
DestroyWindow
UnregisterClassW
CreateWindowExW
RegisterClassExW
DefWindowProcW
UnhookWindowsHookEx
SetWindowsHookExW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CoCreateInstance
CoUninitialize
StringFromGUID2
CoTaskMemFree
CoInitialize

netapi32

NetApiBufferFree
NetWkstaGetInfo

Exports

Exports

KLHGetManager

Sections

.text
Size: 301KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 150KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 356B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb76f1e59efd09a929789fff83abfab4

Code Sign

09:f6:f0:84:76:4b:3f:f5:68:6b:21:3d:91:d8:ab:64Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5fCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

07:8e:a7:40:ab:c6:bd:59:3a:ab:9c:a3:32:9c:e1:b4Certificate

Extended Key Usages

Key Usages

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9Certificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

75:e8:f0:f6:e6:2d:6e:53:6c:a6:46:d8:24:b2:ed:f9:59:bf:5f:f0:a5:bf:b7:df:45:40:e3:11:85:6e:cc:baSigner

1c:32:62:91:fa:66:e8:a0:89:61:a0:3c:0f:1b:ce:61:9b:65:78:ffSigner

Headers

DLL Characteristics

File Characteristics

Imports

winmm

shlwapi

kernel32

user32

advapi32

ole32

netapi32

Exports

Exports

Sections

.text Size: 301KB - Virtual size: 300KB

.rdata Size: 91KB - Virtual size: 90KB

.data Size: 150KB - Virtual size: 155KB

.gfids Size: 512B - Virtual size: 356B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 18KB - Virtual size: 18KB

09:f6:f0:84:76:4b:3f:f5:68:6b:21:3d:91:d8:ab:64
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

07:8e:a7:40:ab:c6:bd:59:3a:ab:9c:a3:32:9c:e1:b4
Certificate

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

75:e8:f0:f6:e6:2d:6e:53:6c:a6:46:d8:24:b2:ed:f9:59:bf:5f:f0:a5:bf:b7:df:45:40:e3:11:85:6e:cc:ba
Signer

1c:32:62:91:fa:66:e8:a0:89:61:a0:3c:0f:1b:ce:61:9b:65:78:ff
Signer

.text
Size: 301KB - Virtual size: 300KB

.rdata
Size: 91KB - Virtual size: 90KB

.data
Size: 150KB - Virtual size: 155KB

.gfids
Size: 512B - Virtual size: 356B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 18KB - Virtual size: 18KB