audiorepeater_ks[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

audiorepeater_ks.exe
Size

91KB
MD5

9601b7cf8b7a736853d17d959e57296d
SHA1

e72b6ceb6f6a2909780abe23d7833fa8205cdbb1
SHA256

b39051116d382de7f586bad900da719842eefce7af28b675fd86b51aa63b7779
SHA512

104c41173a6a9176031022773e83c421a38f19810ed79f3e67948c3698217835602fde8bfbf223a854c698485ffe4a997bbe8549bd61cdbb45a2d2b81a4a01b1
SSDEEP

1536:xqNYqSAywLIzIcqCXqySd2tNQGeat2aq08VsIOzj0Mb0f:aviIcl6zcbQDa7q02yjDb0f

Score

1^/10

Malware Config

Signatures

Files

audiorepeater_ks.exe
.exe windows:6 windows x86 arch:x86

c42cf8a9066c61359281e56eb3fb6b68

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

26/05/2020, 12:18

Not After

26/08/2023, 12:18

Subject

SERIALNUMBER=316547600105556,CN=Muzychenko Evgenii Viktorovich\, IP,O=Muzychenko Evgenii Viktorovich\, IP,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c17736f667477617265406d757a796368656e6b6f2e6e6574,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bd:55:9c:d1:cb:50:2f:ad:be:27:d8:be:4f:1e:29:37:3e:cb:ec:cd:fb:24:53:df:80:54:62:0c:ff:bf:8f:fb
Signer

Actual PE Digest

bd:55:9c:d1:cb:50:2f:ad:be:27:d8:be:4f:1e:29:37:3e:cb:ec:cd:fb:24:53:df:80:54:62:0c:ff:bf:8f:fb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

s:\music\software\win\audiorepeater\1xxks\objfre_wxp_x86\i386\audiorepeater_ks.pdb

Imports

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW

kernel32

Sleep
SetWaitableTimer
SetThreadPriority
GetCurrentThread
CreateWaitableTimerW
CreateEventW
RtlFillMemory
WaitForSingleObject
CreateThread
SetPriorityClass
GetStartupInfoW
CreateFileW
OpenProcess
GetCurrentProcessId
WaitForMultipleObjects
GetProcAddress
QueryPerformanceFrequency
GetModuleFileNameW
GetModuleHandleW
lstrlenA
lstrlenW
lstrcmpiW
GetLastError
WriteFile
GetACP
ReadFile
GetFileSizeEx
FreeLibrary
DeviceIoControl
CloseHandle
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
LoadLibraryW
GetOverlappedResult
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryA
HeapFree
GetProcessHeap
HeapAlloc
GetVersionExW
GetSystemInfo
RtlMoveMemory
FormatMessageW
GetCommandLineW
ExitProcess
SetUnhandledExceptionFilter
SetEvent
RtlZeroMemory
QueryPerformanceCounter
lstrcatW
lstrcpyW
SetLastError

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
BitBlt

user32

FillRect
GetComboBoxInfo
GetWindowLongW
GetClassNameW
MapWindowPoints
GetWindowRect
DestroyWindow
wsprintfW
CreateWindowExW
FindWindowW
GetCursorPos
GetSubMenu
SendDlgItemMessageW
EnableWindow
CheckDlgButton
SetWindowPos
MessageBoxW
SendMessageW
SetDlgItemInt
EmptyClipboard
DialogBoxParamW
GetDesktopWindow
LoadIconW
LoadMenuW
SetWindowLongW
ShowWindow
EndDialog
SetWindowTextW
SetTimer
HiliteMenuItem
TrackPopupMenuEx
SetDlgItemTextW
OpenClipboard
GetWindowTextW
SetClipboardData
CloseClipboard
CallWindowProcW
InvalidateRect
KillTimer
GetDlgItem
PostMessageW
GetDlgItemTextW
IsDlgButtonChecked
GetDlgItemInt

comctl32

ord17

comdlg32

GetOpenFileNameW
GetSaveFileNameW

shell32

Shell_NotifyIconW

ole32

CoCreateInstance
CoInitializeEx

msimg32

GradientFill

setupapi

SetupDiOpenDeviceInterfaceRegKey
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c42cf8a9066c61359281e56eb3fb6b68

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5dCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

bd:55:9c:d1:cb:50:2f:ad:be:27:d8:be:4f:1e:29:37:3e:cb:ec:cd:fb:24:53:df:80:54:62:0c:ff:bf:8f:fbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

comctl32

comdlg32

shell32

ole32

msimg32

setupapi

Sections

.text Size: 62KB - Virtual size: 62KB

.data Size: 1024B - Virtual size: 6KB

.rsrc Size: 15KB - Virtual size: 14KB

.reloc Size: 4KB - Virtual size: 3KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

bd:55:9c:d1:cb:50:2f:ad:be:27:d8:be:4f:1e:29:37:3e:cb:ec:cd:fb:24:53:df:80:54:62:0c:ff:bf:8f:fb
Signer

.text
Size: 62KB - Virtual size: 62KB

.data
Size: 1024B - Virtual size: 6KB

.rsrc
Size: 15KB - Virtual size: 14KB

.reloc
Size: 4KB - Virtual size: 3KB