notmyfaultc[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

notmyfaultc.exe
Size

239KB
MD5

e7c5eb12fbbb0e0e2e73a23563cfa97f
SHA1

0a5e8ccdded4c6ba2106c65dd94a54c1955b4ba3
SHA256

a2d85d0c94b48e0860b8adeb25ddd262739b9e59696eeb22f91eec3905faa8a0
SHA512

69292e5b8a594ea89ffa5fa4d1f8869bd7d42d8a1118dae06adaae54f67b70c7e8f5c031632bc588594f6813b2196c964f9aea93327f0e51313011fa8f9d4866
SSDEEP

3072:kpUn4hlBOaOeyCFtnGHw7ZUF/TzNwDmcLTCrOxdZJ+XXknfpnD4RKcZEGvAEYn:kfTRnJu/Q4CjO0f54X8n

Score

1^/10

Malware Config

Signatures

Files

notmyfaultc.exe
.exe windows:5 windows x86 arch:x86

f3f6010a333ae8438f8af32c11089edc

Code Sign

33:00:00:00:ac:63:16:e7:e3:46:55:b3:1c:00:00:00:00:00:ac
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/05/2016, 17:13

Not After

03/08/2017, 17:13

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2016, 20:17

Not After

02/11/2017, 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:63:1f:d7:df:ca:d9:5f:83:e2:a8:53:1b:dd:ce:d6:d1:3e:28:87:04:64:91:24:61:14:5c:67:44:35:3e:ce
Signer

Actual PE Digest

bd:63:1f:d7:df:ca:d9:5f:83:e2:a8:53:1b:dd:ce:d6:d1:3e:28:87:04:64:91:24:61:14:5c:67:44:35:3e:ce

Digest Algorithm

sha256

PE Digest Matches

true

d9:af:69:44:34:28:19:c6:2a:af:f4:1b:e2:c7:26:3e:8b:54:dc:41
Signer

Actual PE Digest

d9:af:69:44:34:28:19:c6:2a:af:f4:1b:e2:c7:26:3e:8b:54:dc:41

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA

kernel32

SizeofResource
DeviceIoControl
GetSystemInfo
GetTickCount
FormatMessageA
GetEnvironmentVariableA
FindResourceA
SetFileAttributesA
DeleteFileA
LoadResource
GetStringTypeW
OutputDebugStringW
ReadConsoleW
WriteConsoleW
SetFilePointerEx
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
Sleep
LockResource
CreateFileA
CloseHandle
GetLastError
GetCommandLineW
GetVersion
LoadLibraryA
GetModuleHandleA
GetStdHandle
LocalFree
LocalAlloc
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
GetFileType
LCMapStringW
HeapSize
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
SetEndOfFile
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
CreateThread
ExitThread
ResumeThread
GetCommandLineA
DeleteCriticalSection
FlushFileBuffers
WriteFile
GetConsoleCP
IsDebuggerPresent
IsProcessorFeaturePresent
ReadFile
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetProcessHeap
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
LoadLibraryExW
CreateFileW
RtlUnwind
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime

user32

wsprintfA
LoadCursorA
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextA
GetDlgItem
EndDialog
DialogBoxIndirectParamA
SendMessageA

gdi32

StartPage
EndDoc
StartDocA
SetMapMode
GetDeviceCaps
EndPage

comdlg32

PrintDlgA

advapi32

OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
StartServiceA

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3f6010a333ae8438f8af32c11089edc

Code Sign

33:00:00:00:ac:63:16:e7:e3:46:55:b3:1c:00:00:00:00:00:acCertificate

Extended Key Usages

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

bd:63:1f:d7:df:ca:d9:5f:83:e2:a8:53:1b:dd:ce:d6:d1:3e:28:87:04:64:91:24:61:14:5c:67:44:35:3e:ceSigner

d9:af:69:44:34:28:19:c6:2a:af:f4:1b:e2:c7:26:3e:8b:54:dc:41Signer

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

comdlg32

advapi32

Sections

.text Size: 77KB - Virtual size: 77KB

.rdata Size: 47KB - Virtual size: 47KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 93KB - Virtual size: 92KB

33:00:00:00:ac:63:16:e7:e3:46:55:b3:1c:00:00:00:00:00:ac
Certificate

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

bd:63:1f:d7:df:ca:d9:5f:83:e2:a8:53:1b:dd:ce:d6:d1:3e:28:87:04:64:91:24:61:14:5c:67:44:35:3e:ce
Signer

d9:af:69:44:34:28:19:c6:2a:af:f4:1b:e2:c7:26:3e:8b:54:dc:41
Signer

.text
Size: 77KB - Virtual size: 77KB

.rdata
Size: 47KB - Virtual size: 47KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 93KB - Virtual size: 92KB