FluddyChecker-nwNJiUMI[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

FluddyChecker-nwNJiUMI.exe
Size

17.3MB
MD5

04e90d781e3e34036e6d313853a9394e
SHA1

a48717377819a1910af45bf895830afbe24a4cb1
SHA256

97472e35d103e940b4bf33f530adc81d216888d8c572caa920f07d055efd16d8
SHA512

a6209549d97e1b72e93f6ab61b3dd4441a9e9e6bd80cbfab82206359ac3a045e318ca698cbd7831c247f14577016df849ec53a7c01f6d5d2d9ca3bb6a8127b90
SSDEEP

196608:G6E+ovguZqRF2xkCsSd093sHEcjF/G/wziCSbE47zrllO7LKgtO5Mt8ezI:G6E1guZqRIC1lsHEqGoeC94RlO7dChD

Score

1^/10

Malware Config

Signatures

Files

FluddyChecker-nwNJiUMI.exe
.exe windows:6 windows x64 arch:x64

8a60b72c4f4fcf3027027a189b663429

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3f:50:ac:af:ed:b7:df:43:f1:ed:41:6a
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

13-12-2023 10:11

Not After

13-12-2024 10:11

Subject

SERIALNUMBER=323784700315658,CN=IP Hanin German Evgenevich,O=IP Hanin German Evgenevich,L=Saint Petersburg,ST=Saint Petersburg,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13105361696e742050657465727362757267,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07-11-2023 17:13

Not After

09-12-2034 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10-12-2014 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f4:23:ce:d6:f0:77:27:cc:c7:d4:99:71:05:2e:cb:0a:b3:38:78:3c:69:f3:75:0e:97:2e:af:b3:fa:a3:2e:bd
Signer

Actual PE Digest

f4:23:ce:d6:f0:77:27:cc:c7:d4:99:71:05:2e:cb:0a:b3:38:78:3c:69:f3:75:0e:97:2e:af:b3:fa:a3:2e:bd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetVersionExA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

GetClientRect

gdi32

CreateCompatibleBitmap

advapi32

CryptAcquireContextW

shell32

SHGetPathFromIDListW

ole32

CreateStreamOnHGlobal

ws2_32

setsockopt

shlwapi

PathMatchSpecExA

imm32

ImmSetCompositionWindow

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

wtsapi32

WTSFreeMemory

d3d11

D3D11CreateDeviceAndSwapChain

gdiplus

GdipCloneImage

crypt32

CryptQueryObject

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 654KB - Virtual size: 692KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.}Z4
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.TdM
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

..^|
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8a60b72c4f4fcf3027027a189b663429

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

3f:50:ac:af:ed:b7:df:43:f1:ed:41:6aCertificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

f4:23:ce:d6:f0:77:27:cc:c7:d4:99:71:05:2e:cb:0a:b3:38:78:3c:69:f3:75:0e:97:2e:af:b3:fa:a3:2e:bdSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

ws2_32

shlwapi

imm32

d3dx11_43

d3dcompiler_43

dwmapi

wtsapi32

d3d11

gdiplus

crypt32

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 654KB - Virtual size: 692KB

.pdata Size: 119KB - Virtual size: 119KB

_RDATA Size: 512B - Virtual size: 500B

.}Z4 Size: 6.0MB - Virtual size: 6.0MB

.TdM Size: 4KB - Virtual size: 4KB

..^| Size: 5.5MB - Virtual size: 5.5MB

.rsrc Size: 17KB - Virtual size: 17KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

3f:50:ac:af:ed:b7:df:43:f1:ed:41:6a
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

f4:23:ce:d6:f0:77:27:cc:c7:d4:99:71:05:2e:cb:0a:b3:38:78:3c:69:f3:75:0e:97:2e:af:b3:fa:a3:2e:bd
Signer

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 654KB - Virtual size: 692KB

.pdata
Size: 119KB - Virtual size: 119KB

_RDATA
Size: 512B - Virtual size: 500B

.}Z4
Size: 6.0MB - Virtual size: 6.0MB

.TdM
Size: 4KB - Virtual size: 4KB

..^|
Size: 5.5MB - Virtual size: 5.5MB

.rsrc
Size: 17KB - Virtual size: 17KB