f7ffcdd22e2073190af345def5613685c40ef4f744bdd3c6d86fc370c51f7d96

Sharing

Copy URL Twitter E-mail

General

Target

f7ffcdd22e2073190af345def5613685c40ef4f744bdd3c6d86fc370c51f7d96
Size

3.5MB
MD5

d63c49204184b21b978848824c9ac5a1
SHA1

387d277030153d8f7494f8a83c643bd46fc3d949
SHA256

f7ffcdd22e2073190af345def5613685c40ef4f744bdd3c6d86fc370c51f7d96
SHA512

ff4fad3aaf3636de0a19a1ad6378db45491d16d78c4579d26a478da158421277b0442581a5ead8a9e53c2626d0444c4a8d943c7e818ba987c1e41f90b51b0ca9
SSDEEP

49152:j5gzncingMLhseppezHi77mK+Bd4XmN3vIxU4:6SMuepEd6

Score

1^/10

Malware Config

Signatures

Files

f7ffcdd22e2073190af345def5613685c40ef4f744bdd3c6d86fc370c51f7d96
.exe windows:4 windows x86 arch:x86

dafd1be514a06c7374e8c9933958cc78

Code Sign

e8:ed:c8:dd:0d:2e:4e:0c:24:1a:57:e8:d5:9f:54:30
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

27/02/2016, 00:00

Not After

26/02/2017, 23:59

Subject

CN=Kama-Soft,O=Kama-Soft,POSTALCODE=614088,STREET=ul. Arhitektora Svijazeva\, 48\, 19,L=Perm,ST=RU,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8f:b4:f2:23:68:b4:ab:da:c6:14:76:22:49:4c:5d:5b:fd:f7:b1:5a
Signer

Actual PE Digest

8f:b4:f2:23:68:b4:ab:da:c6:14:76:22:49:4c:5d:5b:fd:f7:b1:5a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpEndRequestA

kernel32

GetCurrentProcessId
GlobalUnlock
ExpandEnvironmentStringsW
GetEnvironmentVariableW
ExitProcess
GetVersion
SetEnvironmentVariableW
GetModuleHandleA
WriteFile
WideCharToMultiByte
VirtualAlloc
GetOEMCP
GetACP
lstrlenA
GetDefaultCommConfigA
GetProcAddress
QueryPerformanceCounter
FreeLibrary
FindResourceA
GetVersionExA
LockResource
UnmapViewOfFile
LoadResource
CreateFileMappingW
FindResourceW
lstrcmpiA
GetCommandLineA
DeleteFileA
GetEnvironmentStrings
GetProcessHeap
HeapReAlloc
HeapAlloc
GetCPInfo
RtlUnwind
HeapFree
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
GetTickCount
GlobalFree
lstrcatA
LCMapStringA
SizeofResource
LCMapStringW
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
LoadLibraryA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount

user32

MessageBoxW
SetMenuItemInfoA
GetSystemMetrics
CreateWindowExA
MessageBoxA
CreateDialogParamA
GetUserObjectInformationA
GetClientRect
LoadKeyboardLayoutA
LoadStringA
ShowWindow

gdi32

Rectangle

advapi32

AllocateLocallyUniqueId
AllocateAndInitializeSid

ole32

CoUninitialize
CoCreateGuid

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.0031
Size: 840KB - Virtual size: 839KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dafd1be514a06c7374e8c9933958cc78

Code Sign

e8:ed:c8:dd:0d:2e:4e:0c:24:1a:57:e8:d5:9f:54:30Certificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

8f:b4:f2:23:68:b4:ab:da:c6:14:76:22:49:4c:5d:5b:fd:f7:b1:5aSigner

Headers

File Characteristics

Imports

wininet

kernel32

user32

gdi32

advapi32

ole32

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.0031 Size: 840KB - Virtual size: 839KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 10KB - Virtual size: 17KB

.tls Size: 512B - Virtual size: 21B

.rsrc Size: 136KB - Virtual size: 135KB

e8:ed:c8:dd:0d:2e:4e:0c:24:1a:57:e8:d5:9f:54:30
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

8f:b4:f2:23:68:b4:ab:da:c6:14:76:22:49:4c:5d:5b:fd:f7:b1:5a
Signer

.text
Size: 2.5MB - Virtual size: 2.5MB

.0031
Size: 840KB - Virtual size: 839KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 10KB - Virtual size: 17KB

.tls
Size: 512B - Virtual size: 21B

.rsrc
Size: 136KB - Virtual size: 135KB