audiorepeater_ks[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

audiorepeater_ks.exe
Size

105KB
MD5

ab860708fa2f4a96050033acaaed0994
SHA1

7a09b3b4bd76a9ba0d3514463a03a394728a3507
SHA256

5a49aebf631f7b9e4a5855d60075d1560f10607556ab02940265ae50983f21ec
SHA512

e9643fab997e188d137493e792e4be69ee335ab7b03354f58705047a8bdf9b8637a7dc6973ef133195554666eaf30aefad5719dbfd82913be6505c9264bb84b9
SSDEEP

1536:vUqYKCxBw6kwkSXGJzALnyGmuwaWcGzzkxiCV6LPVc/8QVsIOzjNFO0V:VyRfGJOnyGmkW5z0ik6Lu/8CyjNFO0V

Score

1^/10

Malware Config

Signatures

Files

audiorepeater_ks.exe
.exe windows:6 windows x64 arch:x64

b112e7a9bf3f16fc3f639f897a9559c8

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19-09-2018 00:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

26-05-2020 12:18

Not After

26-08-2023 12:18

Subject

SERIALNUMBER=316547600105556,CN=Muzychenko Evgenii Viktorovich\, IP,O=Muzychenko Evgenii Viktorovich\, IP,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c17736f667477617265406d757a796368656e6b6f2e6e6574,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19-02-2018 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:45:9b:fa:1c:4e:40:c8:ad:b4:38:04:0f:80:98:60:e1:2e:20:9a:b5:28:d9:3a:ef:8a:2a:ee:70:c0:09:b8
Signer

Actual PE Digest

5a:45:9b:fa:1c:4e:40:c8:ad:b4:38:04:0f:80:98:60:e1:2e:20:9a:b5:28:d9:3a:ef:8a:2a:ee:70:c0:09:b8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

s:\music\software\win\audiorepeater\1xxks\objfre_wnet_amd64\amd64\audiorepeater_ks.pdb

Imports

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW

kernel32

Sleep
SetWaitableTimer
SetThreadPriority
GetCurrentThread
CreateWaitableTimerW
CreateEventW
RtlFillMemory
WaitForSingleObject
GetStartupInfoW
CreateFileW
CreateThread
SetPriorityClass
OpenProcess
GetCurrentProcessId
WaitForMultipleObjects
GetProcAddress
QueryPerformanceFrequency
GetModuleFileNameW
GetModuleHandleW
lstrlenA
lstrlenW
lstrcmpiW
SetLastError
WriteFile
GetLastError
ReadFile
GetFileSizeEx
FreeLibrary
DeviceIoControl
CloseHandle
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
LoadLibraryW
GetOverlappedResult
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryA
HeapFree
GetProcessHeap
HeapAlloc
GetVersionExW
GetSystemInfo
RtlMoveMemory
FormatMessageW
GetCommandLineW
RtlCaptureContext
ExitProcess
SetEvent
RtlZeroMemory
QueryPerformanceCounter
lstrcatW
lstrcpyW
GetACP

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
BitBlt

user32

GetClassNameW
MapWindowPoints
GetWindowRect
DestroyWindow
SetWindowPos
CreateWindowExW
GetWindowLongW
FillRect
LoadMenuW
SendDlgItemMessageW
EnableWindow
CheckDlgButton
SetWindowTextW
GetComboBoxInfo
SendMessageW
SetDlgItemInt
GetDlgItemInt
wsprintfW
MessageBoxW
EndDialog
FindWindowW
DialogBoxParamW
ShowWindow
SetTimer
GetDesktopWindow
LoadIconW
SetWindowLongPtrW
GetCursorPos
GetSubMenu
HiliteMenuItem
TrackPopupMenuEx
OpenClipboard
EmptyClipboard
GetWindowTextW
SetClipboardData
CloseClipboard
CallWindowProcW
InvalidateRect
KillTimer
GetDlgItem
PostMessageW
GetDlgItemTextW
IsDlgButtonChecked
SetDlgItemTextW

comctl32

ord17

comdlg32

GetOpenFileNameW
GetSaveFileNameW

shell32

Shell_NotifyIconW

ole32

CoCreateInstance
CoInitializeEx

msimg32

GradientFill

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiOpenDeviceInterfaceRegKey
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 538B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b112e7a9bf3f16fc3f639f897a9559c8

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5dCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

5a:45:9b:fa:1c:4e:40:c8:ad:b4:38:04:0f:80:98:60:e1:2e:20:9a:b5:28:d9:3a:ef:8a:2a:ee:70:c0:09:b8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

comctl32

comdlg32

shell32

ole32

msimg32

setupapi

Sections

.text Size: 76KB - Virtual size: 76KB

.data Size: 1KB - Virtual size: 7KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 15KB - Virtual size: 14KB

.reloc Size: 1024B - Virtual size: 538B

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

5b:98:bb:1d:56:df:0c:02:5d:55:b7:5d
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

5a:45:9b:fa:1c:4e:40:c8:ad:b4:38:04:0f:80:98:60:e1:2e:20:9a:b5:28:d9:3a:ef:8a:2a:ee:70:c0:09:b8
Signer

.text
Size: 76KB - Virtual size: 76KB

.data
Size: 1KB - Virtual size: 7KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 15KB - Virtual size: 14KB

.reloc
Size: 1024B - Virtual size: 538B